{"record":{"id":"e5a70f1a0b25d790","repo":"weaviate/weaviate","slug":"policiestopermission-w","errorCode":null,"errorMessage":"PoliciesToPermission: %w","messagePattern":"PoliciesToPermission: %w","errorType":"http","errorClass":null,"httpStatus":500,"severity":"error","filePath":"adapters/handlers/rest/authz/handlers_authz.go","lineNumber":648,"sourceCode":"\tfor roleName, policies := range roles {\n\t\tif roleName == authorization.Root && !slices.Contains(h.rbacconfig.RootUsers, principal.Username) {\n\t\t\tcontinue\n\t\t}\n\n\t\tname := roleName\n\t\tif h.namespacesEnabled {\n\t\t\t// Hide other namespaces' roles, reserved global roles, and any whose\n\t\t\t// permissions the caller does not already hold; strip the caller's own\n\t\t\t// namespace prefix.\n\t\t\tif !rolevisibility.RoleVisibleToCaller(ctx, h.authorizer, h.namespacesEnabled, principal, roleName, policies) {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tname = namespacing.StripOwnNamespace(principal, roleName)\n\t\t}\n\n\t\tperms, err := conv.PoliciesToPermission(policies...)\n\t\tif err != nil {\n\t\t\treturn authz.NewGetRolesInternalServerError().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf(\"PoliciesToPermission: %w\", err)))\n\t\t}\n\t\tresponse = append(response, &models.Role{Name: &name, Permissions: perms})\n\t}\n\n\t// On NS-disabled clusters visibility stays on the role-name matcher\n\t// (READ_ALL, then READ_MATCH on the same set); NS-enabled was already\n\t// content-filtered in the loop above.\n\tif !h.namespacesEnabled {\n\t\tresourceFilter := filter.New[*models.Role](h.authorizer, h.rbacconfig)\n\t\troleResource := func(role *models.Role) string {\n\t\t\treturn authorization.Roles(*role.Name)[0]\n\t\t}\n\t\tfiltered := resourceFilter.Filter(ctx, principal, response,\n\t\t\tauthorization.VerbWithScope(authorization.READ, authorization.ROLE_SCOPE_ALL), roleResource)\n\t\tif len(filtered) == 0 {\n\t\t\t// try match if all was none\n\t\t\tfiltered = resourceFilter.Filter(ctx, principal, response,\n\t\t\t\tauthorization.VerbWithScope(authorization.READ, authorization.ROLE_SCOPE_MATCH), roleResource)","sourceCodeStart":630,"sourceCodeEnd":666,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/adapters/handlers/rest/authz/handlers_authz.go#L630-L666","documentation":"Wraps conv.PoliciesToPermission failure while listing roles in getRoles: after visibility filtering and namespace-prefix stripping, a visible role's permission set could not be converted to the API response form — typically a malformed stored permission. The whole role-list request fails with a 500 rather than returning a partial list.","triggerScenarios":"Thrown at adapters/handlers/rest/authz/handlers_authz.go:648 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Inspect the stored roles for malformed permissions","Fix or delete the offending role via the controller","Report if all stored roles appear well-formed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}