{"record":{"id":"b2f49f4013c52c19","repo":"hyperledger/fabric","slug":"error-parsing-role-s","errorCode":null,"errorMessage":"error parsing role %s","messagePattern":"error parsing role (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"common/policydsl/policyparser.go","lineNumber":192,"sourceCode":"\t\t\t\treturn nil, fmt.Errorf(\"error parsing principal %s\", t)\n\t\t\t}\n\n\t\t\t/* get the right role */\n\t\t\tvar r mb.MSPRole_MSPRoleType\n\n\t\t\tswitch subm[0][3] {\n\t\t\tcase RoleMember:\n\t\t\t\tr = mb.MSPRole_MEMBER\n\t\t\tcase RoleAdmin:\n\t\t\t\tr = mb.MSPRole_ADMIN\n\t\t\tcase RoleClient:\n\t\t\t\tr = mb.MSPRole_CLIENT\n\t\t\tcase RolePeer:\n\t\t\t\tr = mb.MSPRole_PEER\n\t\t\tcase RoleOrderer:\n\t\t\t\tr = mb.MSPRole_ORDERER\n\t\t\tdefault:\n\t\t\t\treturn nil, fmt.Errorf(\"error parsing role %s\", t)\n\t\t\t}\n\n\t\t\t/* build the principal we've been told */\n\t\t\tmspRole, err := proto.Marshal(&mb.MSPRole{MspIdentifier: subm[0][1], Role: r})\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"error marshalling msp role: %s\", err)\n\t\t\t}\n\n\t\t\tp := &mb.MSPPrincipal{\n\t\t\t\tPrincipalClassification: mb.MSPPrincipal_ROLE,\n\t\t\t\tPrincipal:               mspRole,\n\t\t\t}\n\t\t\tctx.principals = append(ctx.principals, p)\n\n\t\t\t/* create a SignaturePolicy that requires a signature from\n\t\t\t   the principal we've just built*/\n\t\t\tdapolicy := SignedBy(int32(ctx.IDNum))\n\t\t\tpolicies = append(policies, dapolicy)","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/common/policydsl/policyparser.go#L174-L210","documentation":"secondPass maps the captured role substring to an mb.MSPRole_MSPRoleType; because the principal regex only admits the five known roles, this default branch is a defensive guard for internal inconsistency (regex/pass mismatch) or custom role constants. Hitting it means the role text extracted from the principal was not one of member/admin/client/peer/orderer.","triggerScenarios":"Practically only reachable if the principal regex is altered, a fork adds roles without updating this switch, or the Role* constants are redefined so the regex and switch disagree; also via direct secondPass calls with doctored inputs.","commonSituations":"Patched/forked Fabric policydsl where a new role was added to the regex but not to the switch (or vice versa); build/version skew between vendored copies of the package; tests injecting synthetic principal strings bypassing the regex path.","solutions":["Use one of the five supported roles: member, admin, client, peer, orderer.","If you need a new role, update both the regex (line 39) and the role switch (line 180) consistently in your fork.","Check that vendored copies of policydsl aren't mismatched — align to a single upstream version.","If the error appears with stock Fabric, report/inspect for a modified regex or constants (RoleAdmin etc.)."],"exampleFix":"// before (fork)\nregex admits \"owner\" but switch has no case RoleOwner -> default: error parsing role\n// after\ncase RoleOwner: r = mb.MSPRole(6) // add the case, and keep regex and constants in sync","handlingStrategy":"validation","validationCode":"switch role {\ncase \"member\", \"admin\", \"client\", \"peer\", \"orderer\":\n\t// ok\ndefault:\n\treturn fmt.Errorf(\"unsupported role %q\", role)\n}","typeGuard":"func knownRole(r string) bool {\n\tswitch r {\n\tcase \"member\", \"admin\", \"client\", \"peer\", \"orderer\":\n\t\treturn true\n\t}\n\treturn false\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"error parsing role\") {\n\treturn nil, fmt.Errorf(\"role not mapped in policydsl; use member/admin/client/peer/orderer: %w\", err)\n}","preventionTips":["Restrict roles to member, admin, client, peer, orderer in all config surfaces.","In forks, keep the principal regex, Role* constants, and the role switch in sync.","Pin a single version of the policydsl package across modules to avoid skew.","Add table tests covering every supported role through FromString."],"tags":["policydsl","hyperledger-fabric","role","msp","internal-inconsistency"],"backgroundTag":"invalid-principal-format","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}