{"record":{"id":"51f4364c1d375218","repo":"hashicorp/nomad","slug":"invalid-missing-variable-path-in-namespace-s","errorCode":null,"errorMessage":"Invalid missing variable path in namespace %s","messagePattern":"Invalid missing variable path in namespace (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"acl/policy.go","lineNumber":598,"sourceCode":"\t\t}\n\n\t\t// Expand the short hand policy to the capabilities and\n\t\t// add to any existing capabilities\n\t\tif ns.Policy != \"\" {\n\t\t\textraCap := expandNamespacePolicy(ns.Policy)\n\t\t\tns.Capabilities = append(ns.Capabilities, extraCap...)\n\t\t}\n\n\t\t// Expand implicit capabilities\n\t\texpandNamespaceCapabilities(ns)\n\n\t\tif ns.Variables != nil {\n\t\t\tif len(ns.Variables.Paths) == 0 {\n\t\t\t\treturn nil, fmt.Errorf(\"Invalid variable policy: no variable paths in namespace %s\", ns.Name)\n\t\t\t}\n\t\t\tfor _, pathPolicy := range ns.Variables.Paths {\n\t\t\t\tif pathPolicy.PathSpec == \"\" {\n\t\t\t\t\treturn nil, fmt.Errorf(\"Invalid missing variable path in namespace %s\", ns.Name)\n\t\t\t\t}\n\t\t\t\tif strings.HasPrefix(pathPolicy.PathSpec, \"/\") {\n\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\"Invalid variable path %q in namespace %s: cannot start with a leading '/'`\",\n\t\t\t\t\t\tpathPolicy.PathSpec, ns.Name)\n\t\t\t\t}\n\t\t\t\tfor _, cap := range pathPolicy.Capabilities {\n\t\t\t\t\tif !isPathCapabilityValid(cap) {\n\t\t\t\t\t\treturn nil, fmt.Errorf(\n\t\t\t\t\t\t\t\"Invalid variable capability '%s' in namespace %s\", cap, ns.Name)\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tpathPolicy.Capabilities = expandVariablesCapabilities(pathPolicy.Capabilities)\n\n\t\t\t}\n\t\t}\n\n\t\t// Remove the namespace name from the extra key list.","sourceCodeStart":580,"sourceCodeEnd":616,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/policy.go#L580-L616","documentation":"Returned by acl.Parse in acl/policy.go:598 when a variables path block has an empty PathSpec — i.e. a path entry exists but its path string is \"\". Every variables path must specify a non-empty path pattern against which ACL matching is done.","triggerScenarios":"Calling acl.Parse with path \"\" { ... } inside a variables stanza, or JSON policy where a path object has pathspec/path set to empty string; typically from variable interpolation producing an empty value.","commonSituations":"Terraform/template variables like path \"${var.secret_path}\" resolving to empty; copy-paste creating a path block whose name line was deleted; JSON-to-HCL converters emitting empty path keys.","solutions":["Set a concrete non-empty path spec, e.g. path \"secret/team/app\"","Remove the empty path block entirely","Fix the template so the path variable is never empty (add validation/default)","Pre-check all pathPolicy.PathSpec values with a non-empty string validation before calling Parse"],"exampleFix":"// before\nvariables {\n  path \"\" {\n    capabilities = [\"read\"]\n  }\n}\n// after\nvariables {\n  path \"secret/team/app\" {\n    capabilities = [\"read\"]\n  }\n}","handlingStrategy":"validation","validationCode":"for _, ns := range policy.Namespaces {\n    if ns.Variables == nil { continue }\n    for _, p := range ns.Variables.Paths {\n        if strings.TrimSpace(p.PathSpec) == \"\" {\n            return fmt.Errorf(\"namespace %s: empty variables path\", ns.Name)\n        }\n    }\n}","typeGuard":"func hasNonEmptyPathSpec(spec string) bool { return strings.TrimSpace(spec) != \"\" }","tryCatchPattern":null,"preventionTips":["Validate interpolated template values are non-empty before rendering path blocks","Reject empty-string path keys in policy linting","Require explicit default values for path variables in templates"],"tags":["nomad","acl","variables","policy-validation"],"backgroundTag":"acl-policy-validation-failed","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}