jeecgboot/JeecgBoot · error · JeecgBootException

您不是当前组织的创建者，无法删除用户！

Error message

您不是当前组织的创建者，无法删除用户！

What it means

Thrown by SysTenantServiceImpl.deleteUser at step1. Before any deletion it loads the SysTenant row by tenantId and requires that the current logged-in user's username exactly equals sysTenant.createBy. If the tenant does not exist or the current user is not its recorded creator, deletion is refused.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantServiceImpl.java:972

    }

    @Override
    public List<SysTenant> getTenantListByUserId(String userId) {
        return tenantMapper.getTenantListByUserId(userId);
    }

    @Override
    public void deleteUser(SysUser sysUser, Integer tenantId) {
        //被删除人的用户id
        String userId = sysUser.getId();
        //被删除人的密码
        String password = sysUser.getPassword();
        //当前登录用户
        LoginUser user = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        //step1 判断当前用户是否为当前租户的创建者才可以删除
        SysTenant sysTenant = this.getById(tenantId);
        if(null == sysTenant || !user.getUsername().equals(sysTenant.getCreateBy())){
            throw new JeecgBootException("您不是当前组织的创建者，无法删除用户！");
        }
        //step2 判断除了当前组织之外是否还有加入了其他组织
        LambdaQueryWrapper<SysUserTenant> query = new LambdaQueryWrapper<>();
        query.eq(SysUserTenant::getUserId,userId);
        query.ne(SysUserTenant::getTenantId,tenantId);
        List<SysUserTenant> sysUserTenants = userTenantMapper.selectList(query);
        if(CollectionUtils.isNotEmpty(sysUserTenants)){
            throw new JeecgBootException("该用户还存在于其它组织中，无法删除用户！");
        }
        //step3 验证创建时间和密码
        SysUser sysUserData = userService.getById(userId);
        this.verifyCreateTimeAndPassword(sysUserData,password);
        //step4 真实删除用户
        userService.deleteUser(userId);
        userService.removeLogicDeleted(Collections.singletonList(userId));
    }

    /**

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Verify the current login user's username equals sys_tenant.create_by for the given tenantId before calling deleteUser.
  2. Ensure the request sends the correct tenantId (the organization the user is actually being removed from).
  3. If the creator was renamed, update sys_tenant.create_by to the current creator username, or perform deletion as that original creator.
  4. Confirm the tenant row exists - a null sysTenant also triggers this message.

Example fix

// guard before calling deleteUser
SysTenant t = sysTenantService.getById(tenantId);
if (t == null || !currentUser.getUsername().equals(t.getCreateBy())) {
    return Result.error("无权操作：仅组织创建者可删除用户");
}
sysTenantService.deleteUser(sysUser, tenantId);
Defensive patterns

Strategy: validation

Validate before calling

LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
SysTenant t = sysTenantService.getById(tenantId);
if (t == null || !me.getUsername().equals(t.getCreateBy())) {
    return Result.error("仅组织创建者可执行此操作");
}

Type guard

boolean isCreator(SysTenant t, LoginUser u) {
  return t != null && u != null && u.getUsername() != null && u.getUsername().equals(t.getCreateBy());
}

Try / catch

try { sysTenantService.deleteUser(sysUser, tenantId); }
catch (JeecgBootException e) {
  if (e.getMessage().contains("创建者")) return Result.error("无权操作");
  throw e;
}

Prevention

When it happens

Trigger: POST to the delete-tenant-user endpoint with a tenantId for which the current user is not the creator, or a tenantId that does not exist (returns null, also trips the guard).

Common situations: A tenant admin (non-creator) tries to remove a member; the tenant was created by a user whose username was since renamed; tenantId from the request is wrong/zero; multi-tenant context switched so SecurityUtils principal no longer matches createBy.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/17762af662f3f031. Report an issue: GitHub.