{"record":{"id":"f5450eba2dea4c37","repo":"hashicorp/nomad","slug":"panic-err","errorCode":null,"errorMessage":"panic(err)","messagePattern":"panic\\(err\\)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"acl/virtual.go","lineNumber":17,"sourceCode":"// Copyright IBM Corp. 2015, 2026\n// SPDX-License-Identifier: BUSL-1.1\n\npackage acl\n\nvar ClientACL = initClientACL()\nvar ServerACL = initServerACL()\nvar ACLsDisabledACL = initACLsDisabledACL()\n\nfunc initClientACL() *ACL {\n\treturn NewClientACL(\"*\")\n}\n\nfunc NewClientACL(pool string) *ACL {\n\taclObj, err := NewACL(false, []*Policy{})\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\taclObj.client = PolicyWrite\n\taclObj.pool = pool\n\taclObj.agent = PolicyRead\n\taclObj.server = PolicyRead\n\treturn aclObj\n}\n\nfunc initServerACL() *ACL {\n\taclObj, err := NewACL(false, []*Policy{})\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\taclObj.agent = PolicyRead\n\taclObj.server = PolicyWrite\n\treturn aclObj\n}\n","sourceCodeStart":1,"sourceCodeEnd":35,"githubUrl":"https://github.com/hashicorp/nomad/blob/482b49bf1aec006f089bcfc7e632d8f6ac303e5e/acl/virtual.go#L1-L35","documentation":"NewClientACL constructs a permissive client ACL (wildcard pool, write access for client, read for agent/server) by delegating to NewACL(false, []*Policy{}). If NewACL returns an error even for this empty-policy configuration, the constructor calls panic(err), turning an ACL initialization failure into a process crash rather than a returnable error.","triggerScenarios":"Calling NewClientACL (directly, via the AllowAll-style wrapper, initClientACL, or during ResolveClientIdentityACL/resolveClaims identity resolution) when NewACL(false, []*Policy{}) fails — practically only when the underlying ACL management/initialization machinery is unavailable or in a degraded state.","commonSituations":"ACL backend/state store not initialized before building client ACLs; test harnesses constructing ACLs before the ACL subsystem is ready; regressions in NewACL that make even empty-policy construction fail.","solutions":["Fix the underlying NewACL failure: inspect the wrapped error to find why empty-policy ACL creation failed (usually subsystem initialization ordering).","Ensure the ACL subsystem/store is initialized before any code path (init functions, identity resolvers) constructs client ACLs.","In library code, replace panic with returning an error or a cached singleton so a single init failure does not crash the process.","In tests, initialize the ACL manager/fixtures before calling NewClientACL or use the AllowAll helper after subsystem setup."],"exampleFix":"// before\n// aclObj, err := NewACL(false, []*Policy{})\n// if err != nil { panic(err) }\n\n// after (caller-side guard)\n// defer func() {\n// \tif r := recover(); r != nil {\n// \t\tlog.Errorf(\"NewClientACL panicked: %v\", r)\n// \t}\n// }()\n// acl := NewClientACL(\"*\")","handlingStrategy":"try-catch","validationCode":"// ensure ACL subsystem is initialized before calling\nif !aclSubsystemReady() {\n\treturn errors.New(\"ACL subsystem not initialized; cannot build client ACL\")\n}","typeGuard":"func safeNewClientACL(pool string) (acl *ACL, err error) {\n\tdefer func() {\n\t\tif r := recover(); r != nil {\n\t\t\terr = fmt.Errorf(\"NewClientACL panicked: %v\", r)\n\t\t}\n\t}()\n\treturn NewClientACL(pool), nil\n}","tryCatchPattern":"acl, err := safeNewClientACL(\"*\")\nif err != nil {\n\tlog.Errorf(\"client ACL init failed: %v\", err)\n\treturn nil, err // degrade instead of crashing\n}","preventionTips":["Initialize the ACL subsystem before any init()/identity-resolution path builds client ACLs.","Cache the wildcard client ACL singleton instead of constructing it on every request.","Wrap panicking constructors with recover-based helpers at API boundaries.","Keep NewACL able to succeed for empty policies; add tests covering that path."],"tags":["acl","panic","initialization","consul"],"backgroundTag":"acl-initialization-panic","analyzedSha":"482b49bf1aec006f089bcfc7e632d8f6ac303e5e","analyzedAt":"2026-09-04T07:54:14.808Z","contentChangedAt":"2026-09-04T07:54:14.808Z","schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}