{"record":{"id":"a217a9e2cc62a828","repo":"hyperledger/fabric","slug":"cannot-override-peer-type-policy-for-channeless-ac","errorCode":null,"errorMessage":"cannot override peer type policy for channeless ACL check","messagePattern":"cannot override peer type policy for channeless ACL check","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/resourceprovider.go","lineNumber":195,"sourceCode":"\n\t\tif resCfg != nil {\n\t\t\tpp := &aclmgmtPolicyProviderImpl{&policyEvaluatorImpl{resCfg}}\n\t\t\tpolicyName := pp.GetPolicyName(resName)\n\t\t\tif policyName != \"\" {\n\t\t\t\taclLogger.Debugf(\"acl policy %s found in config for resource %s\", policyName, resName)\n\t\t\t\treturn pp.CheckACL(policyName, idinfo)\n\t\t\t}\n\t\t\taclLogger.Debugf(\"acl policy not found in config for resource %s\", resName)\n\t\t}\n\t}\n\n\treturn rp.defaultProvider.CheckACL(resName, channelID, idinfo)\n}\n\n// CheckACLNoChannel implements the ACLProvider interface function\nfunc (rp *resourceProvider) CheckACLNoChannel(resName string, idinfo any) error {\n\tif !rp.enforceDefaultBehavior(resName, \"\", idinfo) {\n\t\treturn fmt.Errorf(\"cannot override peer type policy for channeless ACL check\")\n\t}\n\n\treturn rp.defaultProvider.CheckACLNoChannel(resName, idinfo)\n}\n","sourceCodeStart":177,"sourceCodeEnd":200,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/resourceprovider.go#L177-L200","documentation":"CheckACLNoChannel is the channel-less ACL check; it delegates to the default (peer-type based) provider only when the resource uses default behavior. If the caller attempts to override the peer type policy for a resource that has a channel-less ACL check configured, the provider refuses with this error, since channel-less checks must always enforce the built-in peer type policy.","triggerScenarios":"Calling CheckACLNoChannel(resName, idinfo) for a resource name whose default behavior is not enforceable (rp.enforceDefaultBehavior returns false) — i.e., an ACL resource not among the supported channel-less resources, or a custom resource registration attempting to override it.","commonSituations":"Chaincode or system component passing an arbitrary/non-standard resource name to the channel-less check; lifecycle code (e.g. _lifecycle checks like IsLosCheckCommitReadinessEnabled) invoked against a resource registered with a channel-scoped override; misconfiguration of the resource-based ACL mapping.","solutions":["Use only the supported channel-less resource names (e.g. resources in the builtin peer-type policy list such as _lifecycle checks).","If the resource is channel-scoped, call CheckACL with the channel ID instead of CheckACLNoChannel.","Review custom resource/ACL registrations (resourceprovider config) and remove overrides for channel-less resources.","Check enforceDefaultBehavior's accepted resource list to confirm the resource qualifies."],"exampleFix":"// before\nerr := aclProvider.CheckACLNoChannel(\"my/custom/resource\", id)\n// after: use channel-scoped check for non-default resources\nerr := aclProvider.CheckACL(\"my/custom/resource\", channelID, id)","handlingStrategy":"validation","validationCode":"var channellessResources = map[string]bool{\n    resources.LsccInstallsyscc: true,\n    // ... only resources valid for CheckACLNoChannel\n}\nif !channellessResources[resName] {\n    // use CheckACL with channelID instead\n}","typeGuard":"func isChannellessResource(resName string) bool {\n    return strings.HasPrefix(resName, \"lscc/\") // plus any known channel-less resource prefixes\n}","tryCatchPattern":"err := aclProvider.CheckACLNoChannel(resName, idInfo)\nif err != nil && strings.Contains(err.Error(), \"cannot override peer type policy\") {\n    // fall back to channel-scoped CheckACL(resName, channelID, idInfo)\n}","preventionTips":["Call CheckACLNoChannel only with built-in channel-less resources","Use CheckACL with a channel ID for any custom or channel-scoped resource","Do not register channel-scoped overrides for resources meant to be checked channel-lessly"],"tags":["hyperledger-fabric","acl","channelless","configuration"],"backgroundTag":"acl-resource-not-channelless","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}