{"record":{"id":"8e697e6ee1a23e65","repo":"weaviate/weaviate","slug":"role-q-in-includeroles-is-a-built-in-role-and-c","errorCode":null,"errorMessage":"role %q in 'includeRoles' is a built-in role and cannot be backed up","messagePattern":"role %q in 'includeRoles' is a built-in role and cannot be backed up","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"usecases/backup/scheduler.go","lineNumber":833,"sourceCode":"\t\treturn nil, fmt.Errorf(\"list all roles: %w\", err)\n\t}\n\treturn resolveRoleSelectors(includeRoles, allRoles)\n}\n\n// resolveRoleSelectors follows resolveUserSelectors: '*'/'?' wildcards, dedup,\n// exact selectors must exist, and a non-empty list matching nothing is an error.\n//\n// Built-in roles are the exception. Naming one explicitly is rejected, and\n// wildcards expand over custom roles only, so '*' never picks up a built-in.\n// Restore re-applies the built-ins from env and code either way.\nfunc resolveRoleSelectors(includeRoles, allRoles []string) ([]string, error) {\n\tif dup := findDuplicate(includeRoles); dup != \"\" {\n\t\treturn nil, fmt.Errorf(\"role list 'includeRoles' contains duplicate: %s\", dup)\n\t}\n\n\tfor _, r := range includeRoles {\n\t\tif slices.Contains(authorization.BuiltInRoles, r) {\n\t\t\treturn nil, fmt.Errorf(\"role %q in 'includeRoles' is a built-in role and cannot be backed up\", r)\n\t\t}\n\t}\n\n\tcandidates := make([]string, 0, len(allRoles))\n\tfor _, r := range allRoles {\n\t\tif slices.Contains(authorization.BuiltInRoles, r) {\n\t\t\tcontinue\n\t\t}\n\t\tcandidates = append(candidates, r)\n\t}\n\n\troles := expandWildcards(includeRoles, candidates)\n\n\tknown := make(map[string]struct{}, len(candidates))\n\tfor _, r := range candidates {\n\t\tknown[r] = struct{}{}\n\t}\n\tfor _, r := range roles {","sourceCodeStart":815,"sourceCodeEnd":851,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/backup/scheduler.go#L815-L851","documentation":"A built-in role (from authorization.BuiltInRoles, e.g. roles shipped with Weaviate like admin/viewer) was explicitly named in 'includeRoles'. Built-in roles cannot be included in a backup because restore re-applies built-ins from env and code anyway; including them would be redundant and misleading. Wildcards are safe — they expand over custom roles only — so this only fires on explicit naming.","triggerScenarios":"Calling the backup API with includeRoles containing an exact built-in role name (e.g. 'admin', 'viewer' or any member of BuiltInRoles). Checked before wildcard expansion, so even alongside valid custom roles the request fails.","commonSituations":"Operator assumes all roles (including built-ins) must be listed for a full RBAC snapshot; scripts that copy every role from a role listing (which includes built-ins) into includeRoles; migration from setups where built-ins were regular roles.","solutions":["Remove built-in role names from includeRoles; keep only custom roles.","To snapshot all custom roles, use the '*' wildcard — it expands over custom roles only and never picks up built-ins.","No client-side change needed for built-ins on restore: the restore process re-applies built-ins from env and code automatically."],"exampleFix":"// before\n{\"includeRoles\": [\"admin\", \"viewer\", \"analytics-role\"]}\n// after\n{\"includeRoles\": [\"analytics-role\"]}  // or [\"*\"] for all custom roles","handlingStrategy":"validation","validationCode":"import \"slices\"\nfor _, r := range includeRoles {\n    if slices.Contains(authorization.BuiltInRoles, r) {\n        includeRoles = slices.DeleteFunc(includeRoles, func(x string) bool { return x == r })\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never list built-in roles explicitly; use '*' to cover all custom roles","Filter BuiltInRoles out of any role list copied from a role enumeration","Remember restore re-applies built-ins automatically"],"tags":["backup","rbac","roles","validation"],"backgroundTag":"built-in-role-not-backupable","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}