What causes "unable to update allowlist: %w" in crowdsecurity/crowdsec?

Check the wrapped error for a unique-constraint message; pick a different name if so

unable to update allowlist: %w

Error message

unable to update allowlist: %w

What it means

UpdateAllowlistMeta issues an ent Update setting name and description on the allowlist matched by allowlist_id. Any Exec failure — driver error, unique constraint on the new name colliding with another allowlist, cancelled context — is wrapped as 'unable to update allowlist: %w'.

Source

Thrown at pkg/database/allowlists.go:212

	c.Log.Tracef("values: %v", values)

	nbDeleted, err := c.Ent.AllowListItem.Delete().Where(
		allowlistitem.HasAllowlistWith(allowlist.IDEQ(list.ID)),
		allowlistitem.ValueIn(values...),
	).Exec(ctx)
	if err != nil {
		return 0, fmt.Errorf("unable to remove values from allowlist: %w", err)
	}

	return nbDeleted, nil
}

func (c *Client) UpdateAllowlistMeta(ctx context.Context, allowlistID string, name string, description string) error {
	c.Log.Debugf("updating allowlist %s meta", name)

	err := c.Ent.AllowList.Update().Where(allowlist.AllowlistIDEQ(allowlistID)).SetName(name).SetDescription(description).Exec(ctx)
	if err != nil {
		return fmt.Errorf("unable to update allowlist: %w", err)
	}

	return nil
}

func (c *Client) ReplaceAllowlist(ctx context.Context, list *ent.AllowList, items []*models.AllowlistItem, fromConsole bool) (int, error) {
	c.Log.Debugf("replacing values in allowlist %s", list.Name)
	c.Log.Tracef("items: %+v", items)

	_, err := c.Ent.AllowListItem.Delete().Where(allowlistitem.HasAllowlistWith(allowlist.IDEQ(list.ID))).Exec(ctx)
	if err != nil {
		return 0, fmt.Errorf("unable to delete allowlist contents: %w", err)
	}

	added, err := c.AddToAllowlist(ctx, list, items)
	if err != nil {
		return 0, fmt.Errorf("unable to add values to allowlist: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

Check the wrapped error for a unique-constraint message; pick a different name if so
Verify DB connectivity and that the allowlists table schema is current
Resolve lock contention or retry after transient DB issues
Ensure the allowlistID passed actually exists (update of a missing ID silently affects 0 rows rather than erroring here)

Defensive patterns

Strategy: validation

Validate before calling

lists, err := client.ListAllowLists(ctx, false)
if err != nil { return err }
for _, l := range lists {
    if l.Name == newName && l.AllowlistID != allowlistID {
        return fmt.Errorf("name %q already used by allowlist %s", newName, l.AllowlistID)
    }
}

Try / catch

if err := client.UpdateAllowlistMeta(ctx, id, name, desc); err != nil {
    if strings.Contains(err.Error(), "UNIQUE") || strings.Contains(err.Error(), "duplicate") {
        return fmt.Errorf("name %q already taken", name)
    }
    return err
}

Prevention

Uniqueness-check the new name before renaming
Confirm the allowlistID exists (0-row updates do not error here)
Keep DB connectivity healthy during console sync operations

When it happens

Trigger: updateOneAllowlist calling Client.UpdateAllowlistMeta when the DB write fails; notably a unique-name constraint violation if the new name already exists on another allowlist row.

Common situations: Renaming an allowlist to a name already taken (name is unique); DB unreachable during a console sync; SQLite lock contention during concurrent LAPI requests.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6b327305033dc905. Report an issue: GitHub.