JuliusBrussee/caveman · error

envelope: organization scope is required

Error message

envelope: organization scope is required

What it means

Validation guard in scopeAAD(): the tenant-scoped seal/open path was called with a Scope whose OrganizationID is empty or whitespace-only. AAD binding requires an organization identifier, so the call cannot proceed.

Source

Thrown at shared/platform/envelope/envelope.go:173

	}
	ns := gcm.NonceSize()
	if len(ciphertext) < ns {
		return nil, fmt.Errorf("envelope: ciphertext too short")
	}
	nonce, ct := ciphertext[:ns], ciphertext[ns:]
	plaintext, err := gcm.Open(nil, nonce, ct, aad)
	if err != nil {
		return nil, fmt.Errorf("envelope: open: %w", err)
	}
	return plaintext, nil
}

func scopeAAD(scope Scope) ([]byte, string, error) {
	scope.OrganizationID = strings.TrimSpace(scope.OrganizationID)
	scope.ProjectID = strings.TrimSpace(scope.ProjectID)
	scope.Kind = strings.TrimSpace(scope.Kind)
	if scope.OrganizationID == "" {
		return nil, "", fmt.Errorf("envelope: organization scope is required")
	}
	if scope.Kind == "" {
		return nil, "", fmt.Errorf("envelope: object kind is required")
	}
	aad, err := json.Marshal(struct {
		Version        int    `json:"version"`
		OrganizationID string `json:"organization_id"`
		ProjectID      string `json:"project_id"`
		Kind           string `json:"kind"`
	}{2, scope.OrganizationID, scope.ProjectID, scope.Kind})
	if err != nil {
		return nil, "", fmt.Errorf("envelope: encode scope: %w", err)
	}
	sum := sha256.Sum256(aad)
	return aad, hex.EncodeToString(sum[:]), nil
}

View on GitHub (pinned to 766dce6b13)

Solutions

1. Populate Scope.OrganizationID from the authenticated tenant context before calling SealForScope/OpenForScope
2. Trim and validate scope fields at the API boundary before reaching the envelope layer

When it happens

Trigger: Thrown at shared/platform/envelope/envelope.go:173 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of JuliusBrussee/caveman@766dce6b13 (2026-08-18). Data as JSON: /api/errors/b8d28f06957c7cf3. Report an issue: GitHub.