yikart/AiToEarn · error · UnauthorizedException

需要管理员权限1

Error message

需要管理员权限1

What it means

ManagerGuard verifies the JWT successfully but throws '需要管理员权限1' when the payload lacks the isManager claim (or it is falsy). The token is valid, but its owner is not a manager, so the admin route is denied.

Source

Thrown at project/aitoearn-electron/server/src/auth/manager.guard.ts:57

    ]);

    if (!isManager || isPublic) {
      return true;
    }

    const request = context.switchToHttp().getRequest();
    const token = this.extractTokenFromHeader(request);
    if (!token) {
      throw new UnauthorizedException('token不存在,需要管理员权限');
    }

    try {
      const payload = await this.jwtService.verifyAsync(token, {
        secret: process.env.AUTH_SECRET,
      });

      if (!payload.isManager) {
        throw new UnauthorizedException('需要管理员权限1');
      }

      request['user'] = payload;
    } catch {
      throw new UnauthorizedException('需要管理员权限2');
    }
    return true;
  }

  private extractTokenFromHeader(request: Request): string | undefined {
    const [type, token] = request.headers.authorization?.split(' ') ?? [];
    return type === 'Bearer' ? token : undefined;
  }
}

View on GitHub (pinned to d3aa8bea5b)

Solutions

1. Obtain a token from a manager account (isManager: true in payload).
2. Ensure the login/signing code includes isManager in the JWT payload for managers.
3. Re-issue the token after promoting a user to manager.
4. Confirm the token belongs to the intended environment with correct role data.

Example fix

// before
jwtService.sign({ sub: user.id });
// after
jwtService.sign({ sub: user.id, isManager: user.isManager });

function isManagerToken(token) {
  try {
    const payload = JSON.parse(atob(token.replace('Bearer ', '').split('.')[1]));
    return payload.isManager === true;
  } catch { return false; }
}
if (!isManagerToken(myToken)) throw new Error('当前账号不是管理员');

function isManagerPayload(p) {
  return typeof p === 'object' && p !== null && p.isManager === true;
}

try {
  await adminApi.call(managerToken);
} catch (e) {
  if (e?.response?.status === 401 && e.message.includes('需要管理员权限1')) {
    throw new Error('请使用管理员账号登录，当前 token 不含 isManager 权限');
  } else throw e;
}

When it happens

Trigger: A regular (non-manager) user's valid JWT hits a route guarded by ManagerGuard; or a token issued without isManager: true in the sign payload.

Common situations: Testing with a normal user token against admin endpoints; manager flag not set at login/token-signing time; role changes not reflected until token refresh; tokens from another environment lacking the claim.

Related errors

• token不存在,需要管理员权限
• 需要管理员权限2
• Token已过期，请重新登录
• Token校验失败，请重新登录
• userId is required

AI-assisted analysis of yikart/AiToEarn@d3aa8bea5b (2026-08-31). Data as JSON: /api/errors/d341cc8f0251a504. Report an issue: GitHub.