{"record":{"id":"df933d75590b3fd1","repo":"padrino/padrino-framework","slug":"you-can-t-merge-any-with-other-roles","errorCode":null,"errorMessage":"You can't merge :any with other roles","messagePattern":"You can't merge :any with other roles","errorType":"exception","errorClass":"Padrino::Admin::AccessControlError","httpStatus":null,"severity":"error","filePath":"padrino-admin/lib/padrino-admin/access_control.rb","lineNumber":48,"sourceCode":"          app.send(:access_control=, Padrino::Admin::AccessControl::Base.new)\n        end\n        alias included registered\n      end\n\n      ##\n      # This base access control class where roles are defined as are authorizations.\n      #\n      class Base\n        def initialize\n          @roles, @authorizations, @project_modules = [], [], []\n        end\n\n        ##\n        # We map project modules for a given role or roles.\n        #\n        def roles_for(*roles, &block)\n          raise Padrino::Admin::AccessControlError, \"Role #{role} must be present and must be a symbol!\" if roles.any? { |r| !r.is_a?(Symbol) } || roles.empty?\n          raise Padrino::Admin::AccessControlError, \"You can't merge :any with other roles\" if roles.size > 1 && roles.any? { |r| r == :any }\n\n          @roles += roles\n          @authorizations << Authorization.new(*roles, &block)\n        end\n\n        ##\n        # Return an array of roles.\n        #\n        def roles\n          @roles.uniq.reject { |r| r == :any }\n        end\n\n        ##\n        # Return an array of project_modules.\n        #\n        def project_modules(account)\n          role = account.role.to_sym rescue :any\n          authorizations = @authorizations.find_all { |auth| auth.roles.include?(role) }","sourceCodeStart":30,"sourceCodeEnd":66,"githubUrl":"https://github.com/padrino/padrino-framework/blob/167044f3d56b2bce12f943eb826fdb0b0ea94375/padrino-admin/lib/padrino-admin/access_control.rb#L30-L66","documentation":"roles_for refuses to combine the special role :any with concrete roles. :any already matches every account, so merging it with :admin would make it ambiguous which authorization block governs a request. Give :any its own single-role block, or list only concrete roles.","triggerScenarios":"roles_for(:any, :admin); splatting an array that contains :any together with other roles (e.g. [:any] + stored_roles); refactoring a role list and leaving a stray :any in place.","commonSituations":"Trying to express 'admins plus everyone else'; iterating stored role records where one entry is 'any'; copy-pasting an existing roles_for block and appending :any.","solutions":["Split into two blocks: roles_for(:any) { ... } and roles_for(:admin) { ... }","If :any was unintended, remove it and keep only the concrete roles","When building role lists dynamically, reject :any first (roles.reject { |r| r == :any }) or assert it is the sole entry before calling roles_for"],"exampleFix":"# before\naccess_control.roles_for(:any, :admin) do |role| ... end\n\n# after\naccess_control.roles_for(:any) do |role| ... end\naccess_control.roles_for(:admin) do |role| ... end","handlingStrategy":"validation","validationCode":"roles = roles.map(&:to_sym)\nroles = roles.reject { |r| r == :any } unless roles == [:any]\naccess_control.roles_for(*roles) { |role| ... }","typeGuard":"def any_merge_safe?(*roles) = roles.size == 1 || !roles.include?(:any)","tryCatchPattern":null,"preventionTips":["Keep :any in its own roles_for(:any) block, separate from concrete roles","Filter stored role lists for :any before splatting them into roles_for","Remember :any already matches every account — combining it buys nothing"],"tags":["padrino-admin","access-control","ruby","roles","configuration"],"backgroundTag":"invalid-configuration-value","analyzedSha":"167044f3d56b2bce12f943eb826fdb0b0ea94375","analyzedAt":"2026-08-23T12:41:41.049Z","schemaVersion":2},"datasetVersion":"2026-08-23T16:17:53.355Z"}