{"record":{"id":"c06b670ff51e3525","repo":"larksuite/cli","slug":"invalid-max-risk-q-must-be-one-of-read-write-hig","errorCode":null,"errorMessage":"invalid max_risk %q: must be one of read|write|high-risk-write","messagePattern":"invalid max_risk %q: must be one of read\\|write\\|high-risk-write","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cmdpolicy/validate.go","lineNumber":38,"sourceCode":"//   - bad MaxRisk string (\"readd\") would skip the risk check entirely\n//   - malformed doublestar pattern (\"docs/[abc\") never matches, so a\n//     plugin that meant to allow \"docs/*\" silently allows nothing,\n//     and a deny list with the same typo silently denies nothing\n//\n// A typo in either field by a plugin author or admin must abort the load\n// rather than continue with a degraded rule (hard-constraint #6 / #11\n// safety contract).\n//\n// A nil rule is a no-op (treated as \"no restriction\" everywhere -- not an\n// error).\nfunc ValidateRule(r *platform.Rule) error {\n\tif r == nil {\n\t\treturn nil\n\t}\n\n\tif r.MaxRisk != \"\" {\n\t\tif !r.MaxRisk.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid max_risk %q: must be one of read|write|high-risk-write\", r.MaxRisk)\n\t\t}\n\t}\n\n\tfor _, id := range r.Identities {\n\t\tif !id.IsValid() {\n\t\t\treturn fmt.Errorf(\"invalid identities entry %q: must be 'user' or 'bot'\", id)\n\t\t}\n\t}\n\n\tfor _, g := range r.Allow {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid allow glob %q: %w\", g, err)\n\t\t}\n\t}\n\tfor _, g := range r.Deny {\n\t\tif err := validateGlob(g); err != nil {\n\t\t\treturn fmt.Errorf(\"invalid deny glob %q: %w\", g, err)\n\t\t}","sourceCodeStart":20,"sourceCodeEnd":56,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/cmdpolicy/validate.go#L20-L56","documentation":"ValidateRule rejects rules whose MaxRisk field is set but is not a valid risk level. The only accepted values are read, write, and high-risk-write. This is a pure input validation with no wrapping — the message names the offending value verbatim.","triggerScenarios":"ValidateRule (via Resolve or LoadYAMLPolicy) receives a rule with MaxRisk set to any string other than the three valid enum values, e.g. 'admin', 'rw', 'WRITE', 'dangerous'.","commonSituations":"Typo or casing mistakes in policy YAML or plugin rule definitions, copying max_risk values from other tools' schemas, or rules written against an older/imagined version of the risk taxonomy.","solutions":["Set max_risk to exactly one of: read, write, high-risk-write (lowercase)","Check for typos or uppercase; the value is case-sensitive per the enum","If the intent was stronger restriction than the enum offers, use high-risk-write and enforce extra limits via identities","Remove the max_risk field entirely if no limit is intended (empty is valid)"],"exampleFix":"// before (policy.yaml)\nrules:\n  - max_risk: \"ADMIN\"\n// after\nrules:\n  - max_risk: \"high-risk-write\"","handlingStrategy":"validation","validationCode":"var validMaxRisk = map[string]bool{\"read\": true, \"write\": true, \"high-risk-write\": true}\nif r.MaxRisk != \"\" && !validMaxRisk[r.MaxRisk] {\n    return fmt.Errorf(\"max_risk %q invalid; use read|write|high-risk-write\", r.MaxRisk)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use the exact lowercase strings read, write, high-risk-write","Omit max_risk entirely when no restriction is intended","Share a constants file for risk levels across tools that generate policies","Run ValidateRule over policy files in CI before deployment"],"tags":["validation","enum","policy"],"backgroundTag":"invalid-enum-value","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}