What causes "unable to delete allowlist: %w" in crowdsecurity/crowdsec?

Read the wrapped DB error for the root cause

unable to delete allowlist: %w

Error message

unable to delete allowlist: %w

What it means

The second step of DeleteAllowList: deleting the allowlist row itself after its items were removed. This error means that AllowList DELETE failed; the items may already be gone while the allowlist remains. The raw DB error is wrapped.

Source

Thrown at pkg/database/allowlists.go:55

	}

	return allowlist, nil
}

func (c *Client) DeleteAllowList(ctx context.Context, name string, fromConsole bool) error {
	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole))).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist items: %w", err)
	}

	c.Log.Debugf("deleted %d items from allowlist %s", nbDeleted, name)

	nbDeleted, err = c.Ent.AllowList.
		Delete().
		Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)).
		Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist: %w", err)
	}

	if nbDeleted == 0 {
		return fmt.Errorf("allowlist %s not found", name)
	}

	return nil
}

func (c *Client) DeleteAllowListByID(ctx context.Context, name string, allowlistID string, fromConsole bool) error {
	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.AllowlistIDEQ(allowlistID), allowlist.FromConsoleEQ(fromConsole))).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to delete allowlist items: %w", err)
	}

	c.Log.Debugf("deleted %d items from allowlist %s", nbDeleted, name)

	nbDeleted, err = c.Ent.AllowList.

View on GitHub (pinned to 909b515798)

Solutions

Read the wrapped DB error for the root cause
Retry DeleteAllowList — already-deleted items make it idempotent
Verify DELETE grants on the allowlists table
Note: if nbDeleted==0 afterwards, the API returns 'allowlist %s not found' — check name/fromConsole match

Example fix

// before
err := client.DeleteAllowList(ctx, name, false)
// after
if err := client.DeleteAllowList(ctx, name, false); err != nil {
    if errors.Is(err, entdb.DeleteFail) {
        log.Errorf("allowlist delete failed, check DB: %v", err)
    }
}

Defensive patterns

Strategy: try-catch

Validate before calling

exists, err := client.Ent.AllowList.Query().Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)).Exist(ctx)
if err != nil || !exists { return nil }

Try / catch

err := client.DeleteAllowList(ctx, name, false)
if err != nil {
    if strings.Contains(err.Error(), "not found") {
        // name/fromConsole mismatch or already deleted
    }
    return err
}

Prevention

Pass the correct fromConsole value — a mismatch silently yields 'not found'
Grant DELETE on allowlists to the DB user
Retry transient failures; the two-stage delete is idempotent
Verify deletion afterwards with a name query rather than assuming success

When it happens

Trigger: c.DeleteAllowList(ctx, name, fromConsole): items deleted successfully, but AllowList.Delete().Where(allowlist.NameEQ(name), allowlist.FromConsoleEQ(fromConsole)) fails — DB error, lock, or cancelled context.

Common situations: Connection drop between the two statements; lock contention on allowlists; DB user missing DELETE on allowlists.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/1e97987c99766f11. Report an issue: GitHub.