{"record":{"id":"e20f8ff84c93d914","repo":"hyperledger/fabric","slug":"unknown-id-on-channelless-checkacl-s","errorCode":null,"errorMessage":"Unknown id on channelless checkACL %s","messagePattern":"Unknown id on channelless checkACL (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/aclmgmt/defaultaclprovider.go","lineNumber":179,"sourceCode":"\tif policy == \"\" {\n\t\taclLogger.Errorf(\"Unmapped channelless policy for %s\", resName)\n\t\treturn fmt.Errorf(\"Unmapped channelless policy for %s\", resName)\n\t}\n\n\tswitch typedData := idinfo.(type) {\n\tcase *pb.SignedProposal:\n\t\treturn d.policyChecker.CheckPolicyNoChannel(policy, typedData)\n\tcase *common.Envelope:\n\t\tsd, err := protoutil.EnvelopeAsSignedData(typedData)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\treturn d.policyChecker.CheckPolicyNoChannelBySignedData(policy, sd)\n\tcase []*protoutil.SignedData:\n\t\treturn d.policyChecker.CheckPolicyNoChannelBySignedData(policy, typedData)\n\tdefault:\n\t\taclLogger.Errorf(\"Unmapped id on channelless checkACL %s\", resName)\n\t\treturn fmt.Errorf(\"Unknown id on channelless checkACL %s\", resName)\n\t}\n}\n","sourceCodeStart":161,"sourceCodeEnd":182,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/aclmgmt/defaultaclprovider.go#L161-L182","documentation":"In CheckACLNoChannel, the identity argument must be *pb.SignedProposal, *common.Envelope, or []*protoutil.SignedData (plus *protoutil.SignedData handled earlier). Any other type reaches the default branch and returns this error, because no policy check path exists for that identity representation in the channelless flow.","triggerScenarios":"Calling CheckACLNoChannel with idinfo such as *protoutil.SignedData wrapped incorrectly, an msp identity object, a *pb.Proposal (unsigned), or any custom struct.","commonSituations":"Code copied from channel-based CheckACL passing types unsupported in the channelless path; generic middleware forwarding request contexts; using a single SignedData where the API expects the slice form via other helpers.","solutions":["Pass one of: *pb.SignedProposal, *common.Envelope, or []*protoutil.SignedData.","If you have a single *protoutil.SignedData, wrap it in a slice and use a path that accepts it, or construct an Envelope.","Extract SignedData from your request before invoking the ACL provider instead of passing the raw object."],"exampleFix":"// before\naclProvider.CheckACLNoChannel(resName, signedData)\n// after\naclProvider.CheckACLNoChannel(resName, []*protoutil.SignedData{signedData})","handlingStrategy":"type-guard","validationCode":"switch v := idinfo.(type) {\ncase *pb.SignedProposal, *common.Envelope, []*protoutil.SignedData:\n    // ok\ndefault:\n    return fmt.Errorf(\"CheckACLNoChannel requires SignedProposal, Envelope, or SignedData slice, got %T\", v)\n}","typeGuard":"func isChannellessCheckableID(v any) bool {\n    switch v.(type) {\n    case *pb.SignedProposal, *common.Envelope, []*protoutil.SignedData:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := aclProvider.CheckACLNoChannel(resName, idinfo); err != nil {\n    if strings.HasPrefix(err.Error(), \"Unknown id on channelless\") {\n        return fmt.Errorf(\"unsupported identity type %T for ACL check\", idinfo)\n    }\n    return err\n}","preventionTips":["Wrap single *protoutil.SignedData into a slice before calling","Do not pass msp identities, unsigned Proposals, or request contexts as idinfo","Document accepted types in wrapper functions around the ACL provider"],"tags":["acl","policy","type-mismatch"],"backgroundTag":"unsupported-identity-type","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}