{"record":{"id":"0d1bd5729e3550bd","repo":"weaviate/weaviate","slug":"filtering-authorized-namespaces-w","errorCode":null,"errorMessage":"filtering authorized namespaces: %w","messagePattern":"filtering authorized namespaces: %w","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"adapters/handlers/rest/namespaces/handlers_namespaces.go","lineNumber":405,"sourceCode":"\n\tall, err := h.raft.GetNamespaces()\n\tif err != nil {\n\t\treturn nsops.NewListNamespacesInternalServerError().WithPayload(\n\t\t\tcerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"listing namespaces: %w\", err)))\n\t}\n\tif len(all) == 0 {\n\t\treturn nsops.NewListNamespacesOK().WithPayload([]*models.Namespace{})\n\t}\n\n\tresources := make([]string, len(all))\n\tfor i, ns := range all {\n\t\tresources[i] = authorization.Namespaces(ns.Name)[0]\n\t}\n\n\tallowed, err := h.authorizer.FilterAuthorizedResources(ctx, principal, authorization.READ, resources...)\n\tif err != nil {\n\t\treturn nsops.NewListNamespacesInternalServerError().WithPayload(\n\t\t\tcerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"filtering authorized namespaces: %w\", err)))\n\t}\n\n\tallowedSet := make(map[string]struct{}, len(allowed))\n\tfor _, r := range allowed {\n\t\tallowedSet[r] = struct{}{}\n\t}\n\n\tout := make([]*models.Namespace, 0, len(allowed))\n\tfor _, ns := range all {\n\t\tif _, ok := allowedSet[authorization.Namespaces(ns.Name)[0]]; ok {\n\t\t\tout = append(out, &models.Namespace{Name: ns.Name, HomeNode: ns.Primary(), State: string(ns.State)})\n\t\t}\n\t}\n\treturn nsops.NewListNamespacesOK().WithPayload(out)\n}\n","sourceCodeStart":387,"sourceCodeEnd":421,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/adapters/handlers/rest/namespaces/handlers_namespaces.go#L387-L421","documentation":"This error wraps a failure of h.authorizer.FilterAuthorizedResources, which filters the namespace list down to resources the principal may READ. It surfaces as a 500 because authorization filtering itself failed (as opposed to the request being denied), typically an internal problem in the authz plugin/RBAC store.","triggerScenarios":"GET /v1/namespaces with RBAC authorization enabled when the authorizer errors: configured authz module failed to initialize, user/role lookup fails, or an external authz backend is unreachable.","commonSituations":"AUTHORIZATION_CONFIG set to a module that cannot reach its backend; RBAC roles deleted or corrupted while a valid JWT is presented; misconfigured OIDC groups mapping.","solutions":["Verify the authorizer module configuration (AUTHORIZATION_* env vars) and that its backend is reachable","Check server logs for the underlying error wrapped after 'filtering authorized namespaces:'","Confirm the principal's roles exist in the RBAC state and re-sync roles if needed","Temporarily test with an admin principal to isolate whether the issue is role-specific"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// Ensure a principal is resolvable before listing\nif principal == nil || principal.Username == \"\" { return errors.New(\"authenticated principal required\") }","typeGuard":null,"tryCatchPattern":"ns, err := client.Namespaces.List(ctx)\nif err != nil {\n    var apiErr *namespaces.ListNamespacesInternalServerError\n    if errors.As(err, &apiErr) { log.Printf(\"authz filter failed: %s\", apiErr.Payload.Error[0].Message) }\n    return err\n}","preventionTips":["Validate AUTHORIZATION_* configuration at startup","Monitor availability of the authz backend","Test RBAC role sync after role/user changes"],"tags":["authorization","rbac","namespaces","internal-server-error"],"backgroundTag":"authorization-filter-failed","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}