{"record":{"id":"6a1c8fe4ca8d7ff5","repo":"dgraph-io/dgraph","slug":"can-t-set-dgraph-rule-permission-to-d-value-fo","errorCode":null,"errorMessage":"Can't set <dgraph.rule.permission> to %d, Value for this predicate should be between 0 and 7","messagePattern":"Can't set <dgraph\\.rule\\.permission> to (.+?), Value for this predicate should be between 0 and 7","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"worker/mutation.go","lineNumber":580,"sourceCode":"\t// check compatibility of schema type and storage type\n\t// The goal is to convert value on edge to value type defined by schema.\n\tif dst, err = types.Convert(src, schemaType); err != nil {\n\t\treturn err\n\t}\n\n\t// convert to schema type\n\tb := types.ValueForType(types.BinaryID)\n\tif err = types.Marshal(dst, &b); err != nil {\n\t\treturn err\n\t}\n\n\tif x.WorkerConfig.AclEnabled && x.ParseAttr(edge.GetAttr()) == \"dgraph.rule.permission\" {\n\t\tperm, ok := dst.Value.(int64)\n\t\tif !ok {\n\t\t\treturn errors.Errorf(\"Value for predicate <dgraph.rule.permission> should be of type int\")\n\t\t}\n\t\tif perm < 0 || perm > 7 {\n\t\t\treturn errors.Errorf(\"Can't set <dgraph.rule.permission> to %d, Value for this\"+\n\t\t\t\t\" predicate should be between 0 and 7\", perm)\n\t\t}\n\t}\n\n\t// TODO: Figure out why this is Enum. It really seems like an odd choice -- rather than\n\t//       specifying it as the same type as presented in su.\n\tedge.ValueType = schemaType.Enum()\n\tvar ok bool\n\tedge.Value, ok = b.Value.([]byte)\n\tif !ok {\n\t\treturn errors.Errorf(\"failure to convert edge type: '%+v' to schema type: '%+v'\",\n\t\t\tstorageType, schemaType)\n\t}\n\n\treturn nil\n}\n\n// AssignNsIdsOverNetwork sends a request to assign Namespace IDs to the current zero leader.","sourceCodeStart":562,"sourceCodeEnd":598,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/worker/mutation.go#L562-L598","documentation":"The dgraph.rule.permission predicate (only checked when ACLs are enabled) holds a 3-bit permission bitmask, so its value must be between 0 and 7 inclusive. ValidateAndConvert rejects out-of-range integers to prevent writing meaningless or unsafe permission masks.","triggerScenarios":"A mutation sets dgraph.rule.permission to an int64 outside 0..7, e.g. 8, -1, or a full 0xFF mask, typically from combining permission bits incorrectly or using a decimal read/write value like 100.","commonSituations":"Scripts computing permissions as sums that exceed 7; using percentages or byte masks from other systems; misunderstanding the bit layout (read=4, write=2, modify=1).","solutions":["Set the value to a valid mask in 0..7 (e.g. 7 = all permissions; 4 = read-only).","Compute the mask with bitwise OR of READ(4), WRITE(2), MODIFY(1) instead of arbitrary numbers.","Fix the automation that produced the out-of-range number and clamp/validate before submitting."],"exampleFix":"// before (fails)\n{\"set\":[{\"uid\":\"0x1\",\"dgraph.rule.permission\":100}]}\n\n// after (read|write|modify)\n{\"set\":[{\"uid\":\"0x1\",\"dgraph.rule.permission\":7}]}","handlingStrategy":"validation","validationCode":"const READ = 4, WRITE = 2, MODIFY = 1\nfunction toPermissionMask({read, write, modify}) {\n  const perm = (read ? READ : 0) | (write ? WRITE : 0) | (modify ? MODIFY : 0)\n  if (perm < 0 || perm > 7) throw new RangeError(`permission mask ${perm} out of range 0..7`)\n  return perm\n}","typeGuard":null,"tryCatchPattern":"try {\n  await aclClient.modifyPermissions(rule)\n} catch (e) {\n  if (String(e).includes('between 0 and 7')) {\n    // clamp/recompute the mask from read/write/modify flags and retry\n  }\n}","preventionTips":["Build masks from booleans via bitwise OR (4|2|1), never from raw numbers.","Clamp or assert 0 <= perm <= 7 before submitting any ACL mutation.","Document the bit layout (read=4, write=2, modify=1) wherever permissions are configured."],"tags":["dgraph","acl","validation"],"backgroundTag":"acl-permission-range-invalid","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}