chenhg5/cc-connect · error

no roles defined

Error message

no roles defined

What it means

ValidateRoleInputs in core/user_roles.go rejects an empty roles list. The library requires at least one role definition when configuring project users, otherwise no role resolution could ever succeed (including the default role). It throws this before any per-role validation to fail fast.

Source

Thrown at core/user_roles.go:206

				"max_messages": role.RateLimitCfg.MaxMessages,
				"window_secs":  int(role.RateLimitCfg.Window / time.Second),
			}
		}
		roles[entry.roleName] = roleData
	}

	return map[string]any{
		"configured":   true,
		"default_role": m.defaultRole,
		"roles":        roles,
	}
}

// ValidateRoleInputs checks role inputs for consistency: duplicate user IDs,
// multiple wildcards, empty user_ids, and default_role existence.
func ValidateRoleInputs(defaultRole string, roles []RoleInput) error {
	if len(roles) == 0 {
		return fmt.Errorf("no roles defined")
	}
	wildcardCount := 0
	seenUserIDs := make(map[string]string) // userID → role name
	roleNames := make(map[string]bool, len(roles))
	for _, ri := range roles {
		roleNames[ri.Name] = true
		if len(ri.UserIDs) == 0 {
			return fmt.Errorf("role %q has empty user_ids", ri.Name)
		}
		for _, uid := range ri.UserIDs {
			if uid == "*" {
				wildcardCount++
				continue
			}
			lower := strings.ToLower(uid)
			if prev, dup := seenUserIDs[lower]; dup {
				return fmt.Errorf("user %q appears in both role %q and %q", uid, prev, ri.Name)
			}

View on GitHub (pinned to 4000b2338a)

Solutions

1. Add at least one RoleInput to the roles slice before calling ValidateRoleInputs
2. In handleProjectUsers, decode the request into RoleInput slice and reject empty payloads earlier with a clearer 400 message
3. If clearing all roles is intended, use a dedicated delete/clear API path instead of calling validation with an empty list

Example fix

// before
err := core.ValidateRoleInputs(cfg.DefaultRole, nil)
// after
if len(cfg.Roles) == 0 {
    return errors.New("at least one role must be defined")
}
err := core.ValidateRoleInputs(cfg.DefaultRole, cfg.Roles)

if len(roles) == 0 {
    return errors.New("roles must contain at least one entry")
}
err := core.ValidateRoleInputs(defaultRole, roles)

When it happens

Trigger: Calling ValidateRoleInputs with an empty (or nil) []RoleInput slice, e.g. from the handleProjectUsers HTTP handler when the client submitted a project-users payload with no roles array or an empty one.

Common situations: A client posts a users-config JSON with "roles": [] or omits the roles field entirely; a UI form was submitted without adding any role rows; a config migration dropped all roles.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• config: %s.users has no roles defined
• config: %s.users.roles.%s has empty user_ids
• default_role %q does not match any defined role
• tmux: 'session' option is required (name of the tmux session
• config: relay.visibility must be "full", "summary", or "none

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/0cfe92ac059c5b03. Report an issue: GitHub.