weaviate/weaviate · error

PoliciesToPermission: %w

Error message

PoliciesToPermission: %w

What it means

Wraps conv.PoliciesToPermission failure while listing roles in getRoles: after visibility filtering and namespace-prefix stripping, a visible role's permission set could not be converted to the API response form — typically a malformed stored permission. The whole role-list request fails with a 500 rather than returning a partial list.

Source

Thrown at adapters/handlers/rest/authz/handlers_authz.go:648

	for roleName, policies := range roles {
		if roleName == authorization.Root && !slices.Contains(h.rbacconfig.RootUsers, principal.Username) {
			continue
		}

		name := roleName
		if h.namespacesEnabled {
			// Hide other namespaces' roles, reserved global roles, and any whose
			// permissions the caller does not already hold; strip the caller's own
			// namespace prefix.
			if !rolevisibility.RoleVisibleToCaller(ctx, h.authorizer, h.namespacesEnabled, principal, roleName, policies) {
				continue
			}
			name = namespacing.StripOwnNamespace(principal, roleName)
		}

		perms, err := conv.PoliciesToPermission(policies...)
		if err != nil {
			return authz.NewGetRolesInternalServerError().WithPayload(cerrors.ErrPayloadFromSingleErr(principal, fmt.Errorf("PoliciesToPermission: %w", err)))
		}
		response = append(response, &models.Role{Name: &name, Permissions: perms})
	}

	// On NS-disabled clusters visibility stays on the role-name matcher
	// (READ_ALL, then READ_MATCH on the same set); NS-enabled was already
	// content-filtered in the loop above.
	if !h.namespacesEnabled {
		resourceFilter := filter.New[*models.Role](h.authorizer, h.rbacconfig)
		roleResource := func(role *models.Role) string {
			return authorization.Roles(*role.Name)[0]
		}
		filtered := resourceFilter.Filter(ctx, principal, response,
			authorization.VerbWithScope(authorization.READ, authorization.ROLE_SCOPE_ALL), roleResource)
		if len(filtered) == 0 {
			// try match if all was none
			filtered = resourceFilter.Filter(ctx, principal, response,
				authorization.VerbWithScope(authorization.READ, authorization.ROLE_SCOPE_MATCH), roleResource)

View on GitHub (pinned to 75aa4b6d11)

Solutions

1. Inspect the stored roles for malformed permissions
2. Fix or delete the offending role via the controller
3. Report if all stored roles appear well-formed

When it happens

Trigger: Thrown at adapters/handlers/rest/authz/handlers_authz.go:648 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of weaviate/weaviate@75aa4b6d11 (2026-09-04). Data as JSON: /api/errors/e5a70f1a0b25d790. Report an issue: GitHub.