{"record":{"id":"99f5c1f47c3dbc8b","repo":"elastic/elasticsearch","slug":"files-entitlement-must-contain-mode-for-every-li","errorCode":null,"errorMessage":"files entitlement must contain 'mode' for every listed file","messagePattern":"files entitlement must contain 'mode' for every listed file","errorType":"validation","errorClass":"PolicyValidationException","httpStatus":null,"severity":"error","filePath":"libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java","lineNumber":259,"sourceCode":"            String pathSetting = checkString.apply(file, \"path_setting\");\n            String settingBaseDirAsString = checkString.apply(file, \"basedir_if_relative\");\n            String modeAsString = checkString.apply(file, \"mode\");\n            String platformAsString = checkString.apply(file, \"platform\");\n            Boolean exclusiveBoolean = checkBoolean.apply(file, \"exclusive\");\n            boolean exclusive = exclusiveBoolean != null && exclusiveBoolean;\n\n            if (file.isEmpty() == false) {\n                throw new PolicyValidationException(\"unknown key(s) [\" + file + \"] in a listed file for files entitlement\");\n            }\n            int foundKeys = (pathAsString != null ? 1 : 0) + (relativePathAsString != null ? 1 : 0) + (pathSetting != null ? 1 : 0);\n            if (foundKeys != 1) {\n                throw new PolicyValidationException(\n                    \"a files entitlement entry must contain one of \" + \"[path, relative_path, path_setting]\"\n                );\n            }\n\n            if (modeAsString == null) {\n                throw new PolicyValidationException(\"files entitlement must contain 'mode' for every listed file\");\n            }\n            Mode mode = parseMode(modeAsString);\n            Platform platform = null;\n            if (platformAsString != null) {\n                platform = parsePlatform(platformAsString);\n            }\n\n            if (relativeTo != null && relativePathAsString == null) {\n                throw new PolicyValidationException(\"'relative_to' may only be used with 'relative_path'\");\n            }\n\n            if (settingBaseDirAsString != null && pathSetting == null) {\n                throw new PolicyValidationException(\"'basedir_if_relative' may only be used with 'path_setting'\");\n            }\n\n            final FileData fileData;\n            if (relativePathAsString != null) {\n                if (relativeTo == null) {","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/elastic/elasticsearch/blob/db6a809a667c081ca1dc7500389d26975573215f/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/entitlements/FilesEntitlement.java#L241-L277","documentation":"Thrown when a files-entitlement entry has no `mode` field. Mode is mandatory on every listed file because the parser cannot infer whether read-write access is intended, and defaulting to read could silently break plugins that need to write.","triggerScenarios":"A files-entitlement entry omits the `mode` key, e.g. `{ \"path\": \"/var/log/es\" }` with no mode specified.","commonSituations":"Author assumes read is the default; entry was created by copying a template that left mode out; partial edit removed the mode line; YAML merge that dropped the key.","solutions":["Add `\"mode\": \"read\"` or `\"mode\": \"read_write\"` to every entry in the `paths` array.","Audit all entries, since the check fires per-entry — fixing one will simply surface the next."],"exampleFix":"// before\n{ \"path\": \"/var/log/es\" }\n\n// after\n{ \"path\": \"/var/log/es\", \"mode\": \"read_write\" }","handlingStrategy":"validation","validationCode":"public static void validateModePresent(Map<String,Object> entry) {\n    if (!entry.containsKey(\"mode\")) {\n        throw new IllegalArgumentException(\"files entry is missing required 'mode'\");\n    }\n}","typeGuard":"public static boolean hasMode(Map<String,Object> entry) {\n    return entry.containsKey(\"mode\");\n}","tryCatchPattern":null,"preventionTips":["Add `required: [\"mode\"]` to your policy JSON Schema.","Never assume a default mode — set it explicitly on every entry.","When iterating entries in code, fail the whole policy on the first missing mode."],"tags":["entitlements","files","policy","validation"],"backgroundTag":null,"analyzedSha":"db6a809a667c081ca1dc7500389d26975573215f","analyzedAt":"2026-08-12T01:39:14.192Z","schemaVersion":2},"datasetVersion":"2026-08-13T14:17:21.547Z"}