config: %s.users: wildcard user_ids=["*"] appears in multipl

Error message

config: %s.users: wildcard user_ids=["*"] appears in multiple roles

What it means

This error rejects a users config where the wildcard user_id ["*"] is defined under more than one role. The wildcard grants everyone, so defining it in multiple roles is redundant and ambiguous about which role applies; the validator fails fast instead.

Source

Thrown at config/config.go:1188

	seenUserIDs := make(map[string]string) // userID → role name
	for roleName, rc := range u.Roles {
		if len(rc.UserIDs) == 0 {
			return fmt.Errorf("config: %s.users.roles.%s has empty user_ids", prefix, roleName)
		}
		for _, uid := range rc.UserIDs {
			if uid == "*" {
				wildcardCount++
				continue
			}
			lower := strings.ToLower(uid)
			if prev, dup := seenUserIDs[lower]; dup {
				return fmt.Errorf("config: %s.users: user %q appears in both role %q and %q", prefix, uid, prev, roleName)
			}
			seenUserIDs[lower] = roleName
		}
	}
	if wildcardCount > 1 {
		return fmt.Errorf("config: %s.users: wildcard user_ids=[\"*\"] appears in multiple roles", prefix)
	}
	if u.DefaultRole != "" {
		if _, ok := u.Roles[u.DefaultRole]; !ok {
			return fmt.Errorf("config: %s.users.default_role %q does not match any defined role", prefix, u.DefaultRole)
		}
	}
	return nil
}

// SaveActiveProvider persists the active provider name for a project.
// It uses surgical text editing to preserve comments and unknown fields.
func SaveActiveProvider(projectName, providerName string) error {
	configMu.Lock()
	defer configMu.Unlock()
	return patchProjectAgentOption(projectName, "provider", providerName)
}

// SaveProviderModel persists the selected model for a provider in a project.

View on GitHub (pinned to 4000b2338a)

Solutions

Keep the wildcard in exactly one role and delete it from the others
If different classes of users need different roles, list explicit user_ids per role instead of ["*"]
Restart/reload the service to re-validate the corrected config

Example fix

// before
roles.default.user_ids = ["*"]
roles.admin.user_ids = ["*", "alice"]
// after
roles.default.user_ids = ["*"]
roles.admin.user_ids = ["alice"]

Defensive patterns

Strategy: validation

Validate before calling

wildcards := 0
for _, ids := range roles {
	for _, id := range ids {
		if id == "*" { wildcards++ }
	}
}
if wildcards > 1 { return errors.New("wildcard defined in multiple roles") }

Try / catch

if err := loadConfig(path); err != nil {
	if strings.Contains(err.Error(), "wildcard") {
		// de-duplicate ["*"] entries in roles
	}
	return err
}

Prevention

Use ["*"] in at most one role per users block
Copy role blocks carefully; remove the wildcard when cloning
Add a config linter rule rejecting multiple wildcard entries

When it happens

Trigger: Running config validation when two or more roles inside a project's users section each contain the wildcard entry user_ids = ["*"].

Common situations: Setting up 'everyone can chat' defaults and accidentally leaving ["*"] in both a default and a restricted role; scaffolding a second role by copying an existing one that already had ["*"].

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/90bafb9d911bfc3d. Report an issue: GitHub.