{"record":{"id":"c53e6924ca61b84d","repo":"grpc/grpc-go","slug":"name-is-not-present","errorCode":null,"errorMessage":"\"name\" is not present","messagePattern":"\"name\" is not present","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"authz/rbac_translator.go","lineNumber":370,"sourceCode":"\t\treturn v3rbacpb.RBAC_AuditLoggingOptions_ON_DENY\n\tdefault:\n\t\treturn v3rbacpb.RBAC_AuditLoggingOptions_NONE\n\t}\n}\n\n// translatePolicy translates SDK authorization policy in JSON format to two\n// Envoy RBAC polices (deny followed by allow policy) or only one Envoy RBAC\n// allow policy. Also returns the overall policy name. If the input policy\n// cannot be parsed or is invalid, an error will be returned.\nfunc translatePolicy(policyStr string) ([]*v3rbacpb.RBAC, string, error) {\n\tpolicy := &authorizationPolicy{}\n\td := json.NewDecoder(bytes.NewReader([]byte(policyStr)))\n\td.DisallowUnknownFields()\n\tif err := d.Decode(policy); err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"failed to unmarshal policy: %v\", err)\n\t}\n\tif policy.Name == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(`\"name\" is not present`)\n\t}\n\tif len(policy.AllowRules) == 0 {\n\t\treturn nil, \"\", fmt.Errorf(`\"allow_rules\" is not present`)\n\t}\n\tallowLogger, denyLogger, err := policy.AuditLoggingOptions.toProtos()\n\tif err != nil {\n\t\treturn nil, \"\", err\n\t}\n\trbacs := make([]*v3rbacpb.RBAC, 0, 2)\n\tif len(policy.DenyRules) > 0 {\n\t\tdenyPolicies, err := parseRules(policy.DenyRules, policy.Name)\n\t\tif err != nil {\n\t\t\treturn nil, \"\", fmt.Errorf(`\"deny_rules\" %v`, err)\n\t\t}\n\t\tdenyRBAC := &v3rbacpb.RBAC{\n\t\t\tAction:              v3rbacpb.RBAC_DENY,\n\t\t\tPolicies:            denyPolicies,\n\t\t\tAuditLoggingOptions: denyLogger,","sourceCodeStart":352,"sourceCodeEnd":388,"githubUrl":"https://github.com/grpc/grpc-go/blob/03255a9237b6eb32710f6bc4f2de9a675b99fe36/authz/rbac_translator.go#L352-L388","documentation":"Raised by translatePolicy right after JSON decode succeeds: the top-level \"name\" field of the gRPC authorization policy is mandatory and must be non-empty. The policy name is used as a prefix for every generated RBAC policy key, so an empty name would collide and is rejected before translation proceeds.","triggerScenarios":"The policy JSON decodes cleanly but the \"name\" field is missing or empty string. translatePolicy checks `policy.Name == \"\"` and returns this exact message (no index, since name is a top-level scalar).","commonSituations":"Forgetting the name field entirely; setting name to \"\" intentionally; building the policy from a template whose name placeholder wasn't substituted; assuming name is optional.","solutions":["Add a top-level \"name\" field with a unique, non-empty identifier for the policy.","Ensure the name is unique across all policies loaded by the same interceptor set.","Validate the policy JSON has a non-empty \"name\" in a pre-deploy lint.","Generate policies from the SDK's documented example as a base template."],"exampleFix":"// before:\n{ \"allow_rules\": [ ... ] }   // no top-level name\n\n// after:\n{ \"name\": \"payments-svc-policy\", \"allow_rules\": [ ... ] }","handlingStrategy":"validation","validationCode":"func validatePolicyName(policyStr string) error {\n    var p struct {\n        Name string `json:\"name\"`\n    }\n    if err := json.Unmarshal([]byte(policyStr), &p); err != nil { return err }\n    if strings.TrimSpace(p.Name) == \"\" {\n        return fmt.Errorf(`\"name\" is not present`) // mirrors SDK message\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always set a unique top-level policy name.","Substitute name placeholders in templated policies.","Lint for non-empty name in CI.","Use the SDK example policy as a base template."],"tags":["authz","rbac","authorization-policy","config","validation"],"analyzedSha":"03255a9237b6eb32710f6bc4f2de9a675b99fe36","analyzedAt":"2026-08-07T00:29:34.215Z","schemaVersion":2},"datasetVersion":"2026-08-07T03:17:09.362Z"}