{"record":{"id":"86b8e187ed52742a","repo":"elastic/elasticsearch","slug":"invalid-mode-valid-values-read-read-write","errorCode":null,"errorMessage":"invalid mode: {}, valid values: [read, read_write]","messagePattern":"invalid mode: (.+?), valid values: \\[read, read_write\\]","errorType":"validation","errorClass":"PolicyValidationException","httpStatus":null,"severity":"error","filePath":"libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java","lineNumber":164,"sourceCode":"\n        @Override\n        public Stream<Path> resolvePaths(PathLookup pathLookup) {\n            return pathLookup.resolveSettingPaths(baseDir, setting);\n        }\n\n        @Override\n        public String description() {\n            return Strings.format(\"[%s] <%s>%s<%s>%s\", mode, baseDir, SEPARATOR, setting, exclusive ? \" (exclusive)\" : \"\");\n        }\n    }\n\n    private static Mode parseMode(String mode) {\n        if (mode.equals(\"read\")) {\n            return Mode.READ;\n        } else if (mode.equals(\"read_write\")) {\n            return Mode.READ_WRITE;\n        } else {\n            throw new PolicyValidationException(\"invalid mode: \" + mode + \", valid values: [read, read_write]\");\n        }\n    }\n\n    private static Platform parsePlatform(String platform) {\n        if (platform.equals(\"linux\")) {\n            return Platform.LINUX;\n        } else if (platform.equals(\"macos\")) {\n            return Platform.MACOS;\n        } else if (platform.equals(\"windows\")) {\n            return Platform.WINDOWS;\n        } else {\n            throw new PolicyValidationException(\"invalid platform: \" + platform + \", valid values: [linux, macos, windows]\");\n        }\n    }\n\n    private static BaseDir parseBaseDir(String baseDir) {\n        return switch (baseDir) {\n            case \"config\" -> BaseDir.CONFIG;","sourceCodeStart":146,"sourceCodeEnd":182,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java#L146-L182","documentation":"Thrown by FilesEntitlement.parseMode when the `mode` string on a files-entitlement entry is neither \"read\" nor \"read_write\". Mode selects read-only vs read-write access for the listed path and is mandatory, so an unknown value cannot be silently defaulted.","triggerScenarios":"A policy file lists a files entitlement entry whose `mode` field is something other than the two allowed literals (for example \"write\", \"rw\", \"READ\", \"read-only\", or a typo like \"read-write\" with a hyphen).","commonSituations":"Author guesses the mode literal instead of consulting the docs; migrating from a different permission vocabulary (e.g. \"rw\"); using uppercase or hyphenated variants; copy-pasting from a sample that used a different schema.","solutions":["Set `mode` to exactly \"read\" for read-only access.","Set `mode` to exactly \"read_write\" for read+write access (underscore, lowercase).","Re-encode/redeploy the policy patch and restart."],"exampleFix":"// before\n{ \"path\": \"/var/log/es\", \"mode\": \"read-write\" }\n\n// after\n{ \"path\": \"/var/log/es\", \"mode\": \"read_write\" }","handlingStrategy":"validation","validationCode":"private static final Set<String> ALLOWED_MODES = Set.of(\"read\", \"read_write\");\n\npublic static void validateMode(String mode) {\n    if (!ALLOWED_MODES.contains(mode)) {\n        throw new IllegalArgumentException(\"mode must be one of \" + ALLOWED_MODES + \", got: \" + mode);\n    }\n}","typeGuard":"public static boolean isValidMode(String mode) {\n    return \"read\".equals(mode) || \"read_write\".equals(mode);\n}","tryCatchPattern":null,"preventionTips":["Validate the policy JSON against a JSON Schema before encoding.","Treat the policy file as code: review and lint it.","Lowercase + underscore only; never hyphens or uppercase."],"tags":["entitlements","files","policy","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T09:17:06.757Z"}