{"record":{"id":"b83e56bbd9f6ec3f","repo":"hyperledger/fabric","slug":"collection-config-access-policy-is-nil","errorCode":null,"errorMessage":"Collection config access policy is nil","messagePattern":"Collection config access policy is nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/privdata/simplecollection.go","lineNumber":100,"sourceCode":"}\n\n// Setup configures a simple collection object based on a given\n// StaticCollectionConfig proto that has all the necessary information\nfunc (sc *SimpleCollection) Setup(collectionConfig *peer.StaticCollectionConfig, deserializer msp.IdentityDeserializer) error {\n\tif collectionConfig == nil {\n\t\treturn errors.New(\"Nil config passed to collection setup\")\n\t}\n\tsc.conf = proto.Clone(collectionConfig).(*peer.StaticCollectionConfig)\n\tsc.name = collectionConfig.GetName()\n\n\t// get the access signature policy envelope\n\tcollectionPolicyConfig := collectionConfig.GetMemberOrgsPolicy()\n\tif collectionPolicyConfig == nil {\n\t\treturn errors.New(\"Collection config policy is nil\")\n\t}\n\taccessPolicyEnvelope := collectionPolicyConfig.GetSignaturePolicy()\n\tif accessPolicyEnvelope == nil {\n\t\treturn errors.New(\"Collection config access policy is nil\")\n\t}\n\n\terr := sc.setupAccessPolicy(collectionPolicyConfig, deserializer)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\t// get member org MSP IDs from the envelope, identities that fail to deserialize will not be returned\n\tsc.memberOrgs = getMemberOrgs(accessPolicyEnvelope.Identities, deserializer)\n\n\treturn nil\n}\n\n// setupAccessPolicy configures a simple collection object based on a given\n// StaticCollectionConfig proto that has all the necessary information\nfunc (sc *SimpleCollection) setupAccessPolicy(collectionPolicyConfig *peer.CollectionPolicyConfig, deserializer msp.IdentityDeserializer) error {\n\tvar err error\n\tsc.accessPolicy, err = getPolicy(collectionPolicyConfig, deserializer)","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/privdata/simplecollection.go#L82-L118","documentation":"Setup extracts the signature-policy envelope from the collection's MemberOrgsPolicy. This error fires when the MemberOrgsPolicy exists but contains no SignaturePolicy envelope (GetSignaturePolicy returns nil), so no access policy can be constructed. It distinguishes 'policy present but empty' from a fully missing policy.","triggerScenarios":"A CollectionPolicyConfig built with a channel-level/reference policy or an empty payload instead of a signature_policy, passed through the collection config into SimpleCollection.Setup.","commonSituations":"Mixing policy types when authoring collections config (e.g., setting channelConfigPolicy reference where signaturePolicy is required), programmatically built CollectionPolicyConfig left zero-valued, upgrade from config formats that dropped signature policies.","solutions":["Ensure each collection's memberOrgsPolicy contains a populated signaturePolicy envelope","If a channel policy reference was intended, confirm the code path supports it — otherwise convert it to a signature policy","Re-approve the chaincode definition with the corrected collections config"],"exampleFix":"// before\npolCfg := &peer.CollectionPolicyConfig{} // empty -> envelope nil\n\n// after\npolCfg := &peer.CollectionPolicyConfig{\n  Payload: &peer.CollectionPolicyConfig_SignaturePolicy{\n    SignaturePolicy: cauthdsl.SignedByMspMember(\"Org1MSP\"),\n  },\n}","handlingStrategy":"validation","validationCode":"pol := cfg.GetMemberOrgsPolicy()\nif pol != nil && pol.GetSignaturePolicy() == nil {\n  return errors.New(\"memberOrgsPolicy present but signaturePolicy envelope missing\")\n}","typeGuard":"func hasSignatureEnvelope(c *peer.CollectionPolicyConfig) bool {\n  return c != nil && c.GetSignaturePolicy() != nil\n}","tryCatchPattern":"if err := sc.Setup(cfg, deserializer); err != nil {\n  if strings.Contains(err.Error(), \"access policy is nil\") {\n    return fmt.Errorf(\"collection policy has no signature envelope: %w\", err)\n  }\n  return err\n}","preventionTips":["Build member orgs policies with cauthdsl helpers (SignedByMspMember etc.), never zero-value structs","Reject non-signature policy payloads where signaturePolicy is required","Test Setup() on every collection in CI before deploying"],"tags":["privdata","collection-config","policy"],"backgroundTag":"missing-collection-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}