{"record":{"id":"8185a66f944b9d95","repo":"juanfont/headscale","slug":"auto-approver-is-not-an-alias","errorCode":null,"errorMessage":"auto approver is not an alias","messagePattern":"auto approver is not an alias","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"hscontrol/policy/v2/types.go","lineNumber":128,"sourceCode":"\tErrMultipleUsersFound          = errors.New(\"multiple users found\")\n\tErrInvalidGroupFormat          = errors.New(\"group must start with 'group:'\")\n\tErrInvalidTagFormat            = errors.New(\"tag must start with 'tag:'\")\n\tErrInvalidHostname             = errors.New(\"invalid hostname\")\n\tErrHostResolve                 = errors.New(\"error resolving host\")\n\tErrInvalidPrefix               = errors.New(\"invalid prefix\")\n\tErrInvalidAutogroup            = errors.New(\"invalid autogroup\")\n\tErrUnknownAutogroup            = errors.New(\"unknown autogroup\")\n\tErrHostportMissingColon        = errors.New(\"hostport must contain a colon\")\n\tErrTypeNotSupported            = errors.New(\"type not supported\")\n\tErrInvalidAlias                = errors.New(\"invalid alias format\")\n\tErrInvalidAutoApprover         = errors.New(\"invalid auto approver format\")\n\tErrInvalidOwner                = errors.New(\"invalid owner format\")\n\tErrGroupNotDefined             = errors.New(\"group not defined in policy\")\n\tErrInvalidGroupMember          = errors.New(\"invalid group member type\")\n\tErrGroupValueNotArray          = errors.New(\"group value must be an array of users\")\n\tErrInvalidHostIP               = errors.New(\"hostname contains invalid IP address\")\n\tErrTagNotDefined               = errors.New(\"tag not found\")\n\tErrAutoApproverNotAlias        = errors.New(\"auto approver is not an alias\")\n\tErrInvalidACLAction            = errors.New(\"invalid ACL action\")\n\tErrInvalidSSHAction            = errors.New(\"invalid SSH action\")\n\tErrInvalidProtocolNumber       = errors.New(\"invalid protocol number\")\n\tErrProtocolLeadingZero         = errors.New(\"leading 0 not permitted in protocol number\")\n\tErrProtocolOutOfRange          = errors.New(\"protocol number out of range (0-255)\")\n\tErrAutogroupNotSupported       = errors.New(\"autogroup not supported in headscale\")\n\tErrAutogroupInternetSrc        = errors.New(\"autogroup:internet can only be used in ACL destinations\")\n\tErrAutogroupSelfSrc            = errors.New(\"\\\"autogroup:self\\\" not valid on the src side of a rule\")\n\tErrAutogroupNotSupportedACLSrc = errors.New(\"autogroup not supported for ACL sources\")\n\tErrAutogroupNotSupportedACLDst = errors.New(\"autogroup not supported for ACL destinations\")\n\tErrAutogroupDangerAllDst       = errors.New(\"cannot use autogroup:danger-all as a dst\")\n\tErrAutogroupNotSupportedSSHSrc = errors.New(\"autogroup not supported for SSH sources\")\n\tErrAutogroupNotSupportedSSHDst = errors.New(\"autogroup not supported for SSH destinations\")\n\tErrHostNotDefined              = errors.New(\"host not defined in policy\")\n\tErrSSHSourceAliasNotSupported  = errors.New(\"alias not supported for SSH source\")\n\tErrSSHDestAliasNotSupported    = errors.New(\"alias not supported for SSH destination\")\n\tErrUnknownField                = errors.New(\"unknown field\")\n\tErrProtocolNoSpecificPorts     = errors.New(\"protocol does not support specific ports\")","sourceCodeStart":110,"sourceCodeEnd":146,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L110-L146","documentation":"Returned by resolveAutoApprovers (hscontrol/policy/v2/types.go:1541,1556) when an entry in the policy's autoApprovers routes/exitNode lists is not an Alias implementation. Both sites are marked \"Should never happen\" — the JSON unmarshalling path only ever produces Alias values, so this is an internal invariant check, not a user-facing validation.","triggerScenarios":"Not reachable through normal policy files. Can only fire if Go code programmatically constructs a Policy with AutoApprovers containing a non-Alias value (e.g. after an API change or a faulty refactor of the Alias interface set).","commonSituations":"Essentially never seen by config authors. Would appear in headscale logs at policy-compile time if a future code change violated the invariant, e.g. adding a new autoApprover kind without implementing Alias.","solutions":["If you hit this as a headscale user, report it as a bug — the policy file cannot cause it","If you are extending policy v2 in Go, ensure every element you place in AutoApprovers.Routes[prefix] or AutoApprovers.ExitNode implements the Alias interface"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isAutoApproverNotAlias(err error) bool {\n\treturn errors.Is(err, policy.ErrAutoApproverNotAlias)\n}","tryCatchPattern":"ips, exit, err := resolveAutoApprovers(p, users, nodes)\nif err != nil {\n\tif errors.Is(err, policy.ErrAutoApproverNotAlias) {\n\t\t// internal invariant breach — do not retry, report upstream\n\t\tlog.Error().Err(err).Msg(\"autoApprover invariant violated; please report\")\n\t}\n\treturn err\n}","preventionTips":["Treat this error as a bug report, not a config problem","If you construct Policy programmatically, unit-test that autoApprovers entries satisfy the Alias interface"],"tags":["policy","internal","invariant","autoapprovers","go"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}