{"record":{"id":"9ccd4837378e96e1","repo":"crowdsecurity/crowdsec","slug":"unable-to-check-if-value-is-allowlisted-w","errorCode":null,"errorMessage":"unable to check if value is allowlisted: %w","messagePattern":"unable to check if value is allowlisted: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/database/allowlists.go","lineNumber":327,"sourceCode":"\t\t\t\t\t\tallowlistitem.And(\n\t\t\t\t\t\t\tallowlistitem.StartIPEQ(rng.Start.Addr),\n\t\t\t\t\t\t\tallowlistitem.StartSuffixGTE(rng.Start.Sfx),\n\t\t\t\t\t\t)),\n\t\t\t\t\tallowlistitem.Or(\n\t\t\t\t\t\tallowlistitem.EndIPLT(rng.End.Addr),\n\t\t\t\t\t\tallowlistitem.And(\n\t\t\t\t\t\t\tallowlistitem.EndIPEQ(rng.End.Addr),\n\t\t\t\t\t\t\tallowlistitem.EndSuffixLTE(rng.End.Sfx),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t),\n\t\t\t),\n\t\t)\n\t}\n\n\titems, err := query.WithAllowlist().All(ctx)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"unable to check if value is allowlisted: %w\", err)\n\t}\n\n\t// doing this in ent is not worth the complexity\n\tsort.SliceStable(items, func(i, j int) bool {\n\t\treturn items[i].Edges.Allowlist[0].Name < items[j].Edges.Allowlist[0].Name\n\t})\n\n\tfor _, item := range items {\n\t\tif len(item.Edges.Allowlist) == 0 {\n\t\t\tcontinue\n\t\t}\n\n\t\treason := item.Value + \" from \" + item.Edges.Allowlist[0].Name\n\t\tif item.Comment != \"\" {\n\t\t\treason += \" (\" + item.Comment + \")\"\n\t\t}\n\n\t\treasons = append(reasons, reason)","sourceCodeStart":309,"sourceCodeEnd":345,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/allowlists.go#L309-L345","documentation":"IsAllowlistedBy queries allowlist items matching a value (IP or CIDR) together with their parent allowlist edge, to produce human-readable matching reasons. If the ent query (WithAllowlist().All) fails, this error wraps the DB failure. Note the sort afterwards assumes every item has a non-empty Edges.Allowlist.","triggerScenarios":"Calling IsAllowlistedBy / CheckInAllowlistBulk / TestIsAllowListedBy_* when the underlying allowlist_item query fails: SQLite 'database is locked', disk I/O error, or schema mismatch (e.g. upgrading crowdsec without running the DB migration).","commonSituations":"Bouncer or LAPI lookups during heavy write load locking the SQLite DB; running a newer binary against an older schema that lacks the allowlist tables.","solutions":["Read the wrapped error: 'database is locked' means reduce concurrent writers or switch to a client-server DB","Run 'cscli db migrate' / upgrade flow if the schema is older than the binary","Verify DB file integrity and disk space; restore from backup if corrupted","Retry the lookup - it is read-only and safe to repeat"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"if _, err := csnet.NewRange(value); err != nil {\n    return fmt.Errorf(\"invalid allowlist lookup value %q\", value)\n}","typeGuard":null,"tryCatchPattern":"reasons, err := c.IsAllowlistedBy(ctx, value)\nif err != nil {\n    if strings.Contains(err.Error(), \"database is locked\") {\n        return c.IsAllowlistedBy(ctx, value) // read-only, safe to retry\n    }\n    return fmt.Errorf(\"allowlist lookup failed: %w\", err)\n}","preventionTips":["Run DB migrations when upgrading crowdsec before serving lookups","Keep SQLite writers serialized or move to a client-server DB at scale","Validate the value parses as an IP/CIDR before the DB call"],"tags":["database","allowlist","query","sqlite"],"backgroundTag":"database-query-failed","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}