gofr-dev/gofr · error

%w: %s

Error message

%w: %s

What it means

For a simple (non-array, non-dotted) path, extractClaimValue does a direct map lookup claims[path]. If the key is absent it wraps errClaimPathNotFound with the requested path. This means the token parsed fine, but the claim key configured for role extraction does not exist in the token.

Source

Thrown at pkg/gofr/datasource/elasticsearch/documents.go:170

	start := time.Now()

	tracedCtx, span := c.addTrace(ctx, "delete-document", []string{index}, id)

	req := esapi.DeleteRequest{
		Index:      index,
		DocumentID: id,
	}

	res, err := req.Do(tracedCtx, c.client)
	if err != nil {
		return fmt.Errorf("%w: deleting document: %w", errOperation, err)
	}

	defer res.Body.Close()

	if res.IsError() {
		return fmt.Errorf("%w: %s", errResponse, res.String())
	}

	c.sendOperationStats(start, fmt.Sprintf("DELETE DOCUMENT %s/%s", index, id),
		[]string{index}, id, nil, span)

	return nil
}

View on GitHub (pinned to 187eb24962)

Solutions

1. Print/decode the actual JWT payload and align the configured claim path with the real key name
2. Ensure the auth server always includes the role claim in access tokens (audience/mapper/protocol-mapper config)
3. Handle the wrapped error with errors.Is(err, errClaimPathNotFound) and treat as 401/403 with a clear log of the missing path

Example fix

// before
v, err := extractClaimValue(claims, "role")
// after
v, err := extractClaimValue(claims, "https://myapp.example.com/roles") // matches actual issuer claim key

// decode token payload first and confirm the key exists
claims := jwt.MapClaims{}
jwt.ParseWithClaims(token, &claims, keyfunc)
if _, ok := claims["role"]; !ok {
    // reject or choose correct claim name before calling middleware
}

func hasClaim(claims jwt.MapClaims, key string) bool {
    _, ok := claims[key]
    return ok
}

v, err := extractClaimValue(claims, path)
if errors.Is(err, errClaimPathNotFound) {
    http.Error(w, "missing role claim: "+path, http.StatusUnauthorized)
    return
}

When it happens

Trigger: Configured claim path (e.g. "role") not present in the incoming JWT's payload — issuer puts the role under a different key ("roles", "https://myapp.com/roles", "authorities") or omits it entirely for tokens issued by a different flow (password reset, service accounts).

Common situations: Migrating identity providers (Auth0 namespaced claims vs custom server claims); tokens minted by a test fixture without a role claim; keycloak realm vs client roles mapping; typo in the configured claim name.

Related errors

• query cannot be empty
• error marshaling data
• error parsing response
• claim key not found
• claim value is not an array

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/641ce1293415d8c6. Report an issue: GitHub.