{"record":{"id":"348b23421f06c02d","repo":"bytebase/bytebase","slug":"failed-to-activate-access-grant-v","errorCode":null,"errorMessage":"failed to activate access grant %v","messagePattern":"failed to activate access grant (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"backend/api/v1/issue_hook.go","lineNumber":121,"sourceCode":"\t\t\t\tEmail: creatorEmail,\n\t\t\t},\n\t\t\tIssue: webhook.NewIssue(issue),\n\t\t},\n\t})\n}\n\n// completeAccessRequestIssue completes the ACCESS_GRANT/ROLE_GRANT issue.\n// For ROLE_GRANT issue: grant the privilege and update the status.\n// For ACCESS_GRANT issue: mark the status as ACTIVE.\nfunc completeAccessRequestIssue(ctx context.Context, stores *store.Store, userEmail string, issue *store.IssueMessage) (*store.IssueMessage, error) {\n\tswitch issue.Type {\n\tcase storepb.Issue_ACCESS_GRANT:\n\t\tif issue.Payload.AccessGrantId == \"\" {\n\t\t\treturn nil, errors.Errorf(\"invalid access grant id for issue %d\", issue.UID)\n\t\t}\n\t\taccessGrantName := common.FormatAccessGrant(issue.ProjectID, issue.Payload.AccessGrantId)\n\t\tif _, err := activateAccessGrant(ctx, stores, accessGrantName, true /* refresh expire time */); err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"failed to activate access grant %v\", accessGrantName)\n\t\t}\n\tcase storepb.Issue_ROLE_GRANT:\n\t\tif err := utils.UpdateProjectPolicyFromRoleGrantIssue(ctx, stores, common.GetWorkspaceIDFromContext(ctx), issue, issue.Payload.RoleGrant); err != nil {\n\t\t\treturn nil, err\n\t\t}\n\tdefault:\n\t\treturn issue, nil\n\t}\n\n\tupdatedIssue, err := stores.UpdateIssue(ctx, issue.ProjectID, issue.UID, &store.UpdateIssueMessage{Status: new(storepb.Issue_DONE)})\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(err, \"failed to update issue %q's status\", issue.Title)\n\t}\n\n\tif _, err := stores.CreateIssueComments(ctx, userEmail, &store.IssueCommentMessage{\n\t\tProjectID: issue.ProjectID,\n\t\tIssueUID:  issue.UID,\n\t\tPayload: &storepb.IssueCommentPayload{","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/bytebase/bytebase/blob/1870550677fe08f0d2a78c07acd27541464eb945/backend/api/v1/issue_hook.go#L103-L139","documentation":"For an ACCESS_GRANT issue, completeAccessRequestIssue calls activateAccessGrant to mark the grant ACTIVE (refreshing its expire time). If activation fails, this error wraps the underlying cause with the grant resource name. The grant itself could not be activated despite the issue being approved.","triggerScenarios":"Approving an ACCESS_GRANT issue when the referenced access grant no longer exists (deleted before approval), the store update fails, or the grant is in a state that cannot be activated (e.g. already expired or revoked).","commonSituations":"Access grants cleaned up by an expiry job while the approval was pending; concurrent revocation of the grant; metadata DB write failure during activation.","solutions":["Check the wrapped error: if the grant is not found, re-create the access grant and a new issue","Retry via RetryIssueApproval if the failure was transient (DB timeout)","Verify the access grant's current state in the store before re-approving","Check for background jobs (expiry/revocation) racing with the approval"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"grant, err := store.GetAccessGrant(ctx, grantName)\nif err != nil {\n    return fmt.Errorf(\"access grant %s not activatable: %w\", grantName, err)\n}\nif grant.State != storepb.AccessGrant_PENDING {\n    return fmt.Errorf(\"access grant %s is not pending\", grantName)\n}","typeGuard":null,"tryCatchPattern":"_, err := client.ApproveIssue(ctx, req)\nif err != nil && strings.Contains(err.Error(), \"failed to activate access grant\") {\n    // check whether the grant still exists / is pending, then re-create or retry\n}","preventionTips":["Avoid running grant-expiry cleanup jobs while approvals are pending","Check grant existence before approving long-queued issues","Use RetryIssueApproval for transient DB failures"],"tags":["go","access-grant","issue","activation"],"backgroundTag":"invalid-state-transition","analyzedSha":"1870550677fe08f0d2a78c07acd27541464eb945","analyzedAt":"2026-09-06T21:16:13.665Z","contentChangedAt":"2026-09-06T21:16:13.665Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}