{"record":{"id":"acee9085d66c2e00","repo":"ruvnet/ruflo","slug":"unsupported-federation-authorization-mode-strin","errorCode":null,"errorMessage":"Unsupported federation authorization mode: ${String(mode)}","messagePattern":"Unsupported federation authorization mode: (.+?)","errorType":"exception","errorClass":"TypeError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/plugin-agent-federation/src/application/claim-checker.ts","lineNumber":45,"sourceCode":"/**\n * Compatibility bridge for the legacy federation policy engine.\n *\n * This removes the anonymous `() => true` production stub and makes\n * compatibility behavior explicit:\n * - legacy: preserve pre-ADR-325 behavior;\n * - observe: calculate and report missing grants without blocking;\n * - enforce: default deny unless the exact claim is configured.\n *\n * ADR-324 policy adapters can supply the `grantedClaims` set after evaluating\n * the request; ownership-changing federation messages remain disabled in the\n * default message policy until the full ingress PEP is composed.\n */\nexport function createFederationClaimChecker(\n  config: FederationClaimCheckerConfig = {},\n): FederationClaimChecker {\n  const mode = config.mode ?? 'legacy';\n  if (mode !== 'legacy' && mode !== 'observe' && mode !== 'enforce') {\n    throw new TypeError(`Unsupported federation authorization mode: ${String(mode)}`);\n  }\n\n  const grantedClaims = new Set<FederationClaimType>();\n  for (const claim of config.grantedClaims ?? []) {\n    if (!FEDERATION_CLAIMS.has(claim as FederationClaimType)) {\n      throw new TypeError(`Unknown federation claim: ${claim}`);\n    }\n    grantedClaims.add(claim as FederationClaimType);\n  }\n\n  return {\n    mode,\n    grantedClaims,\n    checkClaim: (claim) => {\n      const granted = grantedClaims.has(claim);\n      if (mode === 'observe') config.onObservation?.(claim, granted);\n      return mode !== 'enforce' || granted;\n    },","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/plugin-agent-federation/src/application/claim-checker.ts#L27-L63","documentation":"createFederationClaimChecker() accepts exactly three authorization modes: 'legacy' (the default when mode is omitted), 'observe', and 'enforce'. Any other value throws a TypeError at construction time, before any claim is evaluated. This is a programmer/config error, not a runtime data condition.","triggerScenarios":"Typos such as 'enforced' or 'stric'; wrong casing like 'Enforce'; mode strings sourced from env vars or config files with trailing whitespace; mode names from a newer package version passed to an older one.","commonSituations":"Env-var-driven policy configuration without normalization; configs copied from documentation of a different release; ADR-324 adapters emitting their own mode vocabulary.","solutions":["Use exactly one of the literals 'legacy', 'observe', or 'enforce'","If mode comes from env/config, trim and lowercase it, then validate against the allowed set before constructing","Type the config field as the union 'legacy' | 'observe' | 'enforce' so TypeScript rejects bad literals at compile time","Align package versions if the mode name genuinely exists in a newer release"],"exampleFix":"// before\ncreateFederationClaimChecker({ mode: 'Enforce' as any });\n// after\nconst mode = 'enforce' as const;\ncreateFederationClaimChecker({ mode });","handlingStrategy":"type-guard","validationCode":"const MODES = ['legacy', 'observe', 'enforce'] as const;\nconst raw = (config.mode ?? 'legacy').toString().trim().toLowerCase();\nconst mode = (MODES as readonly string[]).includes(raw)\n  ? (raw as (typeof MODES)[number])\n  : 'legacy';\ncreateFederationClaimChecker({ ...config, mode });","typeGuard":"type FederationAuthMode = 'legacy' | 'observe' | 'enforce';\nfunction isFederationAuthMode(m: unknown): m is FederationAuthMode {\n  return m === 'legacy' || m === 'observe' || m === 'enforce';\n}","tryCatchPattern":null,"preventionTips":["Type config fields as the literal union so bad values fail at compile time","Normalize env-sourced modes: trim + lowercase before use","Fail fast in your config loader with a list of valid modes","Keep package versions aligned so mode vocabularies match"],"tags":["config","enum","authorization"],"backgroundTag":"invalid-enum-value","analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}