{"record":{"id":"8a4686b437c7c31e","repo":"dgraph-io/dgraph","slug":"error-deleting-old-acl-predicates-w","errorCode":null,"errorMessage":"error deleting old acl predicates: %w","messagePattern":"error deleting old acl predicates: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"upgrade/change_v20.03.0.go","lineNumber":113,"sourceCode":"\t// Nothing to do.\n\tif len(nquads) == 0 {\n\t\tfmt.Println(\"nothing to do: no old rules found in the cluster\")\n\t\treturn nil\n\t}\n\n\tif err := mutateWithClient(dg, &api.Mutation{Set: nquads}); err != nil {\n\t\treturn fmt.Errorf(\"error upgrading ACL rules: %w\", err)\n\t}\n\tfmt.Println(\"Successfully upgraded ACL rules.\")\n\n\tdeleteOld := Upgrade.Conf.GetBool(\"deleteOld\")\n\tif deleteOld {\n\t\terr := alterWithClient(dg, &api.Operation{\n\t\t\tDropOp:    api.Operation_ATTR,\n\t\t\tDropValue: \"dgraph.group.acl\",\n\t\t})\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"error deleting old acl predicates: %w\", err)\n\t\t}\n\t\tfmt.Println(\"Successfully deleted old rules.\")\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":95,"sourceCodeEnd":120,"githubUrl":"https://github.com/dgraph-io/dgraph/blob/759e242be62c91f8d084da06ad0c8d21256d9c07/upgrade/change_v20.03.0.go#L95-L120","documentation":"When the deleteOld flag is set, upgradeACLRules drops the legacy dgraph.group.acl predicate with an ATTR drop alter. If the alter call fails, the new rules are already written but the old ones remain, and the operation aborts with this wrapped error.","triggerScenarios":"alterWithClient(dg, &api.Operation{DropOp: api.Operation_ATTR, DropValue: \"dgraph.group.acl\"}) fails because the client lacks drop permission, the alpha is unreachable, or a schema/guardian constraint blocks dropping the predicate.","commonSituations":"Running the upgrade without guardian-of-root privileges (drop requires elevated rights); cluster in restricted/health mode; drop rejected while queries/mutations are in flight; deleting old rules on an ACL-protected cluster with insufficient creds.","solutions":["Run the upgrade as a guardian user so DropAttr is authorized, then retry only the delete step","Drop the predicate manually: curl the /alter endpoint with DropAttr dgraph.group.acl using root credentials","If keeping old rules is harmless, re-run the upgrade without --deleteOld and clean up later","Check alpha logs/health and network before retrying"],"exampleFix":"// manual fallback\n// before (tool)\ndgraph upgrade --deleteOld --creds user:password   // drop fails: not guardian\n// after (manual alter with guardian creds)\ncurl -X POST localhost:8080/alter -H 'X-Dgraph-AccessToken: <jwt>' -d '{\"drop_attr\":\"dgraph.group.acl\"}'","handlingStrategy":"fallback","validationCode":"// verify drop permission first\nif err := alterWithClient(dg, &api.Operation{DropOp: api.Operation_ALL, DropValue: \"_x_\"}); err != nil {\n    return errors.New(\"client lacks alter/drop privileges; run as guardian\")\n}","typeGuard":null,"tryCatchPattern":"if err := upgradeACLRules(); err != nil {\n    if strings.Contains(err.Error(), \"error deleting old acl predicates\") {\n        // new rules are already written; drop dgraph.group.acl manually later via /alter\n    }\n    return err\n}","preventionTips":["Drop requires elevated rights: always run the delete step as guardian/root","Separate migration and cleanup: migrate first, drop the old predicate in a controlled window","If the drop fails, remember the cluster still works — old rules are merely redundant"],"tags":["upgrade","acl","drop","schema","dgraph"],"backgroundTag":"acl-migration-query-failure","analyzedSha":"759e242be62c91f8d084da06ad0c8d21256d9c07","analyzedAt":"2026-09-01T14:42:12.034Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}