{"record":{"id":"c8bbd7707a74cec9","repo":"hyperledger/fabric","slug":"collection-policy-config-is-nil","errorCode":null,"errorMessage":"collection policy config is nil","messagePattern":"collection policy config is nil","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/common/privdata/util.go","lineNumber":24,"sourceCode":"\npackage privdata\n\nimport (\n\tmspp \"github.com/hyperledger/fabric-protos-go-apiv2/msp\"\n\t\"github.com/hyperledger/fabric-protos-go-apiv2/peer\"\n\t\"github.com/hyperledger/fabric/common/cauthdsl\"\n\t\"github.com/hyperledger/fabric/common/policies\"\n\t\"github.com/hyperledger/fabric/msp\"\n\t\"github.com/pkg/errors\"\n\t\"google.golang.org/protobuf/proto\"\n)\n\n// getPolicy creates a new policy from the policy envelope. It will return an error if the envelope has invalid policy config.\n// Some caller (e.g., MembershipProvider.AsMemberOf) may drop the error and treat it as a RejectAll policy.\n// In the future, we must revisit the callers if this method will return different types of errors.\nfunc getPolicy(collectionPolicyConfig *peer.CollectionPolicyConfig, deserializer msp.IdentityDeserializer) (policies.Policy, error) {\n\tif collectionPolicyConfig == nil {\n\t\treturn nil, errors.New(\"collection policy config is nil\")\n\t}\n\taccessPolicyEnvelope := collectionPolicyConfig.GetSignaturePolicy()\n\tif accessPolicyEnvelope == nil {\n\t\treturn nil, errors.New(\"collection config access policy is nil\")\n\t}\n\t// create access policy from the envelope\n\n\tpp := cauthdsl.EnvelopeBasedPolicyProvider{Deserializer: deserializer}\n\taccessPolicy, err := pp.NewPolicy(accessPolicyEnvelope)\n\tif err != nil {\n\t\treturn nil, errors.WithMessage(err, \"failed constructing policy object out of collection policy config\")\n\t}\n\n\treturn accessPolicy, nil\n}\n\n// getMemberOrgs returns a map containing member orgs from a list of MSPPrincipals,\n// it will skip identities it fails to process","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/common/privdata/util.go#L6-L42","documentation":"getPolicy in privdata/util.go builds a concrete policies.Policy from a CollectionPolicyConfig envelope. This error fires when the config passed in is nil — there is no policy definition at all, so no policy can be created. The comment notes some callers (e.g., MembershipProvider.AsMemberOf) may discard the error and fall back to a RejectAll policy.","triggerScenarios":"setupAccessPolicy invoking getPolicy with a nil CollectionPolicyConfig (collection defined without member orgs policy), or direct/test callers passing nil.","commonSituations":"Collections config missing the memberOrgsPolicy section, programmatic construction of StaticCollectionConfig that leaves MemberOrgsPolicy unset, membership checks against collections whose policy failed to load.","solutions":["Ensure the collection's memberOrgsPolicy is populated before Setup/setupAccessPolicy is invoked","Validate the collection config package at approval/commit time so malformed configs are rejected early","If you are the caller, handle the returned error rather than treating it as RejectAll when policy presence is required"],"exampleFix":"// before\npolicy, err := getPolicy(nil, deserializer) // errors: collection policy config is nil\n\n// after\nif collectionPolicyConfig == nil {\n  return errors.New(\"collection has no member orgs policy\")\n}\npolicy, err := getPolicy(collectionPolicyConfig, deserializer)","handlingStrategy":"type-guard","validationCode":"if collectionPolicyConfig == nil {\n  return nil, errors.New(\"cannot derive policy: collection policy config is nil\")\n}","typeGuard":"func policyConfigPresent(c *peer.CollectionPolicyConfig) bool {\n  return c != nil\n}","tryCatchPattern":"policy, err := getPolicy(cfg, deserializer)\nif err != nil {\n  if strings.Contains(err.Error(), \"policy config is nil\") {\n    return nil, fmt.Errorf(\"collection misconfigured (no member orgs policy): %w\", err)\n  }\n  return nil, err\n}","preventionTips":["Never call getPolicy with a config you haven't nil-checked","Ensure collection approval validates memberOrgsPolicy presence","Don't silently map this error to RejectAll unless explicitly intended"],"tags":["privdata","nil-check","policy"],"backgroundTag":"missing-collection-policy","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}