{"record":{"id":"a7e1628a0c49197e","repo":"SigNoz/signoz","slug":"codeinvalidinput-a7e162","errorCode":"CodeInvalidInput","errorMessage":"checkErr.GetMessage()","messagePattern":"checkErr\\.GetMessage\\(\\)","errorType":"error_code","errorClass":"errors.SignozError","httpStatus":400,"severity":"error","filePath":"pkg/authz/openfgaserver/server.go","lineNumber":426,"sourceCode":"\n\treturn string(expectedAuthModelBytes) == string(actualAuthModelBytes), nil\n\n}\n\nfunc (server *Server) getStoreIDandModelID() (string, string) {\n\tserver.mtx.RLock()\n\tdefer server.mtx.RUnlock()\n\n\tstoreID := server.storeID\n\tmodelID := server.modelID\n\n\treturn storeID, modelID\n}\n\nfunc (server *Server) getCheckError(checkErr *openfgav1.CheckError) error {\n\tswitch checkErr.GetCode().(type) {\n\tcase *openfgav1.CheckError_InputError:\n\t\treturn errors.New(errors.TypeInvalidInput, errors.CodeInvalidInput, checkErr.GetMessage())\n\tdefault:\n\t\treturn errors.New(errors.TypeInternal, errors.CodeInternal, checkErr.GetMessage())\n\t}\n}\n","sourceCodeStart":408,"sourceCodeEnd":431,"githubUrl":"https://github.com/SigNoz/signoz/blob/5069bf80b08f1f00d7e014eccc09902f9871004f/pkg/authz/openfgaserver/server.go#L408-L431","documentation":"Returned by BatchCheck when one of the per-check errors returned by OpenFGA is classified as an InputError; it is re-exposed as InvalidInput with OpenFGA's own message. This means the check request itself was malformed (bad object/relation/user format, invalid model).","triggerScenarios":"Calling BatchCheck with malformed tuple data — invalid object URI, unknown relation for the model, malformed user string — causing OpenFGA to return CheckError with CheckError_InputError code.","commonSituations":"Passing resource IDs with typos or wrong format (non-UUID where model expects it); using a relation name not present in the current authorization model; model was rewritten but callers still send old relation names.","solutions":["Log checkErr.GetMessage() / the OpenFGA response for the exact offending field","Validate object/relation/user strings against the current OpenFGA authorization model before batching","Ensure the authorization model version callers use matches the model deployed to OpenFGA"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"for _, t := range req.Tuples {\n    if t.GetObject() == \"\" || t.GetRelation() == \"\" || t.GetUser() == \"\" {\n        return fmt.Errorf(\"incomplete tuple: %+v\", t)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := server.BatchCheck(ctx, req); err != nil {\n    if strings.Contains(err.Error(), \"invalid input\") { // log tuple details and return 400\n        log.Warn(\"batch check input rejected\", \"err\", err)\n    }\n}","preventionTips":["Validate tuple shape against the deployed authorization model before calling BatchCheck","Log the offending tuples alongside the OpenFGA message"],"tags":["openfga","authorization","validation","go"],"backgroundTag":"authorization-model-mismatch","analyzedSha":"5069bf80b08f1f00d7e014eccc09902f9871004f","analyzedAt":"2026-08-28T06:22:12.824Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}