larksuite/cli · error

invalid identities entry %q: must be 'user' or 'bot'

Error message

invalid identities entry %q: must be 'user' or 'bot'

What it means

ValidateRule in internal/cmdpolicy/validate.go enforces that every entry in Rule.Identities is a recognized platform.Identity. An entry whose IsValid() is false (anything other than 'user' or 'bot') aborts the rule load. This prevents a typo'd identity from silently disabling an identity-scoped restriction, which would fail open.

Source

Thrown at internal/cmdpolicy/validate.go:44

// rather than continue with a degraded rule (hard-constraint #6 / #11
// safety contract).
//
// A nil rule is a no-op (treated as "no restriction" everywhere -- not an
// error).
func ValidateRule(r *platform.Rule) error {
	if r == nil {
		return nil
	}

	if r.MaxRisk != "" {
		if !r.MaxRisk.IsValid() {
			return fmt.Errorf("invalid max_risk %q: must be one of read|write|high-risk-write", r.MaxRisk)
		}
	}

	for _, id := range r.Identities {
		if !id.IsValid() {
			return fmt.Errorf("invalid identities entry %q: must be 'user' or 'bot'", id)
		}
	}

	for _, g := range r.Allow {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid allow glob %q: %w", g, err)
		}
	}
	for _, g := range r.Deny {
		if err := validateGlob(g); err != nil {
			return fmt.Errorf("invalid deny glob %q: %w", g, err)
		}
	}
	return nil
}

// validateGlob rejects malformed doublestar patterns. doublestar.Match
// returns an error for unbalanced brackets / bad escape sequences; that

View on GitHub (pinned to 7fd6ef3c07)

Solutions

1. Replace the offending identities entry with exactly 'user' or 'bot' (lowercase).
2. Remove the identities field entirely if the rule should apply to all identities.
3. Run the policy CLI validate subcommand to confirm all identities pass before loading.
4. Check for case or pluralization typos ('User', 'users') and normalize to the enum values.

Example fix

// before
identities: ["User", "bot"]
// after
identities: ["user", "bot"]

for _, id := range rule.Identities {
	if id != "user" && id != "bot" {
		return fmt.Errorf("identities entry %q must be 'user' or 'bot'", id)
	}
}
if err := cmdpolicy.ValidateRule(rule); err != nil { return err }

func isKnownIdentity(id platform.Identity) bool { return id == "user" || id == "bot" }

When it happens

Trigger: Calling ValidateRule (directly, via Resolve, or the policy validate subcommand) with a Rule whose Identities slice contains a string other than 'user' or 'bot', e.g. "User", "users", "service", or an empty string.

Common situations: Hand-editing a policy YAML and typo-ing an identity value; using uppercase 'User' when comparison is case-sensitive; older configs using a removed identity alias; building platform.Rule with raw string casts instead of the Identity type.

Understand the failure class

Background: Invalid enum value errors: "Unknown type", "Invalid scope", "must be one of" — when a string is not on the library's allowed list — this error's family across 23 libraries.

Related errors

• invalid allow glob %q: %w
• invalid deny glob %q: %w
• L3: _meta.access_tokens must not be empty
• empty pattern
• Invalid column: {column!r}

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/1563b588fa873f3f. Report an issue: GitHub.