chenhg5/cc-connect · error

role %q has empty user_ids

Error message

role %q has empty user_ids

What it means

ValidateRoleInputs rejects a role entry whose UserIDs list is empty. Every defined role must name at least one user (or the "*" wildcard) to be meaningful for authorization. The error names the offending role so the misconfiguration is easy to locate.

Source

Thrown at core/user_roles.go:214

		"configured":   true,
		"default_role": m.defaultRole,
		"roles":        roles,
	}
}

// ValidateRoleInputs checks role inputs for consistency: duplicate user IDs,
// multiple wildcards, empty user_ids, and default_role existence.
func ValidateRoleInputs(defaultRole string, roles []RoleInput) error {
	if len(roles) == 0 {
		return fmt.Errorf("no roles defined")
	}
	wildcardCount := 0
	seenUserIDs := make(map[string]string) // userID → role name
	roleNames := make(map[string]bool, len(roles))
	for _, ri := range roles {
		roleNames[ri.Name] = true
		if len(ri.UserIDs) == 0 {
			return fmt.Errorf("role %q has empty user_ids", ri.Name)
		}
		for _, uid := range ri.UserIDs {
			if uid == "*" {
				wildcardCount++
				continue
			}
			lower := strings.ToLower(uid)
			if prev, dup := seenUserIDs[lower]; dup {
				return fmt.Errorf("user %q appears in both role %q and %q", uid, prev, ri.Name)
			}
			seenUserIDs[lower] = ri.Name
		}
	}
	if wildcardCount > 1 {
		return fmt.Errorf("wildcard user_ids=[\"*\"] appears in multiple roles")
	}
	if defaultRole != "" {
		if !roleNames[defaultRole] {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Populate UserIDs for the named role before validation
2. Delete the empty role entry entirely if it is not needed
3. Add client-side/server-side validation to reject role rows with no users before calling ValidateRoleInputs

Example fix

// before
roles := []core.RoleInput{{Name: "admin"}}
// after
roles := []core.RoleInput{{Name: "admin", UserIDs: []string{"alice"}}}

for _, r := range roles {
    if len(r.UserIDs) == 0 {
        return fmt.Errorf("role %q needs at least one user", r.Name)
    }
}
core.ValidateRoleInputs(defaultRole, roles)

When it happens

Trigger: Passing a RoleInput with Name set (e.g. "admin") but UserIDs nil or len 0 to ValidateRoleInputs, typically via the handleProjectUsers handler when a role block in the request JSON has an empty user_ids array.

Common situations: A hand-edited TOML/JSON project config where a role was created but users were never filled in; a UI that allows saving a role with no members; a template with a placeholder role left unfilled.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• config: %s.users has no roles defined
• config: %s.users.roles.%s has empty user_ids
• no roles defined
• user %q appears in both role %q and %q
• wildcard user_ids=["*"] appears in multiple roles

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/f88d4c026a6c83c0. Report an issue: GitHub.