{"record":{"id":"3ff17f0bd8e708f9","repo":"gofr-dev/gofr","slug":"endpoint-must-specify-requiredpermissions-or-be-p","errorCode":null,"errorMessage":"endpoint must specify requiredPermissions (or be public)","messagePattern":"endpoint must specify requiredPermissions \\(or be public\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/gofr/rbac/config.go","lineNumber":25,"sourceCode":"\t\"net/http\"\n\t\"os\"\n\t\"path/filepath\"\n\t\"strings\"\n\n\t\"github.com/gorilla/mux\"\n\t\"go.opentelemetry.io/otel/trace\"\n\t\"gopkg.in/yaml.v3\"\n\n\t\"gofr.dev/pkg/gofr/container\"\n\t\"gofr.dev/pkg/gofr/datasource\"\n)\n\nvar (\n\t// errUnsupportedFormat is returned when the config file format is not supported.\n\terrUnsupportedFormat = errors.New(\"unsupported config file format\")\n\n\t// ErrEndpointMissingPermissions is returned when an endpoint doesn't specify requiredPermissions and is not public.\n\tErrEndpointMissingPermissions = errors.New(\"endpoint must specify requiredPermissions (or be public)\")\n\n\t// errWildcardPatternNotSupported is returned when a wildcard pattern is used.\n\terrWildcardPatternNotSupported = errors.New(\"wildcard pattern '/*' is not supported, use mux patterns instead\")\n\n\t// errRegexPatternNotSupported is returned when an old regex pattern is used.\n\terrRegexPatternNotSupported = errors.New(\"regex pattern '^...$' is not supported, use mux patterns instead\")\n\n\t// errRegexIndicatorNotSupported is returned when regex indicators are used outside variable constraints.\n\terrRegexIndicatorNotSupported = errors.New(\"regex pattern is not supported, use mux patterns instead\")\n)\n\n// RoleDefinition defines a role with its permissions and inheritance.\n// Pure config-based: only role->permission mapping is supported.\ntype RoleDefinition struct {\n\t// Name is the role name (required)\n\tName string `json:\"name\" yaml:\"name\"`\n\n\t// Permissions is a list of permissions for this role (format: \"resource:action\")","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/gofr-dev/gofr/blob/187eb24962502e91f1fee856230670958b66e89c/pkg/gofr/rbac/config.go#L7-L43","documentation":"ErrEndpointMissingPermissions is returned by validate and storeEndpointMapping in the RBAC package when a registered endpoint neither declares requiredPermissions nor is marked public. RBAC is config-pure: every protected route must state which roles/permissions it needs or explicitly opt out as public, otherwise the framework cannot decide access. It is exported so callers can compare with errors.Is.","triggerScenarios":"Registering an HTTP route (e.g. via router/route registration while RBAC is enabled) whose endpoint definition omits requiredPermissions and does not set public: true.","commonSituations":"Adding a new handler and forgetting the permissions block; migrating from an open endpoint behind a newly enabled RBAC; copy-pasting endpoint config from a public route without adjusting.","solutions":["Add requiredPermissions to the endpoint definition listing the needed roles/permissions.","If the endpoint should be open, explicitly mark it public in the endpoint config.","Audit all registered endpoints (walk route registrations) to find those missing requiredPermissions.","Compare with errors.Is(err, rbac.ErrEndpointMissingPermissions) in startup validation to fail fast with a clear message."],"exampleFix":"// before\nrouter.Get(\"/admin/stats\", statsHandler) // no permissions declared\n// after\nrouter.Get(\"/admin/stats\", statsHandler,\n\trbac.WithRequiredPermissions(\"admin\", \"stats:read\"))","handlingStrategy":"validation","validationCode":"func assertEndpointAuthorized(ep Endpoint) error {\n\tif ep.Public || len(ep.RequiredPermissions) > 0 {\n\t\treturn nil\n\t}\n\treturn rbac.ErrEndpointMissingPermissions\n}","typeGuard":"func endpointIsCovered(ep Endpoint) bool {\n\treturn ep.Public || len(ep.RequiredPermissions) > 0\n}","tryCatchPattern":"if err := validate(cfg); err != nil {\n\tif errors.Is(err, rbac.ErrEndpointMissingPermissions) {\n\t\tlog.Fatalf(\"endpoint missing requiredPermissions (or public flag): %v\", err)\n\t}\n\treturn err\n}","preventionTips":["Enforce a team convention: every route registration includes requiredPermissions or an explicit public marker.","Run RBAC validation at startup (fail fast) rather than at request time.","Add a lint/test that iterates all registered routes and checks coverage.","When converting public endpoints to protected, add permissions in the same PR."],"tags":["rbac","authorization","config","gofr"],"backgroundTag":"missing-permissions-declaration","analyzedSha":"187eb24962502e91f1fee856230670958b66e89c","analyzedAt":"2026-09-01T20:34:54.554Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}