{"record":{"id":"0a447a2ee2731f09","repo":"langflow-ai/langflow","slug":"permissions-cannot-be-null-pass-an-empty-list-to","errorCode":null,"errorMessage":"permissions cannot be null; pass an empty list to clear","messagePattern":"permissions cannot be null; pass an empty list to clear","errorType":"http","errorClass":"HTTPException","httpStatus":400,"severity":"error","filePath":"src/backend/base/langflow/api/v1/authz_roles.py","lineNumber":223,"sourceCode":"        role.description = payload.description\n\n    if \"name\" in fields_set:\n        # name is NOT NULL + unique on the DB side; reject an explicit null at\n        # the boundary so the caller gets a clear 400 instead of an opaque\n        # IntegrityError that the catch block below mislabels as \"Name conflict\".\n        if payload.name is None:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"name cannot be null\",\n            )\n        role.name = payload.name\n\n    if \"permissions\" in fields_set:\n        # permissions column is nullable=False (default_factory=list). An empty\n        # list is the natural \"clear\" — None would violate the constraint at\n        # commit, so reject it up front.\n        if payload.permissions is None:\n            raise HTTPException(\n                status_code=status.HTTP_400_BAD_REQUEST,\n                detail=\"permissions cannot be null; pass an empty list to clear\",\n            )\n        role.permissions = list(payload.permissions)\n\n    role.updated_at = datetime.now(timezone.utc)\n\n    try:\n        await session.commit()\n    except IntegrityError as exc:\n        await session.rollback()\n        raise HTTPException(\n            status_code=status.HTTP_409_CONFLICT,\n            detail=\"Name conflict — another role already uses this name\",\n        ) from exc\n    await session.refresh(role)\n    await safe_invalidate_role(get_authorization_service(), role.id, op=\"role:update\")\n    await audit_decision(","sourceCodeStart":205,"sourceCodeEnd":241,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/authz_roles.py#L205-L241","documentation":"Raised by PATCH /api/v1/authz/roles/{role_id} when the request body explicitly sets \"permissions\" to null. The permissions column is nullable=False (with a default_factory of an empty list), so a null would violate the constraint at commit time. The route rejects it up front with a 400 and tells you the idiomatic clear: an empty list.","triggerScenarios":"PATCH /authz/roles/{id} with body {\"permissions\": null}; clients that send the whole RoleUpdate object with nulls for collections they meant to leave untouched.","commonSituations":"UI toggle that removes all permission checkboxes and serializes the empty selection as null instead of []; serializers that emit null for empty arrays; misunderstanding that permissions is a required list, not an optional field.","solutions":["To clear all permissions, send {\"permissions\": []} (empty list)","To leave permissions unchanged, omit the \"permissions\" key from the PATCH body","Fix client serialization to emit [] for empty permission sets rather than null"],"exampleFix":"// before\n{ \"permissions\": null }\n\n// after\n{ \"permissions\": [] }","handlingStrategy":"validation","validationCode":"function buildPermissionsPatch(perms: string[] | null | undefined) {\n  if (perms === undefined) return {}; // unchanged\n  if (perms === null) throw new Error('permissions cannot be null — pass [] to clear');\n  return { permissions: perms };\n}","typeGuard":"const isPermissionList = (p: unknown): p is string[] =>\n  Array.isArray(p) && p.every(x => typeof x === 'string');","tryCatchPattern":null,"preventionTips":["Map an empty UI selection to [], never null","Type the client payload so permissions is string[] | undefined, not string[] | null"],"tags":["authz","api","roles","validation","patch"],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}