crowdsecurity/crowdsec · error

unable to remove values from allowlist: %w

Error message

unable to remove values from allowlist: %w

What it means

RemoveFromAllowlist deletes allowlist_items matching the given allowlist ID and value list in one Exec. If the DELETE fails at the database level it is wrapped as 'unable to remove values from allowlist: %w'. A successful Exec with zero rows removed is NOT an error — removal of nonexistent values is silently a no-op returning 0.

Source

Thrown at pkg/database/allowlists.go:201

	err = txClient.Commit()
	if err != nil {
		return 0, rollbackOnError(txClient, err, "error committing transaction")
	}

	return added, nil
}

func (c *Client) RemoveFromAllowlist(ctx context.Context, list *ent.AllowList, values ...string) (int, error) {
	c.Log.Debugf("removing %d values from allowlist %s", len(values), list.Name)
	c.Log.Tracef("values: %v", values)

	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(
		allowlistitem.HasAllowlistWith(allowlist.IDEQ(list.ID)),
		allowlistitem.ValueIn(values...),
	).Exec(ctx)
	if err != nil {
		return 0, fmt.Errorf("unable to remove values from allowlist: %w", err)
	}

	return nbDeleted, nil
}

func (c *Client) UpdateAllowlistMeta(ctx context.Context, allowlistID string, name string, description string) error {
	c.Log.Debugf("updating allowlist %s meta", name)

	err := c.Ent.AllowList.Update().Where(allowlist.AllowlistIDEQ(allowlistID)).SetName(name).SetDescription(description).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to update allowlist: %w", err)
	}

	return nil
}

func (c *Client) ReplaceAllowlist(ctx context.Context, list *ent.AllowList, items []*models.AllowlistItem, fromConsole bool) (int, error) {
	c.Log.Debugf("replacing values in allowlist %s", list.Name)

View on GitHub (pinned to 909b515798)

Solutions

1. Inspect the wrapped driver error to identify the concrete failure
2. If removing very many values, batch them into chunks below the driver's parameter limit
3. Resolve SQLite lock contention or restore DB connectivity, then retry
4. Remember 0 returned rows is success — only handle the returned error

Example fix

// before
client.RemoveFromAllowlist(ctx, list, thousandsOfValues...)
// after
for chunk := range slices.Chunk(values, 500) {
    if _, err := client.RemoveFromAllowlist(ctx, list, chunk...); err != nil {
        return err
    }
}

if len(values) == 0 { return nil } // nothing to remove; skip the query
const maxParams = 500
if len(values) > maxParams { /* chunk the call */ }

n, err := client.RemoveFromAllowlist(ctx, list, values...)
if err != nil {
    if strings.Contains(err.Error(), "unable to remove values") {
        // check wrapped cause; chunk and retry if parameter-limit related
    }
    return err
}
// n==0 means values were not present — not an error

When it happens

Trigger: Client.RemoveFromAllowlist with a DB connection failure, locked database, oversized value list exceeding driver parameter limits, or cancelled context during execution.

Common situations: Removing many values at once hitting SQLite/MySQL placeholder limits; DB lock contention from concurrent LAPI operations; connection drop mid-delete.

Understand the failure class

Background: Database query failed: Internal Server Error 500s wrapping SQL, Prisma, and connection failures — what to check first — this error's family across 16 libraries.

Related errors

• unable to delete allowlist contents: %w
• unable to delete allowlist items: %w
• unable to delete allowlist: %w
• unable to list allowlists: %w
• error creating transaction: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/9db2436db49b98a0. Report an issue: GitHub.