{"record":{"id":"d908210a8b635e52","repo":"juanfont/headscale","slug":"compiling-ssh-policy-w","errorCode":null,"errorMessage":"compiling SSH policy: %w","messagePattern":"compiling SSH policy: %w","errorType":"validation","errorClass":null,"httpStatus":400,"severity":"error","filePath":"hscontrol/policy/v2/policy.go","lineNumber":438,"sourceCode":"\treturn false\n}\n\n// SSHPolicy returns the [tailcfg.SSHPolicy] for node, compiling and\n// caching on first access. Rules use SessionDuration = 0 (no\n// auto-approval) and emit check URLs of the form\n// /machine/ssh/action/{src}/to/{dst}?local_user={local_user} per the\n// SaaS wire format. Cache is invalidated on policy reload.\nfunc (pm *PolicyManager) SSHPolicy(baseURL string, node types.NodeView) (*tailcfg.SSHPolicy, error) {\n\tpm.mu.RLock()\n\tdefer pm.mu.RUnlock()\n\n\tif sshPol, ok := pm.sshPolicyMap.Load(node.ID()); ok {\n\t\treturn sshPol, nil\n\t}\n\n\tsshPol, err := pm.pol.compileSSHPolicy(baseURL, pm.users, node, pm.nodes)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"compiling SSH policy: %w\", err)\n\t}\n\n\tpm.sshPolicyMap.Store(node.ID(), sshPol)\n\n\treturn sshPol, nil\n}\n\n// SSHCheckParams resolves the SSH check period for a source-destination\n// node pair by looking up the current policy. This avoids trusting URL\n// parameters that a client could tamper with. First-match wins across\n// the policy's SSH rules.\n//\n// Returns (duration, true) when a matching rule is found and\n// (0, false) when none is. A (0, true) return means the matched rule\n// uses a zero check period (re-check every session).\nfunc (pm *PolicyManager) SSHCheckParams(\n\tsrcNodeID, dstNodeID types.NodeID,\n) (time.Duration, bool) {","sourceCodeStart":420,"sourceCodeEnd":456,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/policy.go#L420-L456","documentation":"Error \"compiling SSH policy: %w\" thrown in juanfont/headscale.","triggerScenarios":"Thrown at hscontrol/policy/v2/policy.go:438 when the library encounters an invalid state.","commonSituations":"Compilation of the SSH section of the policy failed. Review the SSH rules for invalid actions, sources, or destinations.","solutions":["Inspect the wrapped error for the underlying cause and correct the failing condition (compiling SSH policy); retry the operation after fixing the input, configuration, or environment."],"exampleFix":"Inspect the wrapped error for the underlying cause and correct the failing condition (compiling SSH policy); retry the operation after fixing the input, configuration, or environment.","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}