endpoint[%d]: %w: %s. Example: /api/users/{id:[0-9]+} instea

Error message

endpoint[%d]: %w: %s. Example: /api/users/{id:[0-9]+} instead of ^/api/users/\d+$

What it means

checkRegexPattern rejected a path that looks like an anchored regular expression (starts with ^ or ends with $). RBAC paths must use mux variable syntax, not raw regex, so permission matching stays consistent with routing.

Source

Thrown at pkg/gofr/rbac/config.go:242

	}

	return nil
}

// checkWildcardPattern checks if path contains wildcard pattern.
func (*Config) checkWildcardPattern(path string, index int) error {
	if strings.Contains(path, "/*") {
		return fmt.Errorf("endpoint[%d]: %w: %s. Examples: /api/{resource} for single-level or /api/{path:.*} for multi-level",
			index, errWildcardPatternNotSupported, path)
	}

	return nil
}

// checkRegexPattern checks if path contains old regex pattern.
func (*Config) checkRegexPattern(path string, index int) error {
	if strings.HasPrefix(path, "^") || strings.HasSuffix(path, "$") {
		return fmt.Errorf("endpoint[%d]: %w: %s. Example: /api/users/{id:[0-9]+} instead of ^/api/users/\\d+$",
			index, errRegexPatternNotSupported, path)
	}

	return nil
}

// checkRegexIndicators checks if path contains regex indicators outside variable constraints.
func (*Config) checkRegexIndicators(path string, index int) error {
	if strings.Contains(path, "\\d") || strings.Contains(path, "\\w") || strings.Contains(path, "\\s") {
		// Only allow if it's inside a variable constraint like {id:[0-9]+}
		if !strings.Contains(path, "{") || !strings.Contains(path, ":") {
			return fmt.Errorf("endpoint[%d]: %w: %s. Example: /api/users/{id:[0-9]+}",
				index, errRegexIndicatorNotSupported, path)
		}
	}

	return nil
}

View on GitHub (pinned to 187eb24962)

Solutions

Strip ^ and $ anchors and rewrite the regex as mux variables.
Convert character-class segments: \\d+ becomes {id:[0-9]+} inside braces.
Use {path:.*} for catch-all tails.
Confirm each rewritten path matches the same URLs your regex covered.

Example fix

// before
path: "^/api/users/\\d+$"
// after
path: "/api/users/{id:[0-9]+}"

Defensive patterns

Strategy: validation

Validate before calling

for i, ep := range endpoints {
    if strings.HasPrefix(ep.Path, "^") || strings.HasSuffix(ep.Path, "$") {
        return fmt.Errorf("endpoint[%d] %s: anchored regex not supported; use mux variables like {id:[0-9]+}", i, ep.Path)
    }
}

Try / catch

if err := prevalidateRegexPaths(endpoints); err != nil { return err }
if _, err := rbac.LoadPermissions(path, logger, metrics, tracer); err != nil {
    if strings.Contains(err.Error(), "instead of ^/api") {
        return fmt.Errorf("rewrite regex paths to mux syntax: %w", err)
    }
    return err
}

Prevention

Ban ^ and $ characters in RBAC paths via a lint rule.
Convert legacy regex routes once, centrally, with a mapping table.
Verify rewritten mux patterns match the same URL set as the old regex (unit tests).

When it happens

Trigger: An endpoint path such as ^/api/users/\d+$ passed to EnableRBAC/LoadPermissions and caught by validate -> validateEndpointPath -> checkRegexPattern.

Common situations: Carrying over regex routes from an older config format or another router; converting a regexp-based auth table to this RBAC config verbatim.

Related errors

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/e80e940ab44f3d7e. Report an issue: GitHub.