Metadata.Authorization.IdentityOrder contains duplicate iden

Error message

Metadata.Authorization.IdentityOrder contains duplicate identity %q

What it means

Compile-time guard in validateCommandMetadata: IdentityOrder lists the same identity more than once; each declared identity must appear exactly once.

Source

Thrown at shortcuts/common/typed_compiler.go:164

			}
			switch conditional.Requirement {
			case typedScopeRequired, typedScopeBestEffort:
			default:
				return fmt.Errorf("%s.Requirement %q is invalid", path, conditional.Requirement)
			}
		}
	}
	if len(metadata.Authorization.IdentityOrder) > 0 {
		if len(metadata.Authorization.IdentityOrder) != len(metadata.Authorization.Identities) {
			return fmt.Errorf("Metadata.Authorization.IdentityOrder must contain each declared identity exactly once")
		}
		seen := make(map[typedIdentity]struct{}, len(metadata.Authorization.IdentityOrder))
		for _, identity := range metadata.Authorization.IdentityOrder {
			if _, ok := metadata.Authorization.Identities[identity]; !ok {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains undeclared identity %q", identity)
			}
			if _, duplicate := seen[identity]; duplicate {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains duplicate identity %q", identity)
			}
			seen[identity] = struct{}{}
		}
	}
	return nil
}

func validateScopeList(scopes []string, path string) error {
	seen := make(map[string]struct{}, len(scopes))
	for i, scope := range scopes {
		if strings.TrimSpace(scope) == "" || scope != strings.TrimSpace(scope) {
			return fmt.Errorf("%s[%d] must be a non-blank trimmed scope", path, i)
		}
		if _, ok := seen[scope]; ok {
			return fmt.Errorf("%s contains duplicate scope %q", path, scope)
		}
		seen[scope] = struct{}{}
	}

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Deduplicate IdentityOrder so each declared identity appears once
If constructing programmatically, build from the Identities map keys and use a set to avoid repeats
Consider deriving the order directly from map keys if ordering does not matter

Example fix

// before
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser, common.TypedIdentityUser, common.TypedIdentityBot},
// after
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser, common.TypedIdentityBot},

Defensive patterns

Strategy: validation

Validate before calling

seen := map[common.TypedIdentity]bool{}
for _, id := range meta.Authorization.IdentityOrder { if seen[id] { return fmt.Errorf("duplicate identity %q", id) }; seen[id] = true }

Prevention

Deduplicate before assignment when building the slice programmatically
Write order literals one entry per identity and review against Identities keys
Prefer generating the order from a single identities slice

When it happens

Trigger: IdentityOrder lists the same identity twice, e.g. {user, user} for a two-identity command, or a duplicate introduced by an append during programmatic construction.

Common situations: Merging two identity-order slices without deduplicating; copy-paste duplication inside a literal; generating the order with code that appends defaults then explicit entries.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/d1827b9c12c00fb4. Report an issue: GitHub.