{"record":{"id":"f905c1a28231d4e6","repo":"juanfont/headscale","slug":"w-q-can-be-v","errorCode":null,"errorMessage":"%w: %q, can be %v","messagePattern":"%w: %q, can be (.+?)","errorType":"validation","errorClass":"ErrAutogroupNotSupportedACLSrc","httpStatus":null,"severity":"error","filePath":"hscontrol/policy/v2/types.go","lineNumber":2046,"sourceCode":"\n\treturn nil\n}\n\nfunc validateAutogroupForSrc(src *AutoGroup) error {\n\tif src == nil {\n\t\treturn nil\n\t}\n\n\tif src.Is(AutoGroupInternet) {\n\t\treturn ErrAutogroupInternetSrc\n\t}\n\n\tif src.Is(AutoGroupSelf) {\n\t\treturn ErrAutogroupSelfSrc\n\t}\n\n\tif !slices.Contains(autogroupForSrc, *src) {\n\t\treturn fmt.Errorf(\"%w: %q, can be %v\", ErrAutogroupNotSupportedACLSrc, *src, autogroupForSrc)\n\t}\n\n\treturn nil\n}\n\nfunc validateAutogroupForDst(dst *AutoGroup) error {\n\tif dst == nil {\n\t\treturn nil\n\t}\n\n\tif dst.Is(AutoGroupDangerAll) {\n\t\treturn ErrAutogroupDangerAllDst\n\t}\n\n\tif !slices.Contains(autogroupForDst, *dst) {\n\t\treturn fmt.Errorf(\"%w: %q, can be %v\", ErrAutogroupNotSupportedACLDst, *dst, autogroupForDst)\n\t}\n","sourceCodeStart":2028,"sourceCodeEnd":2064,"githubUrl":"https://github.com/juanfont/headscale/blob/565fd254d06c4c7f9a8cad1714a43445c79ba420/hscontrol/policy/v2/types.go#L2028-L2064","documentation":"validateAutogroupForSrc restricts which autogroups may appear in ACL src lists (ErrAutogroupNotSupportedACLSrc). autogroup:internet and autogroup:self are given dedicated errors; any other autogroup outside the autogroupForSrc allow-list is rejected here with the allowed values printed.","triggerScenarios":"Placing e.g. autogroup:danger-all or autogroup:member in an ACL rule's src list — only the values shown in the message are permitted as sources.","commonSituations":"Assuming membership autogroups (member, admin) can be traffic sources; porting policies between headscale versions whose allow-lists differ.","solutions":["Move the autogroup to dst if it is destination-only, per the allowed list in the error message","Replace it in src with explicit users/groups/tags","Use autogroup:member (if allowed by your version) instead of identity autogroups"],"exampleFix":"// before\n{\"src\": [\"autogroup:danger-all\"], \"dst\": [...]}\n// after\n{\"src\": [\"group:admins\"], \"dst\": [...]}","handlingStrategy":"validation","validationCode":"var autogroupForSrc = map[string]bool{\"autogroup:member\": true /* per headscale docs */}\n\nfunc validSrcAutogroup(s string) bool {\n\tif !strings.HasPrefix(s, \"autogroup:\") { return true }\n\treturn autogroupForSrc[s]\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Learn the src/dst split for autogroups before writing rules","Prefer explicit groups/tags in src for anything identity-based"],"tags":["policy","autogroup","acl","validation"],"backgroundTag":null,"analyzedSha":"565fd254d06c4c7f9a8cad1714a43445c79ba420","analyzedAt":"2026-08-15T13:12:30.133Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}