Hmbown/CodeWhale · error · anyhow::Error

managed external credential access is unsupported for {}; no

Error message

managed external credential access is unsupported for {}; no schema-safe preservation adapter is available

What it means

The external-credential access model has three levels (disabled/read-only/managed) but only read-only is implemented for validate_read_scope(); a consent with access = "managed" bails with this message because no schema-safe preservation adapter exists yet to write back into the external store. It is an explicit not-implemented guard, not a policy denial.

Source

Thrown at crates/config/src/external_credentials.rs:408

    /// Validate that this record is a current read-only consent for one exact
    /// provider/source/path tuple without minting an I/O capability.
    ///
    /// This is intentionally side-effect free so inventory and picker surfaces
    /// can acknowledge dormant consent without inspecting the external file.
    pub fn validate_read_scope(
        &self,
        provider: ProviderKind,
        source: ExternalCredentialSource,
        resolved_path: &Path,
    ) -> Result<()> {
        if self.access == ExternalCredentialAccess::Disabled {
            bail!(
                "external credential access is disabled for {}",
                provider.as_str()
            );
        }
        if self.access == ExternalCredentialAccess::Managed {
            bail!(
                "managed external credential access is unsupported for {}; no schema-safe preservation adapter is available",
                provider.as_str()
            );
        }
        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {
            bail!(
                "external credential consent for {} uses unsupported version {}; revoke and consent again",
                provider.as_str(),
                self.consent_version
            );
        }
        if self.provider != provider.as_str() {
            bail!(
                "external credential consent is scoped to provider {:?}, not {}",
                self.provider,
                provider.as_str()
            );
        }

View on GitHub (pinned to 0c42157ee5)

Solutions

  1. Re-create the consent with read-only access, the only supported mode
  2. Remove the external-credential consent and use a different auth source until managed mode ships

Example fix

# before
[[external_credentials]]
access = "managed"

# after
[[external_credentials]]
access = "read_only"
Defensive patterns

Strategy: validation

Validate before calling

if consent.access == ExternalCredentialAccess::Managed {
    // unsupported today: reject at UI/entry time with a clear message
    return Err(anyhow!("managed access not implemented; use read_only"));
}

Type guard

fn supported_access(access: ExternalCredentialAccess) -> bool {
    matches!(access, ExternalCredentialAccess::ReadOnly)
}

Try / catch

match consent.validate_read_scope(provider, source, &path) {
    Ok(()) => read_external_credential(&path),
    Err(e) if e.to_string().contains("no schema-safe preservation adapter") => {
        downgrade_to_read_only_consent(provider) // re-consent read-only
    }
    Err(e) => Err(e),
}

Prevention

When it happens

Trigger: A consent record carries access = "managed" (hand-edited config, forward-versioned file, or experimental tooling) and validate_read_scope() is called for that provider.

Common situations: Users hand-editing config to 'upgrade' a consent to managed; docs or examples that mention managed mode before it shipped; config files copied from a newer Codewhale that supports managed access.

Related errors

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/64868b7e5f27601c. Report an issue: GitHub.