weaviate/weaviate · warning

no roles to revoke: %w

Error message

no roles to revoke: %w

What it means

RevokeRolesForUser removes roles from a user via RAFT. It refuses an empty roles variadic list, wrapping schema.ErrBadRequest, since revoking nothing is a no-op and would waste a consensus round. Validation happens before marshaling and cluster execution.

Source

Thrown at cluster/raft_rbac_apply_endpoints.go:111

	}
	req := cmd.AddRolesForUsersRequest{User: user, Roles: roles, Version: cmd.RBACAssignRevokeLatestCommandPolicyVersion}
	subCommand, err := json.Marshal(&req)
	if err != nil {
		return fmt.Errorf("marshal request: %w", err)
	}
	command := &cmd.ApplyRequest{
		Type:       cmd.ApplyRequest_TYPE_ADD_ROLES_FOR_USER,
		SubCommand: subCommand,
	}
	if _, err := s.Execute(context.Background(), command); err != nil {
		return err
	}
	return nil
}

func (s *Raft) RevokeRolesForUser(user string, roles ...string) error {
	if len(roles) == 0 {
		return fmt.Errorf("no roles to revoke: %w", schema.ErrBadRequest)
	}
	req := cmd.RevokeRolesForUserRequest{User: user, Roles: roles, Version: cmd.RBACAssignRevokeLatestCommandPolicyVersion}
	subCommand, err := json.Marshal(&req)
	if err != nil {
		return fmt.Errorf("marshal request: %w", err)
	}
	command := &cmd.ApplyRequest{
		Type:       cmd.ApplyRequest_TYPE_REVOKE_ROLES_FOR_USER,
		SubCommand: subCommand,
	}
	if _, err := s.Execute(context.Background(), command); err != nil {
		return err
	}
	return nil
}

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Pass at least one role to revoke
2. Validate the list before calling and short-circuit with a clear message when empty
3. Check upstream filtering logic isn't stripping all roles

Example fix

// before
raft.RevokeRolesForUser(user, toRevoke...)
// after
if len(toRevoke) == 0 {
    return errors.New("no roles to revoke: pass at least one role")
}
raft.RevokeRolesForUser(user, toRevoke...)

if len(roles) == 0 {
    return fmt.Errorf("at least one role is required to revoke from user %q", user)
}
_ = raft.RevokeRolesForUser(user, roles...)

if err := raft.RevokeRolesForUser(user, roles...); err != nil {
    if errors.Is(err, schema.ErrBadRequest) {
        return http.StatusBadRequest, "roles array must contain at least one role"
    }
    return err
}

When it happens

Trigger: Calling Raft.RevokeRolesForUser(user) with zero variadic role arguments — e.g. a REST handler received an empty or missing "roles" array.

Common situations: A client sends {"user":"alice","roles":[]}; a script builds the role list by filtering and ends up with nothing; the CLI is invoked without role arguments.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• ErrBadRequest
• no roles or users to restore: %w
• no roles to remove permissions from: %w
• no roles to assign: %w
• role name is required

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/dabd165e184b542a. Report an issue: GitHub.