paascloud/paascloud-master · error · UacBizException

UAC10011023

UAC10011023

Error message

越权操作

What it means

UacBizException with code UAC10011023 thrown by UacUserMainController.getBindRole when the requested userId equals the currently authenticated user's id. Users are not permitted to view their own role-binding page, as a safeguard against self-modification of role assignments.

Solutions

1. Request the bind-role data for a different userId than the logged-in user
2. Filter the current user out of the UI list before offering the bind-role action
3. Handle UAC10011023 in the client and show a 'cannot manage your own roles' message
4. If self-management is required, the business rule in getBindRole must be changed in code

Example fix

// before
POST /user/bindRole/1001  // current user id is 1001 -> 越权操作
// after
POST /user/bindRole/1002  // target a different user, or manage own roles via a dedicated flow

if (targetUserId === currentUserId) {
  showNotice('不能管理自己的角色绑定');
  return; // don't call the API
}

function canViewBindRole(targetUserId, currentUserId) { return targetUserId !== currentUserId; }

try { return await getBindRole(userId); }
catch (e) {
  if (String(e.message).includes('越权操作')) {
    // show 'cannot manage own roles' and redirect to user list
  }
}

When it happens

Trigger: POST /user/bindRole/{userId} (getBindRole) where the path userId equals loginAuthDto.getUserId(), i.e. an admin opens the bind-role page for their own account.

Common situations: Admin clicking 'bind roles' on their own row in the user management UI; scripted bulk fetch of bind-role data that includes the caller's own id; UI not filtering out the current user from the actionable list.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• UAC10012002
• UAC10011040
• UAC10013007
• UAC10011023
• UAC10011034

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/4d551f3a1ca33d00. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/web/admin/UacUserMainController.java:157

		int result = uacUserService.deleteUserById(userId);
		return handleResult(result);
	}

	/**
	 * 获取用户绑定角色页面数据.
	 *
	 * @param userId the user id
	 *
	 * @return the bind role
	 */
	@PostMapping(value = "/getBindRole/{userId}")
	@ApiOperation(httpMethod = "POST", value = "获取用户绑定角色页面数据")
	public Wrapper<UserBindRoleVo> getBindRole(@ApiParam(name = "userId", value = "角色id") @PathVariable Long userId) {
		logger.info("获取用户绑定角色页面数据. userId={}", userId);
		LoginAuthDto loginAuthDto = super.getLoginAuthDto();
		Long currentUserId = loginAuthDto.getUserId();
		if (Objects.equals(userId, currentUserId)) {
			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}

		UserBindRoleVo bindUserDto = uacUserService.getUserBindRoleDto(userId);
		return WrapMapper.ok(bindUserDto);
	}

	/**
	 * 用户绑定角色.
	 *
	 * @param bindUserRolesDto the bind user roles dto
	 *
	 * @return the wrapper
	 */
	@PostMapping(value = "/bindRole")
	@LogAnnotation
	@ApiOperation(httpMethod = "POST", value = "用户绑定角色")
	public Wrapper<Integer> bindUserRoles(@ApiParam(name = "bindUserRolesDto", value = "用户绑定角色Dto") @RequestBody BindUserRolesDto bindUserRolesDto) {
		logger.info("用户绑定角色 bindUserRolesDto={}", bindUserRolesDto);

View on GitHub (pinned to 781281a950)