{"record":{"id":"33e16970784c5a5b","repo":"Tencent/WeKnora","slug":"failed-to-validate-document-scope-w","errorCode":null,"errorMessage":"failed to validate document scope: %w","messagePattern":"failed to validate document scope: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/agent/tools/scope_authorization.go","lineNumber":86,"sourceCode":"\t}\n\tif knowledgeService == nil {\n\t\treturn nil, fmt.Errorf(\"knowledge service is unavailable\")\n\t}\n\tknowledge, err := knowledgeService.GetKnowledgeByIDOnly(ctx, knowledgeID)\n\tif err != nil || knowledge == nil {\n\t\tif err == nil {\n\t\t\terr = fmt.Errorf(\"empty result\")\n\t\t}\n\t\treturn nil, fmt.Errorf(\"document %s not found: %w\", knowledgeID, err)\n\t}\n\tif !searchTargets.ContainsKB(knowledge.KnowledgeBaseID) {\n\t\treturn nil, fmt.Errorf(\"knowledge base %s is not within the current Agent scope\", knowledge.KnowledgeBaseID)\n\t}\n\tallowed, err := searchTargetsAllowKnowledgeID(\n\t\tctx, searchTargets, knowledge.ID, knowledge.KnowledgeBaseID, knowledgeService,\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to validate document scope: %w\", err)\n\t}\n\tif !allowed {\n\t\treturn nil, fmt.Errorf(\"document %s is not within the current @mention scope\", knowledge.ID)\n\t}\n\treturn knowledge, nil\n}\n\n// authorizeChunkInSearchTargets is the chunk/FAQ counterpart of\n// authorizeKnowledgeInSearchTargets. A chunk ID is accepted only after the\n// server resolves its owning document and validates that document against the\n// full KB/document/tag scope.\nfunc authorizeChunkInSearchTargets(\n\tctx context.Context,\n\tsearchTargets types.SearchTargets,\n\tchunkID string,\n\tchunkService interfaces.ChunkService,\n\tknowledgeService interfaces.KnowledgeService,\n) (*types.Chunk, error) {","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/agent/tools/scope_authorization.go#L68-L104","documentation":"The fine-grained document-scope check (searchTargetsAllowKnowledgeID) itself errored — e.g. tag lookup against the knowledge service failed — so the system cannot decide whether the document is allowed and fails closed by denying authorization.","triggerScenarios":"Thrown at internal/agent/tools/scope_authorization.go:86 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the chained inner error for the underlying service failure","Check knowledge/tag service availability","Retry transient service failures during scope validation"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}