{"record":{"id":"db66bdcd1a09979a","repo":"kubesphere/kubesphere","slug":"incorrect-username-s-the-username-must-equal-to","errorCode":null,"errorMessage":"incorrect username %s, the username must equal to the member","messagePattern":"incorrect username (.+?), the username must equal to the member","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/kapis/iam/v1beta1/handler.go","lineNumber":869,"sourceCode":"\t\tapi.HandleBadRequest(response, request, NewErrMemberNotExist(member.Username))\n\t\treturn\n\t}\n\n\terr = h.am.CreateOrUpdateNamespaceRoleBinding(member.Username, namespace, member.RoleRef)\n\tif err != nil {\n\t\tapi.HandleError(response, request, err)\n\t\treturn\n\t}\n\n\tresponse.WriteEntity(servererr.None)\n}\n\nfunc NewErrMemberNotExist(username string) error {\n\treturn fmt.Errorf(\"member %s not exist\", username)\n}\n\nfunc NewErrIncorrectUsername(username string) error {\n\treturn fmt.Errorf(\"incorrect username %s, the username must equal to the member\", username)\n}\n","sourceCodeStart":851,"sourceCodeEnd":871,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/kapis/iam/v1beta1/handler.go#L851-L871","documentation":"NewErrIncorrectUsername builds 'incorrect username %s, the username must equal to the member' — returned by UpdateWorkspaceMember/UpdateClusterMember/UpdateNamespaceMember when the username in the request body does not match the username in the URL path. Membership updates only allow changing the role of the specified member, not renaming/replacing it.","triggerScenarios":"PUT/PATCH of a workspace/cluster/namespace member where body.username != path username, e.g. path .../members/alice but body {\"username\":\"bob\",\"roleAnnotation\":...}.","commonSituations":"Client code building the body from a different variable than the path param; bulk-update loops sending the wrong payload; copied request templates with a stale username; attempts to repurpose the update endpoint to swap members.","solutions":["Make the request body's username exactly match the URL path username","Fix client code to derive the body username from the same source as the path","To change membership identity, delete the old member and create the new one instead of updating"],"exampleFix":"// before\nbody := `\"username\": \"bob\"` // path: members/alice\n// after\nbody := fmt.Sprintf(`\"username\": %q`, usernameFromPath)","handlingStrategy":"validation","validationCode":"if body.Username != pathUsername {\n  return fmt.Errorf(\"body username %q must equal path member %q\", body.Username, pathUsername)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"incorrect username\") {\n  return ErrUsernameMismatch\n}","preventionTips":["Derive request body username from the same variable as the URL path","Never attempt to swap members via update; delete+create instead","Write client tests asserting body/path equality","Avoid copying request templates with hardcoded usernames"],"tags":["kubesphere","membership","validation"],"backgroundTag":"username-path-body-mismatch","analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}