{"record":{"id":"f95508ba8c1a58d9","repo":"gastownhall/beads","slug":"authorize-assignee-transfer-s-read-claim-pools","errorCode":null,"errorMessage":"authorize assignee transfer %s: read claim pools: %w","messagePattern":"authorize assignee transfer (.+?): read claim pools: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/storage/uow/issue_operations.go","lineNumber":285,"sourceCode":"\treturn true\n}\n\n// authorizeAssigneeTransfer applies the shared assignee-transfer fence to an\n// update running in this unit of work. It is the sibling of the\n// issueops.AuthorizeAssigneeTransfer call in ExecuteUpdate — the same predicate\n// and the same refusal — reached through the config use case because a unit of\n// work has no transaction handle to read claim.pools from. The read only\n// happens once the transfer is otherwise fenced, and its failure propagates\n// rather than being read as \"no pools configured\": treating an unreadable\n// config as an empty alias set would refuse pool work the fence was never meant\n// to touch.\nfunc authorizeAssigneeTransfer(ctx context.Context, uw UnitOfWork, before *types.Issue, request publicops.UpdateRequest) error {\n\tif err := storageissueops.AuthorizeAssigneeTransferWithPools(before, request, nil); err == nil {\n\t\treturn nil\n\t}\n\traw, err := uw.ConfigUseCase().GetConfig(ctx, \"claim.pools\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"authorize assignee transfer %s: read claim pools: %w\", request.IssueID, err)\n\t}\n\treturn storageissueops.AuthorizeAssigneeTransferWithPools(before, request, storageissueops.ParseClaimPools(raw))\n}\n\nfunc updateSpec(request publicops.UpdateRequest) (domain.UpdateSpec, error) {\n\tfields := make(map[string]any)\n\tpatch := request.Patch\n\tif err := validateMetadataPatch(patch.Metadata); err != nil {\n\t\treturn domain.UpdateSpec{}, validationError(err)\n\t}\n\tsetField(fields, \"title\", patch.Title)\n\tsetField(fields, \"description\", patch.Description)\n\tsetField(fields, \"design\", patch.Design)\n\tsetField(fields, \"acceptance_criteria\", patch.AcceptanceCriteria)\n\tsetField(fields, \"spec_id\", patch.SpecID)\n\tsetField(fields, \"await_id\", patch.AwaitID)\n\tsetField(fields, \"status\", patch.Status)\n\tsetField(fields, \"priority\", patch.Priority)","sourceCodeStart":267,"sourceCodeEnd":303,"githubUrl":"https://github.com/gastownhall/beads/blob/71377f276968b452ee607177637970a4ff888584/internal/storage/uow/issue_operations.go#L267-L303","documentation":"authorizeAssigneeTransfer checks whether an update changes the assignee in a way the claim-pool policy forbids. If the initial check (with nil pools) fails, it reads the 'claim.pools' config; failing to read that config produces this wrapped error. It is an infrastructure failure reading configuration, not a policy denial — a denial surfaces as the original AuthorizeAssigneeTransferWithPools error instead.","triggerScenarios":"runUpdate hits an assignee change requiring pool authorization, and uw.ConfigUseCase().GetConfig(ctx, \"claim.pools\") errors (missing config store, query failure, connectivity).","commonSituations":"Config table absent after a fresh/failed initialization; DB unreachable during update; a UoW assembled without a ConfigUseCase (nil dereference path before the read).","solutions":["Read the wrapped error to see why the claim.pools config read failed.","Initialize/repair the config store so 'claim.pools' is readable (e.g. bd doctor / migrations).","Retry the update if the failure was transient (connection blip)."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// ensure claim.pools config exists before assignee-changing updates\nif _, err := cfg.GetConfig(ctx, \"claim.pools\"); err != nil { /* initialize config */ }","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"read claim pools\") {\n    // config infra failure: retry or repair config store\n    return repairAndRetry()\n}","preventionTips":["Initialize the config store (claim.pools) during setup.","Distinguish config-read failures from policy denials in error handling.","Run bd doctor after fresh installs to verify config readability."],"tags":["authorization","config","assignee"],"backgroundTag":"config-read-failed","analyzedSha":"71377f276968b452ee607177637970a4ff888584","analyzedAt":"2026-08-30T18:55:39.744Z","schemaVersion":2},"datasetVersion":"2026-08-30T23:17:21.991Z"}