jeecgboot/JeecgBoot · error · JeecgBootBizTipException

你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！

Error message

你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！

What it means

Thrown by SysTenantPackServiceImpl.izHaveManageUserAuth after querying sysTenantPackMapper.izHaveManageUserAuth(tenantId, currentUserId) returns count 0. The method is a gatekeeper: only accountAdmin or superAdmin roles within the target tenant may perform user-management operations. JeecgBootBizTipException is used (not JeecgBootException) so the message surfaces directly to the API consumer as a tip.

Solutions

  1. Confirm the current user is assigned the accountAdmin or superAdmin role within the target tenant via the tenant pack user list.
  2. If operating cross-tenant, ensure the admin is added to the target tenant's pack first.
  3. Check that the tenantId sent in the request matches the tenant the user actually administers.
  4. Re-authenticate / refresh the token after a role change so the new permissions take effect.

Example fix

// before
sysTenantPackService.izHaveManageUserAuth(targetTenantId);

// after
LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
// verify locally before calling, or catch the tip and show a friendly message
try {
    sysTenantPackService.izHaveManageUserAuth(targetTenantId);
} catch (JeecgBootBizTipException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("您无权管理该组织用户，请联系组织管理员授权。");
    }
    throw e;
}
Defensive patterns

Strategy: try-catch

Validate before calling

LoginUser me = (LoginUser) SecurityUtils.getSubject().getPrincipal();
long cnt = sysTenantPackMapper.izHaveManageUserAuth(targetTenantId, me.getId());
if (cnt == 0) {
    return Result.error("无管理用户权限，请联系组织管理员");
}

Try / catch

try {
    sysTenantPackService.izHaveManageUserAuth(tenantId);
} catch (JeecgBootBizTipException e) {
    if (e.getMessage().contains("管理员")) {
        return Result.error("权限不足：需要组织账户管理员或超级管理员身份");
    }
    throw e;
}

Prevention

When it happens

Trigger: Calling any user-management endpoint (add/remove/invite users in a tenant pack) when the authenticated user holds neither the account-admin nor super-admin role for the specified tenantId. The check runs server-side even if the UI hid the button.

Common situations: A regular member of a tenant tries to call the management API directly; a superAdmin from tenant A operates on tenant B without being in B's pack; role assignment was revoked but the user's session/token is still valid; tenantId mismatch (operator passed the wrong tenant).

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/557a7e6eeb197e08. Report an issue: GitHub.

Appendix: source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/service/impl/SysTenantPackServiceImpl.java:493

            sysTenantPackMapper.updateById(pack);
            //同步默认套餐报下的所有用户已
            if (oConvertUtils.isNotEmpty(sysTenantPack.getIzSysn()) && CommonConstant.STATUS_1.equals(sysTenantPack.getIzSysn())) {
                this.addPackUserByPackTenantId(pack.getTenantId(), pack.getId());
            }
        }
    }


    /**
     * 是否为拥有管理用户权限【accountAdmin，superAdmin】
     * @param tenantId
     */
    @Override
    public void izHaveManageUserAuth(String tenantId) {
        LoginUser sysUser = (LoginUser) SecurityUtils.getSubject().getPrincipal();
        long count = sysTenantPackMapper.izHaveManageUserAuth(tenantId,sysUser.getId());
        if(count == 0){
            throw new JeecgBootBizTipException("你不是当前租户的组织账户管理员或超级管理员，无法进行此操作！");
        }
    }
}

View on GitHub (pinned to 96fb33f5ec)