paascloud/paascloud-master · error · UacBizException

UAC10012002

UAC10012002

Error message

拥有的角色不允许禁用

What it means

UacBizException with code UAC10012002 thrown by UacRoleMainController.modifyUacRoleStatusById when the caller attempts to disable (UacRoleStatusEnum.DISABLE) a role that the currently logged-in user owns (a UacRoleUser row exists linking them). This is a self-protection rule preventing users from locking themselves out of their own roles.

Solutions

1. Log in as a different user who does not hold the target role, then disable it
2. First unassign the role from the current user (delete the UacRoleUser binding), then disable the role
3. Change the target role's id in the request to one the caller does not own
4. If the disable is intentional for self-owned roles, the business rule must be changed in code

Example fix

// before
{"id": 5, "status": "DISABLE"}  // caller owns role 5
// after
// reassign/disable as a user who does not hold role 5
{"id": 5, "status": "DISABLE"}  // executed by another admin

// client-side guard: don't offer 'disable' for roles the current user holds
if (currentUserRoleIds.includes(roleId) && newStatus === 'DISABLE') {
  alert('不能禁用自己拥有的角色');
  return;
}

function canDisable(roleId, currentUserRoleIds) { return !currentUserRoleIds.includes(roleId); }

When it happens

Trigger: POST /modifyRoleStatusById with status='DISABLE' where uacRoleUserService.getByUserIdAndRoleId(loginUserId, roleId) returns a non-null row, i.e. the authenticated user currently holds the role being disabled.

Common situations: Admin testing the disable endpoint on their own admin role; bulk-disable scripts that don't exclude roles assigned to the executing user; status flips to DISABLE accidentally sent for roles the caller owns.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• UAC10011023
• UAC10011040
• UAC10013007
• UAC10011023
• UAC10011034

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/4fb7660cc1a0c2d2. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/web/admin/UacRoleMainController.java:129

	 * @return the wrapper
	 */
	@LogAnnotation
	@PostMapping(value = "/modifyRoleStatusById")
	@ApiOperation(httpMethod = "POST", value = "根据角色Id修改角色状态")
	public Wrapper modifyUacRoleStatusById(@ApiParam(name = "modifyRoleStatusDto", value = "修改角色状态数据") @RequestBody ModifyStatusDto modifyStatusDto) {
		logger.info("根据角色Id修改角色状态 modifyStatusDto={}", modifyStatusDto);
		Long roleId = modifyStatusDto.getId();
		if (roleId == null) {
			throw new UacBizException(ErrorCodeEnum.UAC10012001);
		}

		LoginAuthDto loginAuthDto = getLoginAuthDto();
		Long userId = loginAuthDto.getUserId();

		UacRoleUser ru = uacRoleUserService.getByUserIdAndRoleId(userId, roleId);

		if (ru != null && UacRoleStatusEnum.DISABLE.getType().equals(modifyStatusDto.getStatus())) {
			throw new UacBizException(ErrorCodeEnum.UAC10012002);
		}

		UacRole uacRole = new UacRole();
		uacRole.setId(roleId);
		uacRole.setStatus(modifyStatusDto.getStatus());
		uacRole.setUpdateInfo(loginAuthDto);

		int result = uacRoleService.update(uacRole);
		return super.handleResult(result);
	}


	/**
	 * 保存用户.
	 *
	 * @param role the role
	 *
	 * @return the wrapper

View on GitHub (pinned to 781281a950)