{"record":{"id":"59c44fe5f902a089","repo":"weaviate/weaviate","slug":"errbadrequest-59c44f","errorCode":"ErrBadRequest","errorMessage":"bad request","messagePattern":"bad request","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"warning","filePath":"cluster/rbac/manager.go","lineNumber":31,"sourceCode":"\nimport (\n\t\"encoding/json\"\n\t\"errors\"\n\t\"fmt\"\n\t\"maps\"\n\n\t\"github.com/weaviate/weaviate/usecases/auth/authorization/rbac\"\n\n\t\"github.com/sirupsen/logrus\"\n\n\tcmd \"github.com/weaviate/weaviate/cluster/proto/api\"\n\t\"github.com/weaviate/weaviate/usecases/auth/authorization\"\n\t\"github.com/weaviate/weaviate/usecases/config\"\n\tusecasesNamespaces \"github.com/weaviate/weaviate/usecases/namespaces\"\n\t\"github.com/weaviate/weaviate/usecases/schema/namespacing\"\n)\n\nvar ErrBadRequest = errors.New(\"bad request\")\n\ntype Manager struct {\n\tauthZ       *rbac.Manager\n\tauthNconfig config.Authentication\n\tlogger      logrus.FieldLogger\n}\n\nfunc NewManager(authZ *rbac.Manager, authNconfig config.Authentication, logger logrus.FieldLogger) *Manager {\n\treturn &Manager{authZ: authZ, authNconfig: authNconfig, logger: logger}\n}\n\nfunc (m *Manager) GetRoles(req *cmd.QueryRequest) ([]byte, error) {\n\tif m.authZ == nil {\n\t\treturn json.Marshal(cmd.QueryGetRolesResponse{})\n\t}\n\n\tsubCommand := cmd.QueryGetRolesRequest{}\n\tif err := json.Unmarshal(req.SubCommand, &subCommand); err != nil {","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/cluster/rbac/manager.go#L13-L49","documentation":"ErrBadRequest in cluster/rbac is the sentinel returned by the RBAC cluster Manager when a create/update (e.g. createNamespace, updateNamespace, CreateUser) request fails payload validation before it is applied via RAFT. Like its sibling sentinels in dynusers and replication, it is a plain errors.New value intended for errors.Is matching, letting the REST layer return 4xx rather than 500 for client mistakes.","triggerScenarios":"Calling rbac Manager.CreateUser or namespace create/update with an invalid role/user definition or malformed payload; requests rejected during validation in the RAFT command path.","commonSituations":"Malformed RBAC role or user definitions from automation; missing required permissions fields; clients built against an older API schema submitting payloads the current server rejects.","solutions":["Fix the invalid request payload (role/user definition, namespace fields) before resubmitting.","Match with errors.Is(err, rbac.ErrBadRequest) in handlers to return a 422/400 response instead of 500.","Regenerate client bindings from the current OpenAPI/proto schema if the payload shape changed after an upgrade."],"exampleFix":"// before\nif err := rbacManager.UpdateNamespace(ctx, ns); err != nil {\n    return err // 500 for a client mistake\n}\n// after\nif err := rbacManager.UpdateNamespace(ctx, ns); err != nil {\n    if errors.Is(err, rbac.ErrBadRequest) {\n        return apierrors.NewUnprocessableEntity(err)\n    }\n    return err\n}","handlingStrategy":"validation","validationCode":"// Validate RBAC payload before update\nif ns == nil || ns.Name == \"\" || len(ns.Permissions) == 0 {\n    return fmt.Errorf(\"invalid namespace/role payload\")\n}","typeGuard":"func isRBACBadRequest(err error) bool {\n    return errors.Is(err, rbac.ErrBadRequest)\n}","tryCatchPattern":"if err := rbacManager.UpdateNamespace(ctx, ns); err != nil {\n    if isRBACBadRequest(err) {\n        return respond(422, err.Error())\n    }\n    return respond(500, err.Error())\n}","preventionTips":["Regenerate clients from the current schema after upgrades","Match each package's ErrBadRequest separately — they are distinct sentinels","Unit-test the handler mapping for this sentinel (see errors_test.go pattern)","Validate role/permission fields before submitting RAFT commands"],"tags":["validation","rbac","http-422","raft"],"backgroundTag":"bad-request-validation","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}