{"record":{"id":"0444c9ba82dc38d9","repo":"larksuite/cli","slug":"metadata-authorization-identityorder-must-contain","errorCode":null,"errorMessage":"Metadata.Authorization.IdentityOrder must contain each declared identity exactly once","messagePattern":"Metadata\\.Authorization\\.IdentityOrder must contain each declared identity exactly once","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shortcuts/common/typed_compiler.go","lineNumber":156,"sourceCode":"\t\t\t}\n\t\t\tfor _, scope := range conditional.Scopes {\n\t\t\t\tif _, alwaysRequired := requiredScopes[scope]; alwaysRequired {\n\t\t\t\t\treturn fmt.Errorf(\"%s scope %q is already always required for identity %q\", path, scope, identity)\n\t\t\t\t}\n\t\t\t}\n\t\t\tif conditional.When != strings.TrimSpace(conditional.When) {\n\t\t\t\treturn fmt.Errorf(\"%s.When must be trimmed\", path)\n\t\t\t}\n\t\t\tswitch conditional.Requirement {\n\t\t\tcase typedScopeRequired, typedScopeBestEffort:\n\t\t\tdefault:\n\t\t\t\treturn fmt.Errorf(\"%s.Requirement %q is invalid\", path, conditional.Requirement)\n\t\t\t}\n\t\t}\n\t}\n\tif len(metadata.Authorization.IdentityOrder) > 0 {\n\t\tif len(metadata.Authorization.IdentityOrder) != len(metadata.Authorization.Identities) {\n\t\t\treturn fmt.Errorf(\"Metadata.Authorization.IdentityOrder must contain each declared identity exactly once\")\n\t\t}\n\t\tseen := make(map[typedIdentity]struct{}, len(metadata.Authorization.IdentityOrder))\n\t\tfor _, identity := range metadata.Authorization.IdentityOrder {\n\t\t\tif _, ok := metadata.Authorization.Identities[identity]; !ok {\n\t\t\t\treturn fmt.Errorf(\"Metadata.Authorization.IdentityOrder contains undeclared identity %q\", identity)\n\t\t\t}\n\t\t\tif _, duplicate := seen[identity]; duplicate {\n\t\t\t\treturn fmt.Errorf(\"Metadata.Authorization.IdentityOrder contains duplicate identity %q\", identity)\n\t\t\t}\n\t\t\tseen[identity] = struct{}{}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc validateScopeList(scopes []string, path string) error {\n\tseen := make(map[string]struct{}, len(scopes))\n\tfor i, scope := range scopes {","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/shortcuts/common/typed_compiler.go#L138-L174","documentation":"When IdentityOrder is declared, it must list every declared identity exactly once — its length must equal len(Identities). A length mismatch means some identity is missing from the order (or an extra entry inflates the count).","triggerScenarios":"Metadata.Authorization.Identities declares two identities (user, bot) but IdentityOrder has one or three entries; or IdentityOrder was populated but a new identity was later added to Identities without updating the order.","commonSituations":"Adding bot identity to a command that previously only declared user and forgetting to extend IdentityOrder; hand-writing the slice with a duplicated/extra placeholder entry; copy-paste between commands with different identity sets.","solutions":["Make IdentityOrder contain exactly one entry per key in Identities, in the desired order","Remove IdentityOrder entirely if declaration order does not matter (the field is optional; empty means no explicit ordering)","Update IdentityOrder whenever Identities gains or loses an identity"],"exampleFix":"// before\nIdentities: map[...]{User: {...}, Bot: {...}},\nIdentityOrder: []common.TypedIdentity{common.TypedIdentityUser},\n// after\nIdentities: map[...]{User: {...}, Bot: {...}},\nIdentityOrder: []common.TypedIdentity{common.TypedIdentityUser, common.TypedIdentityBot},","handlingStrategy":"validation","validationCode":"if len(meta.Authorization.IdentityOrder) > 0 && len(meta.Authorization.IdentityOrder) != len(meta.Authorization.Identities) { return errors.New(\"IdentityOrder/Identities length mismatch\") }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Update IdentityOrder whenever Identities changes","Derive order from a single source of truth listing identities once","Omit IdentityOrder when explicit ordering is not needed"],"tags":["go","validation","shortcut-compiler","authorization"],"backgroundTag":"schema-validation-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}