jeecgboot/JeecgBoot · error · JeecgBootException

您不是当前组织的管理员，无法删除用户！

Error message

您不是当前组织的管理员，无法删除用户！

What it means

deleteUserByPassword throws (step1) when sysTenantPackUserMapper.izHaveBuyAuth(currentUserId, tenantId) returns null or 0 — the operator is neither super-admin nor account-admin for the tenant, so they lack authority to delete a user from it. This is the first guard in the delete-user flow.

Solutions

  1. Ensure the operator holds superAdmin or accountAdmin role in the target tenant (check tenant pack user assignments).
  2. Verify the tenantId in the request matches a tenant the operator administers.
  3. Re-login / refresh token after role changes.
  4. Frontend should hide the delete action for non-admins and surface a clear permission message.

Example fix

// before
tenantService.deleteUserByPassword(targetUser, tenantId);

// after
Long auth = sysTenantPackUserMapper.izHaveBuyAuth currentUser().getId(), tenantId);
if (auth == null || auth == 0) {
    return Result.error("无权限：需要组织管理员身份");
}
tenantService.deleteUserByPassword(targetUser, tenantId);
Defensive patterns

Strategy: validation

Validate before calling

Long auth = sysTenantPackUserMapper.izHaveBuyAuth(currentUser().getId(), tenantId);
if (auth == null || auth == 0) {
    return Result.error("需要组织管理员权限");
}

Try / catch

try {
    tenantService.deleteUserByPassword(targetUser, tenantId);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("无删除权限：仅组织管理员可操作");
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling deleteUserByPassword while authenticated as a user without admin rights in the target tenant. The check runs server-side regardless of UI button visibility.

Common situations: A non-admin invokes the delete API directly; admin rights were revoked but the token is still valid; operating on the wrong tenantId; the operator is admin in one tenant but tries to delete a user from another.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/0821160f275a6de4. Report an issue: GitHub.

Appendix: source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java:903

        sysTenantPackUserMapper.deletePackUserByTenantIds(tenantIdList);
        //2.删除产品包对应的菜单权限
        sysPackPermissionMapper.deletePackPermByTenantIds(tenantIdList);
        //3.删除产品包
        sysTenantPackMapper.deletePackByTenantIds(tenantIdList);
    }

    @Override
    public void deleteUserByPassword(SysUser sysUser, Integer tenantId) {
        //被删除人的用户id
        String userId = sysUser.getId();
        //被删除人的密码
        String password = sysUser.getPassword();
        //当前登录用户
        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        //step1 判断当前用户是否为当前租户的管理员(只有超级管理员和账号管理员可以删除)
        Long isHaveAdmin = sysTenantPackUserMapper.izHaveBuyAuth(user.getId(), tenantId);
        if(null == isHaveAdmin || 0 == isHaveAdmin){
            throw new JeecgBootException("您不是当前组织的管理员，无法删除用户！");
        }
        //step2 离职状态下，并且无其他组织情况下，可以删除
        SysUserTenant sysUserTenant = userTenantMapper.getUserTenantByTenantId(userId, tenantId);
        if(null == sysUserTenant || !CommonConstant.USER_TENANT_QUIT.equals(sysUserTenant.getStatus())){
            throw new JeecgBootException("用户没有离职，不允许删除！"); 
        }
        List<Integer> tenantIdsByUserId = userTenantMapper.getTenantIdsByUserId(userId);
        if(CollectionUtils.isNotEmpty(tenantIdsByUserId) && tenantIdsByUserId.size()>0){
            throw new JeecgBootException("用户尚有未退出的组织，无法删除！");
        }
        //step3 当天创建的用户和创建人可以删除
        SysUser sysUserData = userService.getById(userId);
        if(!sysUserData.getCreateBy().equals(user.getUsername())){
            throw new JeecgBootException("您不是该用户的创建人，无法删除！");
        }
        
        // 代码逻辑说明: 【QQYUN-11839】删除用户，需要输入被删除用户的密码，这逻辑对吗？不应该是管理员的密码吗---
        this.verifyCreateTimeAndPassword(sysUserData,password);

View on GitHub (pinned to 96fb33f5ec)