Metadata.Authorization.IdentityOrder must contain each decla

Error message

Metadata.Authorization.IdentityOrder must contain each declared identity exactly once

What it means

When IdentityOrder is declared, it must list every declared identity exactly once — its length must equal len(Identities). A length mismatch means some identity is missing from the order (or an extra entry inflates the count).

Source

Thrown at shortcuts/common/typed_compiler.go:156

			}
			for _, scope := range conditional.Scopes {
				if _, alwaysRequired := requiredScopes[scope]; alwaysRequired {
					return fmt.Errorf("%s scope %q is already always required for identity %q", path, scope, identity)
				}
			}
			if conditional.When != strings.TrimSpace(conditional.When) {
				return fmt.Errorf("%s.When must be trimmed", path)
			}
			switch conditional.Requirement {
			case typedScopeRequired, typedScopeBestEffort:
			default:
				return fmt.Errorf("%s.Requirement %q is invalid", path, conditional.Requirement)
			}
		}
	}
	if len(metadata.Authorization.IdentityOrder) > 0 {
		if len(metadata.Authorization.IdentityOrder) != len(metadata.Authorization.Identities) {
			return fmt.Errorf("Metadata.Authorization.IdentityOrder must contain each declared identity exactly once")
		}
		seen := make(map[typedIdentity]struct{}, len(metadata.Authorization.IdentityOrder))
		for _, identity := range metadata.Authorization.IdentityOrder {
			if _, ok := metadata.Authorization.Identities[identity]; !ok {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains undeclared identity %q", identity)
			}
			if _, duplicate := seen[identity]; duplicate {
				return fmt.Errorf("Metadata.Authorization.IdentityOrder contains duplicate identity %q", identity)
			}
			seen[identity] = struct{}{}
		}
	}
	return nil
}

func validateScopeList(scopes []string, path string) error {
	seen := make(map[string]struct{}, len(scopes))
	for i, scope := range scopes {

View on GitHub (pinned to 7fd6ef3c07)

Solutions

Make IdentityOrder contain exactly one entry per key in Identities, in the desired order
Remove IdentityOrder entirely if declaration order does not matter (the field is optional; empty means no explicit ordering)
Update IdentityOrder whenever Identities gains or loses an identity

Example fix

// before
Identities: map[...]{User: {...}, Bot: {...}},
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser},
// after
Identities: map[...]{User: {...}, Bot: {...}},
IdentityOrder: []common.TypedIdentity{common.TypedIdentityUser, common.TypedIdentityBot},

Defensive patterns

Strategy: validation

Validate before calling

if len(meta.Authorization.IdentityOrder) > 0 && len(meta.Authorization.IdentityOrder) != len(meta.Authorization.Identities) { return errors.New("IdentityOrder/Identities length mismatch") }

Prevention

Update IdentityOrder whenever Identities changes
Derive order from a single source of truth listing identities once
Omit IdentityOrder when explicit ordering is not needed

When it happens

Trigger: Metadata.Authorization.Identities declares two identities (user, bot) but IdentityOrder has one or three entries; or IdentityOrder was populated but a new identity was later added to Identities without updating the order.

Common situations: Adding bot identity to a command that previously only declared user and forgetting to extend IdentityOrder; hand-writing the slice with a duplicated/extra placeholder entry; copy-paste between commands with different identity sets.

Understand the failure class

Background: Schema validation failed / invalid input schema: payload rejected because its shape doesn't match the expected schema — this error's family across 28 libraries.

Related errors

AI-assisted analysis of larksuite/cli@7fd6ef3c07 (2026-09-04). Data as JSON: /api/errors/0444c9ba82dc38d9. Report an issue: GitHub.