gofr-dev/gofr · error

query cannot be empty

Error message

query cannot be empty

What it means

After parsing the index, extractArrayClaim looks up the base key (text before '['). If claims[key] is absent it wraps errClaimKeyNotFound with that key. Unlike error 402 (full path not found on simple lookup), this fires specifically for array-notation paths where the array itself is missing from the token.

Source

Thrown at pkg/gofr/datasource/elasticsearch/elasticsearch.go:27

	"strings"
	"time"

	es "github.com/elastic/go-elasticsearch/v8"
	"github.com/elastic/go-elasticsearch/v8/esapi"
	"go.opentelemetry.io/otel/attribute"
	"go.opentelemetry.io/otel/trace"
)

const (
	statusDown     = "DOWN"
	statusUp       = "UP"
	defaultTimeout = 5 * time.Second
)

var (
	errEmptyIndex        = errors.New("index name cannot be empty")
	errEmptyDocumentID   = errors.New("document ID cannot be empty")
	errEmptyQuery        = errors.New("query cannot be empty")
	errEmptyOperations   = errors.New("operations cannot be empty")
	errHealthCheckFailed = errors.New("elasticsearch health check failed")
	errOperation         = errors.New("elasticsearch operation error")
	errMarshaling        = errors.New("error marshaling data")
	errParsingResponse   = errors.New("error parsing response")
	errResponse          = errors.New("invalid elasticsearch response")
	errEncodingOperation = errors.New("error encoding operation")
)

// Config holds the configuration for connecting to Elasticsearch.
type Config struct {
	Addresses []string
	Username  string
	Password  string
}

// Client represents the Elasticsearch client.
type Client struct {

View on GitHub (pinned to 187eb24962)

Solutions

1. Decode a live token (jwt.io or debug logging) and set the base key to the actual array claim name
2. Require the claim in token issuance (scope, audience, protocol mapper) so every access token carries it
3. errors.Is check for errClaimKeyNotFound and return 401 with a log naming the missing array key

Example fix

// before
extractClaimValue(claims, "roles[0]") // token has "groups": [...]
// after
extractClaimValue(claims, "groups[0]")

baseKey := path[:strings.Index(path, "[")]
if _, ok := claims[baseKey]; !ok {
    return fmt.Errorf("token lacks array claim %q", baseKey)
}

func hasArrayClaim(claims jwt.MapClaims, key string) bool {
    _, ok := claims[key].([]any)
    return ok
}

v, err := extractClaimValue(claims, path)
if errors.Is(err, errClaimKeyNotFound) {
    http.Error(w, "missing array claim", http.StatusUnauthorized)
    return
}

When it happens

Trigger: Path "roles[0]" but the JWT has no "roles" key at all; issuer renamed the claim ("groups"/"authorities") while config still says "roles[0]"; token from a flow that strips array claims.

Common situations: IdP mapper changes; multi-tenant issuers with different claim schemas; service-account tokens that omit user role arrays; stale RBAC config after an auth-server migration.

Related errors

• %w: %s
• error marshaling data
• error parsing response
• claim key not found
• claim value is not an array

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/d0faed479b097fad. Report an issue: GitHub.