What causes "privileges are not set" in vxcontrol/pentagi?

Register the authentication middleware before PrivilegesRequired on the route group so "prm" is populated

vxcontrol/pentagi · error · HttpError

PrivilegesRequired

PrivilegesRequired

Error message

privileges are not set

What it means

getPrms reads the "prm" string-slice (privileges) that authentication middleware must set in the Gin context. If it is empty/absent, it returns "privileges are not set" with code PrivilegesRequired; PrivilegesRequired then aborts the request. It means the request reached an authorization guard without a preceding authentication step populating privileges.

Source

Thrown at backend/pkg/server/auth/permissions.go:15

package auth

import (
	"fmt"
	"slices"

	"pentagi/pkg/server/response"

	"github.com/gin-gonic/gin"
)

func getPrms(c *gin.Context) ([]string, error) {
	prms := c.GetStringSlice("prm")
	if len(prms) == 0 {
		return nil, fmt.Errorf("privileges are not set")
	}
	return prms, nil
}

func PrivilegesRequired(privs ...string) gin.HandlerFunc {
	return func(c *gin.Context) {
		if c.IsAborted() {
			return
		}

		prms, err := getPrms(c)
		if err != nil {
			response.Error(c, response.ErrPrivilegesRequired, err)
			c.Abort()
			return
		}

		for _, priv := range privs {

View on GitHub (pinned to ea665308ba)

Solutions

Register the authentication middleware before PrivilegesRequired on the route group so "prm" is populated
Ensure the client sends valid credentials (session cookie or Bearer API token) with the request
Fix auth-middleware failures (see wrapped auth errors) that leave "prm" unset instead of aborting
In tests, run the auth middleware or set c.Set("prm", ...) before exercising guarded handlers

Example fix

// before
api.POST("/flows", PrivilegesRequired("flows_create"), createFlow)
// after
api.POST("/flows", authMiddleware(), PrivilegesRequired("flows_create"), createFlow)

Defensive patterns

Strategy: validation

Type guard

func hasPrivileges(c *gin.Context) bool {
    return len(c.GetStringSlice("prm")) > 0
}

Prevention

Always register authentication middleware before PrivilegesRequired in route groups
Ensure clients always send credentials (cookie or Bearer token) with guarded requests
In tests, seed the context (c.Set("prm", ...)) or run the auth middleware before guards
Verify reverse proxies do not strip Authorization headers/Cookies en route to the API

When it happens

Trigger: A route uses PrivilegesRequired(...) middleware but the auth middleware that calls c.Set("prm", prms) (tryUserCookieAuthentication/tryProtoTokenAuthentication) did not run, failed silently, or the request bypassed it; calling an API without any credentials so no middleware set "prm".

Common situations: Route registered without the auth middleware before PrivilegesRequired; misconfigured reverse proxy stripping cookies/Authorization headers so auth fails but a later middleware chain still reaches the guard; tests invoking handlers without running auth middleware.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/192d4e307af36417. Report an issue: GitHub.