wildcard pattern '/*' is not supported, use mux patterns ins

Error message

wildcard pattern '/*' is not supported, use mux patterns instead

What it means

errWildcardPatternNotSupported is returned by checkWildcardPattern when a route path in the RBAC config contains a trailing '/*' wildcard. GoFr RBAC requires mux-style patterns (e.g. named path variables) instead of wildcard suffixes, so '/*' patterns are rejected during validation to keep matching semantics unambiguous.

Source

Thrown at pkg/gofr/rbac/config.go:28

	"strings"

	"github.com/gorilla/mux"
	"go.opentelemetry.io/otel/trace"
	"gopkg.in/yaml.v3"

	"gofr.dev/pkg/gofr/container"
	"gofr.dev/pkg/gofr/datasource"
)

var (
	// errUnsupportedFormat is returned when the config file format is not supported.
	errUnsupportedFormat = errors.New("unsupported config file format")

	// ErrEndpointMissingPermissions is returned when an endpoint doesn't specify requiredPermissions and is not public.
	ErrEndpointMissingPermissions = errors.New("endpoint must specify requiredPermissions (or be public)")

	// errWildcardPatternNotSupported is returned when a wildcard pattern is used.
	errWildcardPatternNotSupported = errors.New("wildcard pattern '/*' is not supported, use mux patterns instead")

	// errRegexPatternNotSupported is returned when an old regex pattern is used.
	errRegexPatternNotSupported = errors.New("regex pattern '^...$' is not supported, use mux patterns instead")

	// errRegexIndicatorNotSupported is returned when regex indicators are used outside variable constraints.
	errRegexIndicatorNotSupported = errors.New("regex pattern is not supported, use mux patterns instead")
)

// RoleDefinition defines a role with its permissions and inheritance.
// Pure config-based: only role->permission mapping is supported.
type RoleDefinition struct {
	// Name is the role name (required)
	Name string `json:"name" yaml:"name"`

	// Permissions is a list of permissions for this role (format: "resource:action")
	// Example: ["users:read", "users:write"]
	Permissions []string `json:"permissions,omitempty" yaml:"permissions,omitempty"`

View on GitHub (pinned to 187eb24962)

Solutions

Replace the '/*' wildcard with a mux pattern, e.g. '/{path...}' style variable or enumerate concrete paths.
Use mux route variables like '/api/v1/{resource}' instead of '/api/v1/*'.
List explicit child routes in the config if catch-all behavior is not truly needed.
Keep legacy wildcard patterns out of RBAC config; apply them at the router level instead.

Example fix

// before
"/api/v1/*": {"GET": ["user"]}
// after
"/api/v1/{resource}": {"GET": ["user"]}

Defensive patterns

Strategy: validation

Validate before calling

func hasWildcardSuffix(pattern string) bool {
	return strings.HasSuffix(pattern, "/*")
}
// fail before LoadPermissions if any pattern matches

Try / catch

if err := checkWildcardPattern(pattern); err != nil {
	return fmt.Errorf("invalid RBAC pattern %q: %w", pattern, err)
}

Prevention

Use mux variables like {param} instead of trailing wildcards.
Enumerate concrete child routes instead of catch-alls where possible.
Add a pre-commit check scanning RBAC configs for '/*' suffixes.
Keep a migration note when porting configs from wildcard-based routers.

When it happens

Trigger: Declaring an endpoint path in the RBAC permissions config like '/api/v1/*' or '/files/*'; LoadPermissions/validate calls checkWildcardPattern on each pattern and returns this error.

Common situations: Porting an RBAC config from another framework (Express/Chi style wildcards); writing catch-all routes for static assets or versioned APIs; copying legacy gateway route rules.

Related errors

AI-assisted analysis of gofr-dev/gofr@187eb24962 (2026-09-01). Data as JSON: /api/errors/f76f86d6916856db. Report an issue: GitHub.