jeecgboot/JeecgBoot · error · JeecgBootBizTipException

你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！

Error message

你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！

What it means

Thrown by SysTenantPackServiceImpl.izHaveManageUserAuth after querying sysTenantPackMapper.izHaveManageUserAuth(tenantId, currentUserId) returns count 0. The method is a gatekeeper: only accountAdmin or superAdmin roles within the target tenant may perform user-management operations. JeecgBootBizTipException is used (not JeecgBootException) so the message surfaces directly to the API consumer as a tip.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantPackServiceImpl.java:493

            sysTenantPackMapper.updateById(pack);
            //同步默认套餐报下的所有用户已
            if (oConvertUtils.isNotEmpty(sysTenantPack.getIzSysn()) && CommonConstant.STATUS_1.equals(sysTenantPack.getIzSysn())) {
                this.addPackUserByPackTenantId(pack.getTenantId(), pack.getId());
            }
        }
    }


    /**
     * 是否为拥有管理用户权限【accountAdmin，superAdmin】
     * @param tenantId
     */
    @Override
    public void izHaveManageUserAuth(String tenantId) {
        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        long count = sysTenantPackMapper.izHaveManageUserAuth(tenantId,sysUser.getId());
        if(count == 0){
            throw new JeecgBootBizTipException("你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！");
        }
    }
}

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. Confirm the current user is assigned the accountAdmin or superAdmin role within the target tenant via the tenant pack user list.
2. If operating cross-tenant, ensure the admin is added to the target tenant's pack first.
3. Check that the tenantId sent in the request matches the tenant the user actually administers.
4. Re-authenticate / refresh the token after a role change so the new permissions take effect.

Example fix

// before
sysTenantPackService.izHaveManageUserAuth(targetTenantId);

// after
LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
// verify locally before calling, or catch the tip and show a friendly message
try {
    sysTenantPackService.izHaveManageUserAuth(targetTenantId);
} catch (JeecgBootBizTipException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("您无权管理该组织用户，请联系组织管理员授权。");
    }
    throw e;
}

LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
long cnt = sysTenantPackMapper.izHaveManageUserAuth(targetTenantId, me.getId());
if (cnt == 0) {
    return Result.error("无管理用户权限，请联系组织管理员");
}

try {
    sysTenantPackService.izHaveManageUserAuth(tenantId);
} catch (JeecgBootBizTipException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("权限不足：需要组织账户管理员或超级管理员身份");
    }
    throw e;
}

When it happens

Trigger: Calling any user-management endpoint (add/remove/invite users in a tenant pack) when the authenticated user holds neither the account-admin nor super-admin role for the specified tenantId. The check runs server-side even if the UI hid the button.

Common situations: A regular member of a tenant tries to call the management API directly; a superAdmin from tenant A operates on tenant B without being in B's pack; role assignment was revoked but the user's session/token is still valid; tenantId mismatch (operator passed the wrong tenant).

Related errors

• 您不是当前组织的管理员，无法删除用户！
• 管理员已拒绝您加入租户,请联系租户管理员
• 账号已被锁定,请联系管理员!
• 当前用户不存在，请核对手机号
• 手机号用户:{phone} 昵称：{realname}，{tenantErrorInfo}

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/557a7e6eeb197e08. Report an issue: GitHub.