{"record":{"id":"fdab516d5ed2a16b","repo":"bitwarden/server","slug":"conditions-error","errorCode":null,"errorMessage":"conditions.Error!","messagePattern":"conditions\\.Error!","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"bitwarden_license/src/Services/Pam/Services/AccessRuleWriteValidator.cs","lineNumber":45,"sourceCode":"    }\n\n    public async Task<List<Guid>> ValidateAsync(Guid organizationId, AccessRule rule,\n        IEnumerable<Guid> collectionIds, Guid? existingRuleId = null)\n    {\n        if (string.IsNullOrWhiteSpace(rule.Name))\n        {\n            throw new BadRequestException(\"Name is required.\");\n        }\n\n        if (rule.AllowsExtensions && rule.MaxExtensionDurationSeconds is not > 0)\n        {\n            throw new BadRequestException(\"A maximum extension length is required when extensions are allowed.\");\n        }\n\n        var conditions = _conditionsValidator.Validate(rule.Conditions);\n        if (!conditions.IsValid)\n        {\n            throw new BadRequestException(conditions.Error!);\n        }\n\n        await ValidateNameIsUniqueAsync(organizationId, rule.Name, existingRuleId);\n\n        return await ValidateCollectionsAsync(organizationId, collectionIds, existingRuleId);\n    }\n\n    private async Task ValidateNameIsUniqueAsync(Guid organizationId, string name, Guid? existingRuleId)\n    {\n        var siblings = await _repository.GetManyByOrganizationIdAsync(organizationId);\n        if (siblings.Any(r => r.Id != existingRuleId && string.Equals(r.Name, name, StringComparison.OrdinalIgnoreCase)))\n        {\n            throw new BadRequestException(\"A rule with that name already exists.\");\n        }\n    }\n\n    private async Task<List<Guid>> ValidateCollectionsAsync(Guid organizationId, IEnumerable<Guid> collectionIds,\n        Guid? existingRuleId)","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/bitwarden_license/src/Services/Pam/Services/AccessRuleWriteValidator.cs#L27-L63","documentation":"Thrown as a BadRequestException (HTTP 400) by AccessRuleWriteValidator.ValidateAsync when the IAccessRuleValidator.Validate call on rule.Conditions returns an invalid result. The exception message is dynamic — it is conditions.Error!, so the specific text depends on what condition rule failed validation (e.g., invalid time window, unsupported operator, malformed expression).","triggerScenarios":"Creating or updating a PAM AccessRule where the 'conditions' object fails the conditions validator — e.g., an invalid schedule, an unsupported condition operator, a malformed time range, or a missing required condition field. The exact failure is described in the dynamic error message.","commonSituations":"Conditions JSON has an invalid time-window format. An unsupported or deprecated condition operator is used. A required sub-field of conditions (e.g., IP range, schedule) is missing or malformed. Version mismatch where the client sends a newer condition schema the server rejects.","solutions":["Read the dynamic message in the 400 response — it identifies which condition rule failed.","Validate the conditions payload against the current AccessRule conditions schema before submitting.","Check for deprecated condition operators or fields after a server upgrade.","Simplify conditions to isolate which field triggers the error, then re-add complexity."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { await pamClient.CreateAccessRuleAsync(orgId, rule); }\ncatch (HttpRequestException ex) when (ex.Message.Contains(\"conditions\") || /* 400 on conditions */)\n{ // read ex.Message for the specific condition-validation failure\n  logger.Error(\"Conditions invalid: {Reason}\", ex.Message);\n  // fix the conditions payload per the error text, then retry }","preventionTips":["Always read the dynamic conditions error message — it pinpoints the failing rule.","Validate conditions against the current schema before submitting.","After server upgrades, test existing condition patterns for schema compatibility.","Simplify conditions incrementally to isolate which field is invalid."],"tags":["pam","validation","access-rules","http-400","conditions","dynamic-message"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}