kopia/kopia · error

error validating ACL

Error message

error validating ACL

What it means

AddACL calls e.Validate() before persisting and wraps any validation failure (unsupported label, invalid label value, missing/invalid access level) with this message. The detailed reason is in the wrapped error; this wrapper only marks the failure point in AddACL.

Solutions

1. Read the wrapped cause for the specific validation failure
2. Set a valid access level (read/write/full/none) on the entry
3. Correct label keys/values to match allowedLabels and validators in internal/acl/acl.go

Example fix

// before
AddACL(ctx, rep, &acl.Entry{User: "joe"}, true) // no Access
// after
AddACL(ctx, rep, &acl.Entry{User: "joe", Access: acl.AccessLevelRead, Target: acl.TargetUserACL{...}}, true)

if err := entry.Validate(); err != nil {
    return fmt.Errorf("invalid ACL entry: %w", err)
}
if entry.Access == 0 {
    return errors.New("access level must be set")
}

When it happens

Trigger: Calling AddACL (or the 'kopia acl add' command) with an Entry that has an unknown label, invalid label value, or an Access field that doesn't map to a known access level.

Common situations: CLI users passing a bad --access value; automation constructing ACL entries programmatically with wrong label keys; forgetting to set Access entirely.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

• invalid label ' = ' for type
• unsupported label ' ' for type ' ', must be one of
• ACL entry for a given user and target already exists
• ACL target must have a
• DownloadBytesPerSecond

AI-assisted analysis of kopia/kopia@82495e54b5 (2026-09-07). Data as JSON: /api/errors/5ad31c64619ff085. Report an issue: GitHub.

Appendix: source

Thrown at internal/acl/acl_manager.go:115

		var p Entry

		_, err := rep.GetManifest(ctx, m.ID, &p)
		if err != nil {
			return nil, errors.Wrapf(err, "error loading ACL manifest %v", m.ID)
		}

		p.ManifestID = m.ID

		result = append(result, &p)
	}

	return result, nil
}

// AddACL validates and adds the specified ACL entry to the repository.
func AddACL(ctx context.Context, w repo.RepositoryWriter, e *Entry, overwrite bool) error {
	if err := e.Validate(); err != nil {
		return errors.Wrap(err, "error validating ACL")
	}

	entries, err := LoadEntries(ctx, w, nil)
	if err != nil {
		return errors.Wrap(err, "unable to load ACL entries")
	}

	for _, oldE := range entries {
		if e.User == oldE.User && maps.Equal(e.Target, oldE.Target) {
			if !overwrite && e.Access < oldE.Access {
				return errors.Errorf("ACL entry for a given user and target already exists %v: %v", oldE.User, oldE.Target)
			}

			if err = w.DeleteManifest(ctx, oldE.ManifestID); err != nil {
				return errors.Wrap(err, "error deleting old")
			}
		}
	}

View on GitHub (pinned to 82495e54b5)