gofr-dev/gofr · error

%w: deleting document: %w

Error message

%w: deleting document: %w

What it means

extractClaimValue resolves a dotted/indexed path (e.g. "role", "roles[0]", "permissions.role") inside the JWT MapClaims to fetch the role. The library throws errEmptyClaimPath when the configured claim path string is empty, because there is no way to look up a claim without a key. It is a configuration/programming error, not a token problem.

Source

Thrown at pkg/gofr/datasource/elasticsearch/documents.go:164

		return errEmptyIndex
	}

	if strings.TrimSpace(id) == "" {
		return errEmptyDocumentID
	}

	start := time.Now()

	tracedCtx, span := c.addTrace(ctx, "delete-document", []string{index}, id)

	req := esapi.DeleteRequest{
		Index:      index,
		DocumentID: id,
	}

	res, err := req.Do(tracedCtx, c.client)
	if err != nil {
		return fmt.Errorf("%w: deleting document: %w", errOperation, err)
	}

	defer res.Body.Close()

	if res.IsError() {
		return fmt.Errorf("%w: %s", errResponse, res.String())
	}

	c.sendOperationStats(start, fmt.Sprintf("DELETE DOCUMENT %s/%s", index, id),
		[]string{index}, id, nil, span)

	return nil
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Set the role claim path explicitly in the RBAC middleware options (e.g. Options/WithRoleClaim("role")) so it is never empty
2. If the path comes from config/env, fail fast at startup: validate it is non-empty before wiring the middleware
3. Guard the call site: skip/short-circuit extraction when the configured path is "" and return a clear configuration error

Example fix

// before
mw := rbac.New(h, roles) // roleClaimPath left empty
// after
mw := rbac.New(h, roles, rbac.WithRoleClaimPath("role"))

if claimPath == "" {
    return nil, fmt.Errorf("rbac: role claim path must be configured")
}
// wire middleware only after this check passes

v, err := extractClaimValue(claims, path)
if errors.Is(err, errEmptyClaimPath) {
    // programmer/config error: fail startup or request with 500
}

When it happens

Trigger: Calling extractClaimValue (directly or via extractRoleFromJWT) with path == "" — typically because the RBAC middleware option that sets the role claim path was never set or was set to an empty string.

Common situations: Constructing rbac middleware options with a zero-valued struct field; reading the claim-path from an env var or config file that is missing/empty; forgetting to call the option that configures the role claim name after a library version upgrade renamed the option.

Related errors

• invalid array index
• %w: %s
• index name cannot be empty
• document ID cannot be empty
• query cannot be empty

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/1ce87b625a352b25. Report an issue: GitHub.