phalcon/cphalcon · error · Phalcon\Acl\Exceptions\InvalidAccessList

Invalid value for the accessList

Error message

Invalid value for the accessList

What it means

QueryBuilderCursor throws InvalidCursorColumn from the constructor when 'cursorColumn' is present but is not a non-empty string (typeof != 'string' or empty). The column name is embedded directly into the generated WHERE clause ('[' . cursorColumn . '] > :cursor:'), so an integer, array, or '' is unusable.

Source

Thrown at phalcon/Acl/Adapter/Memory.zep:255

            let this->components[componentName]      = componentObject;
            let this->componentsNames[componentName] = true;
        }

        return this->addComponentAccess(componentName, accessList);
    }

    /**
     * Adds access to components
     */
    public function addComponentAccess(string componentName, var accessList) -> bool
    {
        var accessKey, accessName;
        bool exists;

        this->checkExists(this->componentsNames, componentName, "Component");

        if unlikely (typeof accessList !== "array" && typeof accessList !== "string") {
            throw new InvalidAccessList();
        }

        let exists = true;

        if typeof accessList === "array" {
            for accessName in accessList {
                let accessKey = this->buildAccessKey(componentName, accessName);

                if !isset this->accessList[accessKey] {
                    let this->accessList[accessKey] = exists;
                }
            }
        } else {
            let accessKey = this->buildAccessKey(componentName, accessList);

            if !isset this->accessList[accessKey] {
                let this->accessList[accessKey] = exists;
            }

View on GitHub (pinned to b7419de9cd)

Solutions

1. Set 'cursorColumn' to the actual column name string, e.g. 'cursorColumn' => 'id'.
2. Cast/coerce config input before construction: ensure it is a non-empty string (e.g. validate with is_string($col) && $col !== '').
3. Check for accidental truthy-but-wrong values such as integers coming from JSON configs.

Example fix

// before
$paginator = new QueryBuilderCursor(
    [
        'limit'        => 20,
        'builder'      => $builder,
        'cursorColumn' => '', // or 0 from env casting
    ]
); // throws InvalidCursorColumn

// after
$column = (string) ($_ENV['CURSOR_COLUMN'] ?? 'id');
$paginator = new QueryBuilderCursor(
    [
        'limit'        => 20,
        'builder'      => $builder,
        'cursorColumn' => $column !== '' ? $column : 'id',
    ]
);

$column = $config['cursorColumn'] ?? null;
if (!is_string($column) || $column === '') {
    throw new \InvalidArgumentException(
        'cursorColumn must be a non-empty column-name string'
    );
}
$config['cursorColumn'] = $column;

When it happens

Trigger: 'cursorColumn' => 0 (e.g. a falsy default from a config get), 'cursorColumn' => '', or passing a column index instead of a name.

Common situations: Config arrays sourced from env variables or YAML where the value arrives as an integer or null; copy-paste leaving a placeholder empty string; array config run through array_filter that dropped the key's value.

Related errors

• Headers have already been sent; cannot emit the response.
• No route matched the request.
• The request method is not allowed for the matched route.
• No action directory set; call setActionDirectory().
• Role '{roleName}' (to inherit) does not exist in the role li

AI-assisted analysis of phalcon/cphalcon@b7419de9cd (2026-08-21). Data as JSON: /api/errors/1a7217556e4cae16. Report an issue: GitHub.