paascloud/paascloud-master · error · UacBizException

UAC10015003

UAC10015003

Error message

操作越权, 启用子节点, 必须先启用父节点

What it means

UAC10015003 ("操作越权, 启用子节点, 必须先启用父节点") is thrown when enabling a child group whose parent group is still DISABLE. The hierarchy invariant requires a parent to be enabled before its children, so the operation is rejected as an out-of-order privilege/state operation.

Solutions

  1. Enable the parent group first, then the child (top-down order)
  2. Catch UacBizException UAC10015003 and prompt the user to enable the parent organization first
  3. In batch operations, sort groups by depth (parent before child) before enabling

Example fix

// before
uacGroupService.updateUacGroupStatusById(childGroupId, UacGroupStatusEnum.ENABLE.getStatus());
// after
UacGroup parent = uacGroupMapper.selectByPrimaryKey(child.getPid());
if (parent.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {
    uacGroupService.updateUacGroupStatusById(parent.getId(), UacGroupStatusEnum.ENABLE.getStatus()); // enable parent first
}
uacGroupService.updateUacGroupStatusById(childGroupId, UacGroupStatusEnum.ENABLE.getStatus());
Defensive patterns

Strategy: try-catch

Validate before calling

UacGroup parent = uacGroupMapper.selectByPrimaryKey(childGroup.getPid());
if (parent != null && parent.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {
    throw new IllegalStateException("Enable parent first");
}

Try / catch

try {
    uacGroupService.updateUacGroupStatusById(childId, UacGroupStatusEnum.ENABLE.getStatus());
} catch (UacBizException e) {
    if (ErrorCodeEnum.UAC10015003.getCode().equals(e.getCode())) { /* enable parent first, then retry */ }
    else throw e;
}

Prevention

When it happens

Trigger: Calling updateUacGroupStatusById(childGroupId, ENABLE) where the child has a parent (uacGroup1.getpId()) whose status is UacGroupStatusEnum.DISABLE.

Common situations: Bulk-enable scripts iterating children before parents; restoring a subtree from a dump with parents still disabled; UI enabling leaf nodes directly from a ztree without checking parent state.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/cd77a906eaf72df6. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-provider/paascloud-provider-uac/src/main/java/com/paascloud/provider/service/impl/UacGroupServiceImpl.java:130

			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}
		if (groupUser.getGroupId().equals(uacGroup.getId()) && UacGroupStatusEnum.ENABLE.getStatus() == group.getStatus()) {
			throw new UacBizException(ErrorCodeEnum.UAC10011023);
		}
		uacGroup.setGroupName(group.getGroupName());
		uacGroup.setGroupCode(group.getGroupCode());
		uacGroup.setVersion(group.getVersion() + 1);
		int result = uacGroupMapper.updateByPrimaryKeySelective(uacGroup);
		// 获取当前所选组织的所有子节点
		List<GroupZtreeVo> childUacGroupList = this.getGroupTree(uacGroup.getId());
		// 批量修改组织状态
		if (PublicUtil.isNotEmpty(childUacGroupList)) {
			UacGroup childGroup;
			for (GroupZtreeVo uacGroup1 : childUacGroupList) {
				if (UacGroupStatusEnum.ENABLE.getStatus() == status) {
					UacGroup parentGroup = uacGroupMapper.selectByPrimaryKey(uacGroup1.getpId());
					if (parentGroup.getStatus() == UacGroupStatusEnum.DISABLE.getStatus()) {
						throw new UacBizException(ErrorCodeEnum.UAC10015003);
					}
				}
				childGroup = new UacGroup();
				childGroup.setStatus(uacGroup.getStatus());
				childGroup.setId(uacGroup1.getId());
				result = uacGroupMapper.updateByPrimaryKeySelective(childGroup);
				if (result < 1) {
					throw new UacBizException(ErrorCodeEnum.UAC10015006, uacGroup1.getId());
				}
			}
		}
		return result;
	}

	@Override
	public int deleteUacGroupById(Long id) {

		Preconditions.checkArgument(id != null, "组织id为空");

View on GitHub (pinned to 781281a950)