{"record":{"id":"35bcee06e1355d18","repo":"vitessio/vitess","slug":"conflicting-entries-q-overlaps-with-q","errorCode":null,"errorMessage":"conflicting entries: %q overlaps with %q","messagePattern":"conflicting entries: %q overlaps with %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/tableacl/tableacl.go","lineNumber":226,"sourceCode":"}\n\n// ValidateProto returns an error if the given proto has problems\n// that would cause InitFromProto to fail.\nfunc ValidateProto(config *tableaclpb.Config) (err error) {\n\tt := patricia.NewTrie()\n\tfor _, group := range config.TableGroups {\n\t\tfor _, name := range group.TableNamesOrPrefixes {\n\t\t\tvar prefix patricia.Prefix\n\t\t\tif before, ok := strings.CutSuffix(name, \"%\"); ok {\n\t\t\t\tprefix = []byte(before)\n\t\t\t} else {\n\t\t\t\tprefix = []byte(name + \"\\000\")\n\t\t\t}\n\t\t\tif bytes.Contains(prefix, []byte(\"%\")) {\n\t\t\t\treturn fmt.Errorf(\"got: %s, '%%' means this entry is a prefix and should not appear in the middle of name or prefix\", name)\n\t\t\t}\n\t\t\toverlapVisitor := func(_ patricia.Prefix, item patricia.Item) error {\n\t\t\t\treturn fmt.Errorf(\"conflicting entries: %q overlaps with %q\", name, item)\n\t\t\t}\n\t\t\tif err := t.VisitSubtree(prefix, overlapVisitor); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tif err := t.VisitPrefixes(prefix, overlapVisitor); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t\tt.Insert(prefix, name)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Authorized returns the list of entities who have the specified role on a tablel.\nfunc Authorized(table string, role Role) *ACLResult {\n\treturn currentTableACL.Authorized(table, role)\n}\n","sourceCodeStart":208,"sourceCodeEnd":244,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/tableacl/tableacl.go#L208-L244","documentation":"When registering table ACL entries, tableacl builds a patricia trie of names/prefixes and rejects any new entry that overlaps an existing one (a name/prefix that is a prefix of another entry). Overlapping entries would give ambiguous ACL semantics.","triggerScenarios":"Calling tableacl initialization (RegisterACLTableEntries / config reload) with two table entries where one is a prefix of the other or one contains '%' as a mid-string wildcard (a separate '%' error is returned in that case); the overlapVisitor fails VisitSubtree/VisitPrefixes on the trie.","commonSituations":"TableACL config JSON (or queryserver-config-acl-table flags) listing both 'user%' and 'users', or a copy-paste of entries that prefix-overlap each other.","solutions":["Inspect the table ACL config and find the two overlapping entries named in the message","Remove or rename one entry so no entry is a prefix of another","Remember '%' is only allowed at the end (prefix entries); never put '%' mid-name","Reload/restart vtgate or vttablet and confirm tableacl init succeeds"],"exampleFix":"// before\n[{\"name\":\"user%\"},{\"name\":\"users\"}]\n// after (disjoint)\n[{\"name\":\"user%\"},{\"name\":\"accounts\"}]","handlingStrategy":"validation","validationCode":"func validateACLEntries(names []string) error {\n    for i, a := range names {\n        if strings.Contains(strings.TrimSuffix(a, \"%\"), \"%\") {\n            return fmt.Errorf(\"'%%' only allowed at end: %s\", a)\n        }\n        for _, b := range names[i+1:] {\n            if isPrefixOverlap(a, b) {\n                return fmt.Errorf(\"overlap: %s vs %s\", a, b)\n            }\n        }\n    }\n    return nil\n}","typeGuard":"func isPrefixOnlyEntry(e string) bool {\n    return strings.HasSuffix(e, \"%\") && !strings.Contains(strings.TrimSuffix(e, \"%\"), \"%\")\n}","tryCatchPattern":"if err := tableacl.Init(config); err != nil {\n    if strings.Contains(err.Error(), \"conflicting entries\") {\n        return fmt.Errorf(\"fix table ACL config: %w\", err)\n    }\n    return err\n}","preventionTips":["Keep ACL table entries prefix-disjoint","Only use '%' as a trailing prefix marker","Lint ACL config JSON on every change"],"tags":["tableacl","configuration","validation"],"backgroundTag":"acl-config-overlap","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}