{"record":{"id":"8b0b5b8da5f866ca","repo":"juanfont/headscale","slug":"w-w","errorCode":null,"errorMessage":"%w:\n%w","messagePattern":"%w:\n%w","errorType":"validation","errorClass":"errPolicyTestsFailed","httpStatus":null,"severity":"error","filePath":"hscontrol/policy/v2/types.go","lineNumber":3228,"sourceCode":"\t\t}\n\n\t\tfor _, dst := range t.Accept {\n\t\t\terr := validateTestDestination(pol, dst)\n\t\t\tif err != nil {\n\t\t\t\terrs = append(errs, fmt.Errorf(\"test %d, accept %q: %w\", i, dst, err))\n\t\t\t}\n\t\t}\n\n\t\tfor _, dst := range t.Deny {\n\t\t\terr := validateTestDestination(pol, dst)\n\t\t\tif err != nil {\n\t\t\t\terrs = append(errs, fmt.Errorf(\"test %d, deny %q: %w\", i, dst, err))\n\t\t\t}\n\t\t}\n\t}\n\n\tif len(errs) > 0 {\n\t\treturn fmt.Errorf(\"%w:\\n%w\", errPolicyTestsFailed, multierr.New(errs...))\n\t}\n\n\treturn nil\n}\n\n// validateTestDestination enforces that a tests-block dst describes one\n// connection attempt to one specific host on one specific port. SaaS\n// rejects three shapes that violate the rule: autogroup:internet (routed\n// by exit-node [tailcfg.Node.AllowedIPs], not the packet filter); multi-port\n// (range/list/wildcard, no single allow/deny answer); and CIDR ranges\n// — both raw `/N` syntax and `hosts:`-table aliases whose RHS is a\n// multi-host prefix. Bare IP literals reach this function as *[Prefix]\n// /32 or /128 just like explicit `/32` / `/128` does, so the CIDR\n// check inspects the raw input string for `/` rather than the parsed\n// alias type.\nfunc validateTestDestination(pol *Policy, dst string) error {\n\tawp, err := parseDestinationAlias(dst)\n\tif err != nil {","sourceCodeStart":3210,"sourceCodeEnd":3246,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L3210-L3246","documentation":"Error \"%w:\n%w\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/policy/v2/types.go:3228 when the library encounters an invalid state.","commonSituations":"A compound policy error combining two failures. Read both wrapped messages; fix the primary error first and re-run validation.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}