chenhg5/cc-connect · error

default_role %q does not match any defined role

Error message

default_role %q does not match any defined role

What it means

When default_role is non-empty, ValidateRoleInputs verifies it matches one of the role names defined in the same payload. This ensures every user (including unmatched ones via wildcard or fallback) can be mapped to an existing role. A typo or stale name makes the default unresolvable, so it fails validation.

Source

Thrown at core/user_roles.go:233

		}
		for _, uid := range ri.UserIDs {
			if uid == "*" {
				wildcardCount++
				continue
			}
			lower := strings.ToLower(uid)
			if prev, dup := seenUserIDs[lower]; dup {
				return fmt.Errorf("user %q appears in both role %q and %q", uid, prev, ri.Name)
			}
			seenUserIDs[lower] = ri.Name
		}
	}
	if wildcardCount > 1 {
		return fmt.Errorf("wildcard user_ids=[\"*\"] appears in multiple roles")
	}
	if defaultRole != "" {
		if !roleNames[defaultRole] {
			return fmt.Errorf("default_role %q does not match any defined role", defaultRole)
		}
	}
	return nil
}

// Stop terminates all per-role rate limiter goroutines. Nil-receiver safe.
func (m *UserRoleManager) Stop() {
	if m == nil {
		return
	}
	m.mu.Lock()
	defer m.mu.Unlock()
	for _, rl := range m.limiters {
		rl.Stop()
	}
}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Fix default_role to exactly match one of the defined role names (matching is exact here, not case-folded)
2. Remove default_role (leave empty) if no default is desired
3. Derive default_role programmatically from roles[0].Name or a constant to avoid drift

Example fix

// before
ValidateRoleInputs("admins", roles) // roles only define "admin"
// after
ValidateRoleInputs("admin", roles)

names := map[string]bool{}
for _, r := range roles { names[r.Name] = true }
if defaultRole != "" && !names[defaultRole] {
    return fmt.Errorf("default_role %q not defined", defaultRole)
}
core.ValidateRoleInputs(defaultRole, roles)

When it happens

Trigger: Calling ValidateRoleInputs with defaultRole set to a name that is not among the RoleInput.Name values, e.g. handleProjectUsers receiving {"default_role": "admins"} while only a role named "admin" is defined.

Common situations: Renaming a role in the config but not the default_role field; case/typo mismatches; configs copied between projects where role names differ.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• config: %s.users has no roles defined
• config: %s.users.roles.%s has empty user_ids
• no roles defined
• tmux: 'session' option is required (name of the tmux session
• config: relay.visibility must be "full", "summary", or "none

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/a1d4e0ea50648a64. Report an issue: GitHub.