{"record":{"id":"b9c98749e2d55b77","repo":"vitessio/vitess","slug":"fail-to-initialize-table-acl-v","errorCode":null,"errorMessage":"fail to initialize Table ACL: %v","messagePattern":"fail to initialize Table ACL: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"go/vt/vtaclcheck/vtaclcheck.go","lineNumber":66,"sourceCode":"\tif opts.ACLFile == \"\" && opts.StaticAuthFile == \"\" {\n\t\treturn errors.New(\"no options specified\")\n\t}\n\n\toptions = opts\n\n\treturn nil\n}\n\n// Run the check on the given file\nfunc Run() error {\n\tif options.ACLFile != \"\" {\n\t\ttableacl.Register(\"simpleacl\", &simpleacl.Factory{})\n\t\terr := tableacl.Init(\n\t\t\toptions.ACLFile,\n\t\t\tfunc() {},\n\t\t)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"fail to initialize Table ACL: %v\", err)\n\t\t}\n\n\t\tfmt.Printf(\"JSON ACL file %s looks good\\n\", options.ACLFile)\n\t}\n\n\tif options.StaticAuthFile != \"\" {\n\t\tmysql.RegisterAuthServerStaticFromParams(options.StaticAuthFile, \"\", 0)\n\n\t\tfmt.Printf(\"Static auth file %s looks good\\n\", options.StaticAuthFile)\n\t}\n\n\treturn nil\n}\n","sourceCodeStart":48,"sourceCodeEnd":80,"githubUrl":"https://github.com/vitessio/vitess/blob/01a25a7d176f94613b8d59d799f438380a8760e4/go/vt/vtaclcheck/vtaclcheck.go#L48-L80","documentation":"vtaclcheck validates a Table ACL configuration file. It registers the simpleacl factory and calls tableacl.Init with the provided ACL file; if parsing or validating the JSON ACL file fails, the error is wrapped as 'fail to initialize Table ACL: %v' so the user knows their ACL file is invalid before the tool reports it looks good.","triggerScenarios":"Running vtaclcheck with options.ACLFile set, when tableacl.Init returns an error: malformed JSON, invalid rule entries (unknown factory names, bad principal/group fields), or an unreadable file path.","commonSituations":"Hand-edited tableacl_config.json with syntax errors; referencing an ACL factory (like simpleacl) that isn't registered in the target binary; wrong file path/permissions; config produced for a different vitess version with unsupported fields.","solutions":["Read the wrapped error to find the exact JSON/rule problem, then fix the ACL file (validate JSON syntax first with a linter or jq).","Ensure every 'factory' name in the ACL file matches a registered implementation (e.g. simpleacl) for the binary being checked.","Verify the ACL file path exists and is readable by the process running vtaclcheck.","Re-run vtaclcheck; the message 'JSON ACL file %s looks good' confirms the file is valid."],"exampleFix":"// before: malformed rule entry\n{\"table_rules\": [{\"table\": \"t1\", \"factories\": {\"simpleacl\": {\"principals\": [\"alice\"], \"groups\": \"admins\"}}}]}\n// after: groups must be a list\n{\"table_rules\": [{\"table\": \"t1\", \"factories\": {\"simpleacl\": {\"principals\": [\"alice\"], \"groups\": [\"admins\"]}}}]}","handlingStrategy":"validation","validationCode":"data, err := os.ReadFile(options.ACLFile)\nif err != nil {\n    return fmt.Errorf(\"ACL file unreadable: %w\", err)\n}\nvar cfg map[string]any\nif err := json.Unmarshal(data, &cfg); err != nil {\n    return fmt.Errorf(\"ACL file is not valid JSON: %w\", err)\n}","typeGuard":"func isACLInitErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"fail to initialize Table ACL\")\n}","tryCatchPattern":"if err := vtaclcheck.Run(...); err != nil {\n    if isACLInitErr(err) {\n        return fmt.Errorf(\"fix tableacl_config.json (check JSON syntax, factory names, file path): %w\", err)\n    }\n    return err\n}","preventionTips":["Validate ACL JSON with jq or a JSON linter before running vtaclcheck","Keep factory names in the ACL file in sync with registered implementations (simpleacl, etc.)","Check file path and read permissions when running vtaclcheck as a different user than the config owner"],"tags":["acl","configuration","validation"],"backgroundTag":"acl-config-invalid","analyzedSha":"01a25a7d176f94613b8d59d799f438380a8760e4","analyzedAt":"2026-09-01T17:28:30.605Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}