{"record":{"id":"2a4096a18f24f3e4","repo":"gofr-dev/gofr","slug":"invalid-rbac-config-w","errorCode":null,"errorMessage":"invalid RBAC config: %w","messagePattern":"invalid RBAC config: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/rbac/config.go","lineNumber":168,"sourceCode":"\t\tif err := json.Unmarshal(data, &config); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to parse JSON config file %s: %w\", path, err)\n\t\t}\n\tdefault:\n\t\treturn nil, fmt.Errorf(\"unsupported config file format: %s (supported: .json, .yaml, .yml): %w\", ext, errUnsupportedFormat)\n\t}\n\n\t// Set dependencies\n\tconfig.Logger = logger\n\tconfig.Metrics = metrics\n\tconfig.Tracer = tracer\n\n\t// Initialize mux router for pattern matching\n\t// Use StrictSlash(false) to match the application router's behavior\n\tconfig.muxRouter = mux.NewRouter().StrictSlash(false)\n\n\t// Validate config before processing\n\tif err := config.validate(); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid RBAC config: %w\", err)\n\t}\n\n\t// Process unified config to build internal maps\n\tif err := config.processUnifiedConfig(); err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to process unified config: %w\", err)\n\t}\n\n\treturn &config, nil\n}\n\n// validate validates the RBAC configuration.\nfunc (c *Config) validate() error {\n\t// Validate endpoints: non-public endpoints must have RequiredPermissions\n\t// Also validate that paths use mux patterns only (no wildcards or old regex)\n\tfor i, endpoint := range c.Endpoints {\n\t\tif !endpoint.Public && len(endpoint.RequiredPermissions) == 0 {\n\t\t\treturn fmt.Errorf(\"endpoint[%d]: %w: %s\", i, ErrEndpointMissingPermissions, endpoint.Path)\n\t\t}","sourceCodeStart":150,"sourceCodeEnd":186,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/rbac/config.go#L150-L186","documentation":"After parsing, LoadPermissions runs Config.validate() and the config was semantically invalid (e.g. a non-public endpoint has no RequiredPermissions, or a path pattern is malformed). The underlying validation error is wrapped, so read the full chained message.","triggerScenarios":"EnableRBAC/LoadPermissions with an Endpoints entry where Public is false and RequiredPermissions is empty, or where the path fails validateEndpointPath (bad mux pattern, wildcard, regex style).","commonSituations":"Adding a new protected route and forgetting requiredPermissions; a refactoring dropped the permissions array; copy-pasting a path pattern from a non-mux router.","solutions":["Read the wrapped cause to see which endpoint index/field failed.","Add a non-empty requiredPermissions list to every non-public endpoint.","Set public: true only for endpoints genuinely meant to be unauthenticated.","Fix the path pattern to use mux syntax (see errors 375-379 for pattern specifics)."],"exampleFix":"// before\n{ \"path\": \"/api/orders\", \"requiredPermissions\": [] }\n// after\n{ \"path\": \"/api/orders\", \"requiredPermissions\": [\"orders:read\"] }","handlingStrategy":"validation","validationCode":"for i, ep := range cfg.Endpoints {\n    if !ep.Public && len(ep.RequiredPermissions) == 0 {\n        return fmt.Errorf(\"endpoint[%d] %s: non-public endpoint needs requiredPermissions\", i, ep.Path)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.validateShape(); err != nil { return err }\nif _, err := rbac.LoadPermissions(path, logger, metrics, tracer); err != nil {\n    if strings.Contains(err.Error(), \"invalid RBAC config\") {\n        return fmt.Errorf(\"fix rbac config: %w\", err)\n    }\n    return err\n}","preventionTips":["Validate the config at CI time, not just at startup.","Require every protected endpoint to list permissions in your config schema/JSON-schema check.","Review diffs that flip public:true to false.","Log the full wrapped error chain (errors.Unwrap) to find the failing endpoint index."],"tags":["go","rbac","config","validation"],"backgroundTag":"schema-validation-failed","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}