{"record":{"id":"098b23fdf4ca81fd","repo":"weaviate/weaviate","slug":"getgroupingpolicy-w","errorCode":null,"errorMessage":"GetGroupingPolicy: %w","messagePattern":"GetGroupingPolicy: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/auth/authorization/rbac/manager.go","lineNumber":221,"sourceCode":"\t\t\tcasbinStoragePolicies = collectStaleRoles(polices, casbinStoragePoliciesMap, casbinStoragePolicies)\n\t\t}\n\t}\n\tpolicies, err := conv.CasbinPolicies(m.namespacesEnabled, casbinStoragePolicies...)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"CasbinPolicies: %w\", err)\n\t}\n\treturn policies, nil\n}\n\n// ListGroupingSubjects returns the subject key of every role-assignment row\n// (each a `<prefix>:<user>` or `<prefix>:<group>` string).\nfunc (m *Manager) ListGroupingSubjects() ([]string, error) {\n\tm.restoreLock.RLock()\n\tdefer m.restoreLock.RUnlock()\n\n\trows, err := m.casbin.GetGroupingPolicy()\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"GetGroupingPolicy: %w\", err)\n\t}\n\tsubjects := make([]string, 0, len(rows))\n\tfor _, r := range rows {\n\t\tif len(r) > 0 {\n\t\t\tsubjects = append(subjects, r[0])\n\t\t}\n\t}\n\treturn subjects, nil\n}\n\n// NamespaceSubject is a direct (db/oidc) principal holding at least one role\n// assignment bound to a namespace. ID is the user id without the auth-type\n// prefix, e.g. \"customer1:bob\".\ntype NamespaceSubject struct {\n\tID       string\n\tAuthType authentication.AuthType\n}\n","sourceCodeStart":203,"sourceCodeEnd":239,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/auth/authorization/rbac/manager.go#L203-L239","documentation":"This error wraps casbin GetGroupingPolicy() failing inside Manager.ListGroupingSubjects, which returns the subject key of every role-assignment g row. The read of all grouping policies from storage failed, so callers like NamespaceLocalRBAC (and CountNamespaceLocalRBAC) cannot enumerate role assignments.","triggerScenarios":"Namespace deletion checks (NamespaceLocalRBAC) or any internal call to ListGroupingSubjects when the RBAC storage read fails — unreadable file, corrupted g rows, mount/permission problems on the storage path.","commonSituations":"RBAC file unreadable after permission churn; truncated g section; storage on an unresponsive network volume during namespace-removal gating.","solutions":["Check the wrapped error to identify the storage failure.","Verify the RBAC storage file is readable and its g rows are intact.","Restore the file from backup if the grouping section is corrupted.","Fix mount/permission issues on the data directory.","Retry the namespace operation once reads succeed — the block gate will re-count correctly."],"exampleFix":"// before: read fails on unresponsive NFS mount\n//   RBAC file at /mnt/nfs/weaviate/rbac.csv (NFS hang)\n// after: keep RBAC storage on local persistent disk\n//   RBAC_STORAGE_PATH=/var/lib/weaviate/rbac.csv","handlingStrategy":"retry","validationCode":"// Go: confirm RBAC storage is readable before namespace teardown that calls ListGroupingSubjects\nfunc rbacReadyForNamespaceOp(path string) error {\n\tf, err := os.Open(path)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"rbac storage unreadable, aborting namespace op: %w\", err)\n\t}\n\treturn f.Close()\n}","typeGuard":null,"tryCatchPattern":"if err := client.Namespaces().Deleter().WithName(ns).Do(ctx); err != nil {\n\tif strings.Contains(err.Error(), \"ListGroupingSubjects\") {\n\t\t// transient storage read failure: wait and retry the namespace operation\n\t}\n\treturn err\n}","preventionTips":["Keep RBAC storage on local persistent disks, not NFS","Back up the RBAC file so corrupted g sections are recoverable","Monitor storage I/O errors on nodes running namespace lifecycle operations"],"tags":["rbac","casbin","grouping-policy","storage-io"],"backgroundTag":"policy-file-read-failed","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}