paascloud/paascloud-master · warning · UacBizException

UAC10011034

UAC10011034

Error message

ErrorCodeEnum.UAC10011034

What it means

UacBizException with ErrorCodeEnum.UAC10011034 ("不允许操作admin用户") is thrown by UacUserServiceImpl.bindUserRoles when the target operUserId equals GlobalConstant.Sys.SUPER_MANAGER_USER_ID. The built-in super-admin (admin) account is protected: no user may change its role bindings.

Solutions

  1. Exclude the super-admin userId (GlobalConstant.Sys.SUPER_MANAGER_USER_ID) from any role-editing UI or batch job
  2. Catch UacBizException code 10011034 and skip/show 'cannot modify admin user'
  3. Filter the target list: Objects.equals(id, SUPER_MANAGER_USER_ID) → skip

Example fix

// before
for (Long uid : userIds) {
    bindRoles(uid, roleIds);
}
// after
for (Long uid : userIds) {
    if (Objects.equals(uid, GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) continue;
    bindRoles(uid, roleIds);
}
Defensive patterns

Strategy: validation

Validate before calling

if (Objects.equals(dto.getUserId(), GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) {
    throw new BusinessException("admin user is protected");
}

Try / catch

try {
    uacUserService.bindUserRoles(dto, authResDto);
} catch (UacBizException e) {
    if (e.getCode() == 10011034) { /* skip protected admin user */ }
    else throw e;
}

Prevention

When it happens

Trigger: Calling bindUserRoles with the super-admin's userId as the target of role modification.

Common situations: Bulk role-assignment scripts iterating all users including admin; UI list not excluding the admin account from role editing; imported user data reusing the reserved admin id.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/b5d1460b47ee040f. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacUserServiceImpl.java:295

	@Override
	public void bindUserRoles(BindUserRolesDto bindUserRolesDto, LoginAuthDto authResDto) {

		if (bindUserRolesDto == null) {
			logger.error("参数不能为空");
			throw new IllegalArgumentException("参数不能为空");
		}

		Long operUserId = bindUserRolesDto.getUserId();
		Long loginUserId = authResDto.getUserId();
		List<Long> roleIdList = bindUserRolesDto.getRoleIdList();

		if (null == operUserId) {
			throw new UacBizException(ErrorCodeEnum.UAC10011001);
		}

		// 任何用户不能操作admin用户
		if (Objects.equals(operUserId, GlobalConstant.Sys.SUPER_MANAGER_USER_ID)) {
			throw new UacBizException(ErrorCodeEnum.UAC10011034);
		}

		UacUser user = this.queryByUserId(operUserId);

		if (user == null) {
			logger.error("找不到用户信息 operUserId={}", operUserId);
			throw new UacBizException(ErrorCodeEnum.UAC10011003, operUserId);
		}

		if (PublicUtil.isNotEmpty(roleIdList) && roleIdList.contains(GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
			logger.error("操作超级管理员角色 userId={}", loginUserId);
			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}

		// 1. 先取消对该角色的用户绑定(不包含超级管理员用户)
		List<UacRoleUser> userRoles = uacRoleUserService.listByUserId(operUserId);

		if (PublicUtil.isNotEmpty(userRoles)) {

View on GitHub (pinned to 781281a950)