{"record":{"id":"1563b588fa873f3f","repo":"larksuite/cli","slug":"invalid-identities-entry-q-must-be-user-or-bo","errorCode":null,"errorMessage":"invalid identities entry %q: must be 'user' or 'bot'","messagePattern":"invalid identities entry %q: must be 'user' or 'bot'","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/validate.go","lineNumber":44,"sourceCode":"// rather than continue with a degraded rule (hard-constraint #6 / #11\n// safety contract).\n//\n// A nil rule is a no-op (treated as \"no restriction\" everywhere -- not an\n// error).\nfunc ValidateRule(r *platform.Rule) error {\n\tif r == nil {\n\t\treturn nil\n\t}\n\n\tif r.MaxRisk != \"\" {\n\t\tif !r.MaxRisk.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid max_risk %q: must be one of read|write|high-risk-write\", r.MaxRisk)\n\t\t}\n\t}\n\n\tfor _, id := range r.Identities {\n\t\tif !id.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid identities entry %q: must be 'user' or 'bot'\", id)\n\t\t}\n\t}\n\n\tfor _, g := range r.Allow {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid allow glob %q: %w\", g, err)\n\t\t}\n\t}\n\tfor _, g := range r.Deny {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid deny glob %q: %w\", g, err)\n\t\t}\n\t}\n\treturn nil\n}\n\n// validateGlob rejects malformed doublestar patterns. doublestar.Match\n// returns an error for unbalanced brackets / bad escape sequences; that","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/validate.go#L26-L62","documentation":"ValidateRule in internal/cmdpolicy/validate.go enforces that every entry in Rule.Identities is a recognized platform.Identity. An entry whose IsValid() is false (anything other than 'user' or 'bot') aborts the rule load. This prevents a typo'd identity from silently disabling an identity-scoped restriction, which would fail open.","triggerScenarios":"Calling ValidateRule (directly, via Resolve, or the policy validate subcommand) with a Rule whose Identities slice contains a string other than 'user' or 'bot', e.g. \"User\", \"users\", \"service\", or an empty string.","commonSituations":"Hand-editing a policy YAML and typo-ing an identity value; using uppercase 'User' when comparison is case-sensitive; older configs using a removed identity alias; building platform.Rule with raw string casts instead of the Identity type.","solutions":["Replace the offending identities entry with exactly 'user' or 'bot' (lowercase).","Remove the identities field entirely if the rule should apply to all identities.","Run the policy CLI validate subcommand to confirm all identities pass before loading.","Check for case or pluralization typos ('User', 'users') and normalize to the enum values."],"exampleFix":"// before\nidentities: [\"User\", \"bot\"]\n// after\nidentities: [\"user\", \"bot\"]","handlingStrategy":"validation","validationCode":"for _, id := range rule.Identities {\n\tif id != \"user\" && id != \"bot\" {\n\t\treturn fmt.Errorf(\"identities entry %q must be 'user' or 'bot'\", id)\n\t}\n}\nif err := cmdpolicy.ValidateRule(rule); err != nil { return err }","typeGuard":"func isKnownIdentity(id platform.Identity) bool { return id == \"user\" || id == \"bot\" }","tryCatchPattern":null,"preventionTips":["Construct identities only from platform.Identity constants, never raw strings.","Run ValidateRule on every rule at load time, before handing it to the engine.","Keep policy files in version control and run the policy validate subcommand in CI.","Normalize identity values to lowercase before parsing config."],"tags":["go","config-validation","policy"],"backgroundTag":"invalid-enum-value","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}