Tencent/WeKnora · error

join request not found

Error message

join request not found

What it means

The validator walks each FROM item and, when checkSchemaAccess is enabled, only permits tables in the `public` schema. A RangeVar whose Schemaname is set and is not `public` (e.g. `information_schema.tables`, `pg_catalog.pg_tables`, `app.orders`) is rejected to keep queries inside the allowed schema surface.

Source

Thrown at internal/application/repository/organization.go:242

		Where("organization_id = ?", orgID).
		Count(&count).Error
	return count, err
}

// UpdateInviteCode updates the invite code and optional expiry for an organization (expiresAt nil = never expire)
func (r *organizationRepository) UpdateInviteCode(ctx context.Context, orgID string, inviteCode string, expiresAt *time.Time) error {
	updates := map[string]interface{}{"invite_code": inviteCode, "invite_code_expires_at": expiresAt}
	return r.db.WithContext(ctx).
		Model(&types.Organization{}).
		Where("id = ?", orgID).
		Updates(updates).Error
}

// ----------------
// Join Requests
// ----------------

var ErrJoinRequestNotFound = errors.New("join request not found")

// CreateJoinRequest creates a new join request
func (r *organizationRepository) CreateJoinRequest(ctx context.Context, request *types.OrganizationJoinRequest) error {
	return r.db.WithContext(ctx).Create(request).Error
}

// GetJoinRequestByID gets a join request by ID
func (r *organizationRepository) GetJoinRequestByID(ctx context.Context, id string) (*types.OrganizationJoinRequest, error) {
	var request types.OrganizationJoinRequest
	err := r.db.WithContext(ctx).
		Preload("User").
		Where("id = ?", id).
		First(&request).Error
	if err != nil {
		if errors.Is(err, gorm.ErrRecordNotFound) {
			return nil, ErrJoinRequestNotFound
		}
		return nil, err

View on GitHub (pinned to 988cbb0330)

Solutions

  1. Rewrite the query to reference the table via the default search_path without a schema prefix, assuming it resolves to `public`.
  2. Move the table into the `public` schema if it is intended to be queryable through this library.
  3. If non-public schemas are legitimately needed, construct the validator with checkSchemaAccess=false or extend the allowed-schema list (only if the query source is trusted).

Example fix

// before
SELECT * FROM information_schema.tables;

// after
SELECT * FROM my_tables_view; -- public-schema view over allowed metadata
Defensive patterns

Strategy: validation

Validate before calling

var schemaQualified = regexp.MustCompile(`(?i)\bfrom\s+([a-z_][a-z0-9_]*)\.`)
func usesNonPublicSchema(sql string) bool {
	for _, m := range schemaQualified.FindAllStringSubmatch(sql, -1) {
		if strings.ToLower(m[1]) != "public" {
			return true
		}
	}
	return false
}

Try / catch

if err := validator.ValidateQuery(sql); err != nil {
	var schemaErr = "access to schema"
	if strings.Contains(err.Error(), schemaErr) {
		return fmt.Errorf("query must use the public schema: %w", err)
	}
}

Prevention

When it happens

Trigger: A query like `SELECT * FROM information_schema.tables`, `SELECT * FROM pg_catalog.pg_settings`, or `SELECT * FROM other_schema.users` is validated while schema access checking is on (the default).

Common situations: Introspection queries generated by ORMs or migration tools; multi-tenant apps that intentionally use non-public schemas; queries copied from psql/db admin sessions that fully qualify table names with a non-public schema.

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/4f8b2f76e638c5f4. Report an issue: GitHub.