{"record":{"id":"4f8b2f76e638c5f4","repo":"Tencent/WeKnora","slug":"join-request-not-found","errorCode":null,"errorMessage":"join request not found","messagePattern":"join request not found","errorType":"error_code","errorClass":null,"httpStatus":404,"severity":"error","filePath":"internal/application/repository/organization.go","lineNumber":242,"sourceCode":"\t\tWhere(\"organization_id = ?\", orgID).\n\t\tCount(&count).Error\n\treturn count, err\n}\n\n// UpdateInviteCode updates the invite code and optional expiry for an organization (expiresAt nil = never expire)\nfunc (r *organizationRepository) UpdateInviteCode(ctx context.Context, orgID string, inviteCode string, expiresAt *time.Time) error {\n\tupdates := map[string]interface{}{\"invite_code\": inviteCode, \"invite_code_expires_at\": expiresAt}\n\treturn r.db.WithContext(ctx).\n\t\tModel(&types.Organization{}).\n\t\tWhere(\"id = ?\", orgID).\n\t\tUpdates(updates).Error\n}\n\n// ----------------\n// Join Requests\n// ----------------\n\nvar ErrJoinRequestNotFound = errors.New(\"join request not found\")\n\n// CreateJoinRequest creates a new join request\nfunc (r *organizationRepository) CreateJoinRequest(ctx context.Context, request *types.OrganizationJoinRequest) error {\n\treturn r.db.WithContext(ctx).Create(request).Error\n}\n\n// GetJoinRequestByID gets a join request by ID\nfunc (r *organizationRepository) GetJoinRequestByID(ctx context.Context, id string) (*types.OrganizationJoinRequest, error) {\n\tvar request types.OrganizationJoinRequest\n\terr := r.db.WithContext(ctx).\n\t\tPreload(\"User\").\n\t\tWhere(\"id = ?\", id).\n\t\tFirst(&request).Error\n\tif err != nil {\n\t\tif errors.Is(err, gorm.ErrRecordNotFound) {\n\t\t\treturn nil, ErrJoinRequestNotFound\n\t\t}\n\t\treturn nil, err","sourceCodeStart":224,"sourceCodeEnd":260,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/repository/organization.go#L224-L260","documentation":"The validator walks each FROM item and, when checkSchemaAccess is enabled, only permits tables in the `public` schema. A RangeVar whose Schemaname is set and is not `public` (e.g. `information_schema.tables`, `pg_catalog.pg_tables`, `app.orders`) is rejected to keep queries inside the allowed schema surface.","triggerScenarios":"A query like `SELECT * FROM information_schema.tables`, `SELECT * FROM pg_catalog.pg_settings`, or `SELECT * FROM other_schema.users` is validated while schema access checking is on (the default).","commonSituations":"Introspection queries generated by ORMs or migration tools; multi-tenant apps that intentionally use non-public schemas; queries copied from psql/db admin sessions that fully qualify table names with a non-public schema.","solutions":["Rewrite the query to reference the table via the default search_path without a schema prefix, assuming it resolves to `public`.","Move the table into the `public` schema if it is intended to be queryable through this library.","If non-public schemas are legitimately needed, construct the validator with checkSchemaAccess=false or extend the allowed-schema list (only if the query source is trusted)."],"exampleFix":"// before\nSELECT * FROM information_schema.tables;\n\n// after\nSELECT * FROM my_tables_view; -- public-schema view over allowed metadata","handlingStrategy":"validation","validationCode":"var schemaQualified = regexp.MustCompile(`(?i)\\bfrom\\s+([a-z_][a-z0-9_]*)\\.`)\nfunc usesNonPublicSchema(sql string) bool {\n\tfor _, m := range schemaQualified.FindAllStringSubmatch(sql, -1) {\n\t\tif strings.ToLower(m[1]) != \"public\" {\n\t\t\treturn true\n\t\t}\n\t}\n\treturn false\n}","typeGuard":null,"tryCatchPattern":"if err := validator.ValidateQuery(sql); err != nil {\n\tvar schemaErr = \"access to schema\"\n\tif strings.Contains(err.Error(), schemaErr) {\n\t\treturn fmt.Errorf(\"query must use the public schema: %w\", err)\n\t}\n}","preventionTips":["Keep all queryable tables in the public schema or expose them via public views.","Strip schema qualifiers from generated SQL or configure search_path so unqualified names resolve correctly.","Audit ORM/migration-generated introspection queries before routing them through the validator."],"tags":["sql","security","schema-access","validation"],"backgroundTag":"schema-access-denied","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}