JuliusBrussee/caveman · error

envelope: object kind is required

Error message

envelope: object kind is required

What it means

Validation guard in scopeAAD(): Scope.Kind is empty after trimming. The kind (object type) is part of the additional authenticated data binding ciphertext to a logical object type, so sealing or opening without it is rejected.

Source

Thrown at shared/platform/envelope/envelope.go:176

		return nil, fmt.Errorf("envelope: ciphertext too short")
	}
	nonce, ct := ciphertext[:ns], ciphertext[ns:]
	plaintext, err := gcm.Open(nil, nonce, ct, aad)
	if err != nil {
		return nil, fmt.Errorf("envelope: open: %w", err)
	}
	return plaintext, nil
}

func scopeAAD(scope Scope) ([]byte, string, error) {
	scope.OrganizationID = strings.TrimSpace(scope.OrganizationID)
	scope.ProjectID = strings.TrimSpace(scope.ProjectID)
	scope.Kind = strings.TrimSpace(scope.Kind)
	if scope.OrganizationID == "" {
		return nil, "", fmt.Errorf("envelope: organization scope is required")
	}
	if scope.Kind == "" {
		return nil, "", fmt.Errorf("envelope: object kind is required")
	}
	aad, err := json.Marshal(struct {
		Version        int    `json:"version"`
		OrganizationID string `json:"organization_id"`
		ProjectID      string `json:"project_id"`
		Kind           string `json:"kind"`
	}{2, scope.OrganizationID, scope.ProjectID, scope.Kind})
	if err != nil {
		return nil, "", fmt.Errorf("envelope: encode scope: %w", err)
	}
	sum := sha256.Sum256(aad)
	return aad, hex.EncodeToString(sum[:]), nil
}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Set Scope.Kind to the logical object kind being sealed/opened before calling the scope-aware envelope APIs
2. Validate the scope struct at the call site so missing kinds never reach the envelope

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:176 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/54d3c3df4dfb487d. Report an issue: GitHub.