{"record":{"id":"5ad31c64619ff085","repo":"kopia/kopia","slug":"error-validating-acl","errorCode":null,"errorMessage":"error validating ACL","messagePattern":"error validating ACL","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/acl/acl_manager.go","lineNumber":115,"sourceCode":"\t\tvar p Entry\n\n\t\t_, err := rep.GetManifest(ctx, m.ID, &p)\n\t\tif err != nil {\n\t\t\treturn nil, errors.Wrapf(err, \"error loading ACL manifest %v\", m.ID)\n\t\t}\n\n\t\tp.ManifestID = m.ID\n\n\t\tresult = append(result, &p)\n\t}\n\n\treturn result, nil\n}\n\n// AddACL validates and adds the specified ACL entry to the repository.\nfunc AddACL(ctx context.Context, w repo.RepositoryWriter, e *Entry, overwrite bool) error {\n\tif err := e.Validate(); err != nil {\n\t\treturn errors.Wrap(err, \"error validating ACL\")\n\t}\n\n\tentries, err := LoadEntries(ctx, w, nil)\n\tif err != nil {\n\t\treturn errors.Wrap(err, \"unable to load ACL entries\")\n\t}\n\n\tfor _, oldE := range entries {\n\t\tif e.User == oldE.User && maps.Equal(e.Target, oldE.Target) {\n\t\t\tif !overwrite && e.Access < oldE.Access {\n\t\t\t\treturn errors.Errorf(\"ACL entry for a given user and target already exists %v: %v\", oldE.User, oldE.Target)\n\t\t\t}\n\n\t\t\tif err = w.DeleteManifest(ctx, oldE.ManifestID); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"error deleting old\")\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":97,"sourceCodeEnd":133,"githubUrl":"https://github.com/kopia/kopia/blob/82495e54b584c1ef6073c9e1be048f57f8aef078/internal/acl/acl_manager.go#L97-L133","documentation":"AddACL calls e.Validate() before persisting and wraps any validation failure (unsupported label, invalid label value, missing/invalid access level) with this message. The detailed reason is in the wrapped error; this wrapper only marks the failure point in AddACL.","triggerScenarios":"Calling AddACL (or the 'kopia acl add' command) with an Entry that has an unknown label, invalid label value, or an Access field that doesn't map to a known access level.","commonSituations":"CLI users passing a bad --access value; automation constructing ACL entries programmatically with wrong label keys; forgetting to set Access entirely.","solutions":["Read the wrapped cause for the specific validation failure","Set a valid access level (read/write/full/none) on the entry","Correct label keys/values to match allowedLabels and validators in internal/acl/acl.go"],"exampleFix":"// before\nAddACL(ctx, rep, &acl.Entry{User: \"joe\"}, true) // no Access\n// after\nAddACL(ctx, rep, &acl.Entry{User: \"joe\", Access: acl.AccessLevelRead, Target: acl.TargetUserACL{...}}, true)","handlingStrategy":"validation","validationCode":"if err := entry.Validate(); err != nil {\n    return fmt.Errorf(\"invalid ACL entry: %w\", err)\n}\nif entry.Access == 0 {\n    return errors.New(\"access level must be set\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set Access to a documented access level constant","Run entry.Validate() in tests for every ACL shape your tooling produces","Validate CLI flag values before mapping them onto Entry fields"],"tags":["acl","validation","go"],"backgroundTag":"schema-validation-failed","analyzedSha":"82495e54b584c1ef6073c9e1be048f57f8aef078","analyzedAt":"2026-09-07T20:35:21.689Z","contentChangedAt":"2026-09-07T20:35:21.689Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}