paascloud/paascloud-master · error · UacBizException

UAC10012003

UAC10012003

Error message

系统角色不能删除

What it means

UacBizException UAC10012003 ('系统角色不能删除' / system role cannot be deleted) thrown by UacRoleServiceImpl.deleteRoleById when the target roleId equals GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID. The built-in super-admin role is protected from deletion to keep the system administrable.

Solutions

1. Exclude the SUPER_MANAGER_ROLE_ID from any bulk delete set before iterating
2. Filter the super role out of delete-eligible role lists in the UI
3. Return a clear message to the user that the system role is protected

Example fix

// before
roleIds.forEach(id -> uacRoleService.deleteRoleById(id));
// after
roleIds.stream()
    .filter(id -> !Objects.equals(id, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID))
    .forEach(id -> uacRoleService.deleteRoleById(id));

if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
    return Result.error("系统角色不能删除");
}

boolean isSystemRole(Long roleId) { return Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID); }

try {
    uacRoleService.deleteRoleById(roleId);
} catch (UacBizException e) {
    if (ErrorCodeEnum.UAC10012003.getCode().equals(e.getCode())) {
        return Result.error("系统内置角色不允许删除");
    }
    throw e;
}

When it happens

Trigger: Attempting to delete the super-manager role: calling deleteRoleById with the well-known super admin role ID, whether directly via API or through a UI that does not filter it out of the delete list.

Common situations: Admin script iterating over all roles and deleting them; UI lacking the super-role guard; data restore/migration re-adding delete requests for the protected role.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• UAC10011023
• UAC10012001
• UAC10012001
• UAC10012005
• UAC10011001

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/32c193b8d0747d45. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacRoleServiceImpl.java:78

		return uacRoleMapper.findByRoleCode(roleCode);
	}

	@Override
	@Transactional(readOnly = true, rollbackFor = Exception.class)
	public List<RoleVo> queryRoleListWithPage(UacRole role) {
		return uacRoleMapper.queryRoleListWithPage(role);
	}

	@Override
	public int deleteRoleById(Long roleId) {
		//查询该角色下是否有用户绑定, 有的话提醒不能删除
		if (null == roleId) {
			throw new IllegalArgumentException(ErrorCodeEnum.UAC10012001.msg());
		}

		// 超级管理员不能删除
		if (Objects.equals(roleId, GlobalConstant.Sys.SUPER_MANAGER_ROLE_ID)) {
			throw new UacBizException(ErrorCodeEnum.UAC10012003);
		}

		List<UacRoleUser> uruList = uacRoleUserService.listByRoleId(roleId);

		if (!uruList.isEmpty()) {
			uacRoleUserService.deleteByRoleId(roleId);
		}

		uacRoleActionService.deleteByRoleId(roleId);
		uacRoleMenuService.deleteByRoleId(roleId);
		return uacRoleMapper.deleteByPrimaryKey(roleId);
	}

	@Override
	public int saveRole(UacRole role, LoginAuthDto loginAuthDto) {
		int result = 0;
		role.setUpdateInfo(loginAuthDto);
		if (role.isNew()) {

View on GitHub (pinned to 781281a950)