{"record":{"id":"b3cd1633f01440d7","repo":"larksuite/cli","slug":"policy-yaml-q-w","errorCode":null,"errorMessage":"policy yaml %q: %w","messagePattern":"policy yaml %q: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/resolver.go","lineNumber":71,"sourceCode":"\tif len(owners) > 1 {\n\t\treturn nil, ResolveSource{}, fmt.Errorf(\"%w: %v\", ErrMultipleRestricts, owners)\n\t}\n\n\tif len(s.PluginRules) > 0 {\n\t\trules := make([]*platform.Rule, 0, len(s.PluginRules))\n\t\tfor _, pr := range s.PluginRules {\n\t\t\tif err := ValidateRule(pr.Rule); err != nil {\n\t\t\t\treturn nil, ResolveSource{}, fmt.Errorf(\"plugin %q rule invalid: %w\", pr.PluginName, err)\n\t\t\t}\n\t\t\trules = append(rules, pr.Rule)\n\t\t}\n\t\treturn rules, ResolveSource{Kind: SourcePlugin, Name: owners[0]}, nil\n\t}\n\n\tif len(s.YAMLRules) > 0 {\n\t\tfor _, r := range s.YAMLRules {\n\t\t\tif err := ValidateRule(r); err != nil {\n\t\t\t\treturn nil, ResolveSource{}, fmt.Errorf(\"policy yaml %q: %w\", s.YAMLPath, err)\n\t\t\t}\n\t\t}\n\t\treturn s.YAMLRules, ResolveSource{Kind: SourceYAML, Name: s.YAMLPath}, nil\n\t}\n\n\treturn nil, ResolveSource{Kind: SourceNone}, nil\n}\n\n// distinctOwners returns the unique plugin names contributing a rule, in\n// first-seen order. A single plugin contributing N rules collapses to one\n// owner; that is the case the single-owner check below permits.\nfunc distinctOwners(prs []PluginRule) []string {\n\tseen := map[string]bool{}\n\towners := make([]string, 0, len(prs))\n\tfor _, pr := range prs {\n\t\tif !seen[pr.PluginName] {\n\t\t\tseen[pr.PluginName] = true\n\t\t\towners = append(owners, pr.PluginName)","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/resolver.go#L53-L89","documentation":"Resolve validates each YAML policy rule with ValidateRule; a failure is wrapped as 'policy yaml %q: %w' naming the YAML file path. The same format is reused when parsing the YAML fails inside LoadYAMLPolicy, so this message can indicate either schema-invalid rules or unparseable YAML content.","triggerScenarios":"Resolve with non-empty YAMLRules where any rule fails ValidateRule; or LoadYAMLPolicy feeding Resolve where pyaml.Parse fails on the file's contents.","commonSituations":"Hand-edited policy YAML with an invalid max_risk string or an identities entry other than 'user'/'bot', wrong YAML structure (rules not matching the expected schema), or malformed YAML syntax.","solutions":["Read the wrapped cause for the exact failing rule/field","Fix max_risk to one of read|write|high-risk-write","Ensure every identities entry is exactly 'user' or 'bot'","Validate the YAML parses (yaml lint) and matches the expected policy rule schema"],"exampleFix":"// before (policy.yaml)\nrules:\n  - max_risk: \"admin\"\n    identities: [\"bot\", \"service\"]\n// after\nrules:\n  - max_risk: \"high-risk-write\"\n    identities: [\"bot\"]","handlingStrategy":"validation","validationCode":"func validateYAMLPolicy(path string) error {\n    data, err := os.ReadFile(path)\n    if err != nil { return err }\n    rules, err := pyaml.Parse(data)\n    if err != nil { return fmt.Errorf(\"policy yaml %q: %w\", path, err) }\n    for _, r := range rules {\n        if err := cmdpolicy.ValidateRule(r); err != nil {\n            return fmt.Errorf(\"policy yaml %q: %w\", path, err)\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Lint policy YAML (syntax and schema) before deploying","Keep a checked-in, validated example policy file","Re-validate after every manual edit to the policy file","Test LoadYAMLPolicy in CI with the actual policy file"],"tags":["validation","yaml","policy"],"backgroundTag":"rule-validation-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}