bytebase/bytebase · error

failed to activate access grant %v

Error message

failed to activate access grant %v

What it means

For an ACCESS_GRANT issue, completeAccessRequestIssue calls activateAccessGrant to mark the grant ACTIVE (refreshing its expire time). If activation fails, this error wraps the underlying cause with the grant resource name. The grant itself could not be activated despite the issue being approved.

Source

Thrown at backend/api/v1/issue_hook.go:121

				Email: creatorEmail,
			},
			Issue: webhook.NewIssue(issue),
		},
	})
}

// completeAccessRequestIssue completes the ACCESS_GRANT/ROLE_GRANT issue.
// For ROLE_GRANT issue: grant the privilege and update the status.
// For ACCESS_GRANT issue: mark the status as ACTIVE.
func completeAccessRequestIssue(ctx context.Context, stores *store.Store, userEmail string, issue *store.IssueMessage) (*store.IssueMessage, error) {
	switch issue.Type {
	case storepb.Issue_ACCESS_GRANT:
		if issue.Payload.AccessGrantId == "" {
			return nil, errors.Errorf("invalid access grant id for issue %d", issue.UID)
		}
		accessGrantName := common.FormatAccessGrant(issue.ProjectID, issue.Payload.AccessGrantId)
		if _, err := activateAccessGrant(ctx, stores, accessGrantName, true /* refresh expire time */); err != nil {
			return nil, errors.Wrapf(err, "failed to activate access grant %v", accessGrantName)
		}
	case storepb.Issue_ROLE_GRANT:
		if err := utils.UpdateProjectPolicyFromRoleGrantIssue(ctx, stores, common.GetWorkspaceIDFromContext(ctx), issue, issue.Payload.RoleGrant); err != nil {
			return nil, err
		}
	default:
		return issue, nil
	}

	updatedIssue, err := stores.UpdateIssue(ctx, issue.ProjectID, issue.UID, &store.UpdateIssueMessage{Status: new(storepb.Issue_DONE)})
	if err != nil {
		return nil, errors.Wrapf(err, "failed to update issue %q's status", issue.Title)
	}

	if _, err := stores.CreateIssueComments(ctx, userEmail, &store.IssueCommentMessage{
		ProjectID: issue.ProjectID,
		IssueUID:  issue.UID,
		Payload: &storepb.IssueCommentPayload{

View on GitHub (pinned to 1870550677)

Solutions

1. Check the wrapped error: if the grant is not found, re-create the access grant and a new issue
2. Retry via RetryIssueApproval if the failure was transient (DB timeout)
3. Verify the access grant's current state in the store before re-approving
4. Check for background jobs (expiry/revocation) racing with the approval

grant, err := store.GetAccessGrant(ctx, grantName)
if err != nil {
    return fmt.Errorf("access grant %s not activatable: %w", grantName, err)
}
if grant.State != storepb.AccessGrant_PENDING {
    return fmt.Errorf("access grant %s is not pending", grantName)
}

_, err := client.ApproveIssue(ctx, req)
if err != nil && strings.Contains(err.Error(), "failed to activate access grant") {
    // check whether the grant still exists / is pending, then re-create or retry
}

When it happens

Trigger: Approving an ACCESS_GRANT issue when the referenced access grant no longer exists (deleted before approval), the store update fails, or the grant is in a state that cannot be activated (e.g. already expired or revoked).

Common situations: Access grants cleaned up by an expiry job while the approval was pending; concurrent revocation of the grant; metadata DB write failure during activation.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

Related errors

• invalid access grant id for issue %d
• plan has rollout
• failed to refresh issue
• failed to check if approval is approved
• failed to complete role grant

AI-assisted analysis of bytebase/bytebase@1870550677 (2026-09-06). Data as JSON: /api/errors/348b23421f06c02d. Report an issue: GitHub.