{"record":{"id":"511a2c7f8a65edbe","repo":"apache/rocketmq","slug":"the-decision-is-null-or-illegal","errorCode":null,"errorMessage":"The decision is null or illegal.","messagePattern":"The decision is null or illegal\\.","errorType":"validation","errorClass":"AuthorizationException","httpStatus":null,"severity":"error","filePath":"auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java","lineNumber":267,"sourceCode":"        if (CollectionUtils.isEmpty(entry.getActions())) {\n            throw new AuthorizationException(\"The actions is empty.\");\n        }\n        if (entry.getActions().contains(Action.ANY)) {\n            throw new AuthorizationException(\"The actions can not be Any.\");\n        }\n        Environment environment = entry.getEnvironment();\n        if (environment != null && CollectionUtils.isNotEmpty(environment.getSourceIps())) {\n            for (String sourceIp : environment.getSourceIps()) {\n                if (StringUtils.isBlank(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is empty.\");\n                }\n                if (!IPAddressUtils.isValidIPOrCidr(sourceIp)) {\n                    throw new AuthorizationException(\"The source ip is invalid.\");\n                }\n            }\n        }\n        if (entry.getDecision() == null) {\n            throw new AuthorizationException(\"The decision is null or illegal.\");\n        }\n    }\n\n    private <T> CompletableFuture<T> handleException(Exception e) {\n        CompletableFuture<T> result = new CompletableFuture<>();\n        Throwable throwable = ExceptionUtils.getRealException(e);\n        result.completeExceptionally(throwable);\n        return result;\n    }\n\n    private AuthenticationMetadataProvider getAuthenticationMetadataProvider() {\n        if (authenticationMetadataProvider == null) {\n            throw new IllegalStateException(\"The authenticationMetadataProvider is not configured.\");\n        }\n        return authenticationMetadataProvider;\n    }\n\n    private AuthorizationMetadataProvider getAuthorizationMetadataProvider() {","sourceCodeStart":249,"sourceCodeEnd":285,"githubUrl":"https://github.com/apache/rocketmq/blob/293f5885719fc4aa3619446a1900f58ccfcfdd29/auth/src/main/java/org/apache/rocketmq/auth/authorization/manager/AuthorizationMetadataManagerImpl.java#L249-L285","documentation":"Thrown by AuthorizationMetadataManagerImpl.validate() when a PolicyEntry has a null decision. Every policy must explicitly state Decision.ALLOW or Decision.DENY so the evaluator can order and apply rules deterministically; there is no default decision.","triggerScenarios":"createAcl/updateAcl with a policy JSON that omits the \"decision\" field, or programmatic construction of PolicyEntry without setDecision(...).","commonSituations":"ACL documents written by hand or generated by scripts that only fill resources and actions; schema drift where the decision field was renamed; mistaken assumption that omitting decision defaults to ALLOW.","solutions":["Add \"decision\":\"ALLOW\" (or \"DENY\" as intended) to each policy in the ACL document","In code, call entry.setDecision(Decision.ALLOW) before submitting the entry"],"exampleFix":"// before\n{\"resources\":[{\"type\":\"TOPIC\",\"pattern\":\"order-*\"}],\"actions\":[\"PUB\",\"SUB\"]}\n\n// after\n{\"resources\":[{\"type\":\"TOPIC\",\"pattern\":\"order-*\"}],\"actions\":[\"PUB\",\"SUB\"],\"decision\":\"ALLOW\"}","handlingStrategy":"validation","validationCode":"boolean policyComplete(PolicyEntry e) {\n    return e.getResource() != null && e.getActions() != null && !e.getActions().isEmpty()\n        && e.getDecision() != null;\n}","typeGuard":null,"tryCatchPattern":"try { metadataManager.updateAcl(acl).join(); }\ncatch (AuthorizationException e) { /* set missing decision and retry */ }","preventionTips":["Treat decision as a required field in every ACL template and form","Schema-validate ACL JSON against the current PolicyEntry model before submission"],"tags":["auth","authorization","acl","validation","rocketmq"],"backgroundTag":null,"analyzedSha":"293f5885719fc4aa3619446a1900f58ccfcfdd29","analyzedAt":"2026-08-14T11:50:13.822Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}