Tencent/WeKnora · error

failed to generate KS3 presigned URL: %w

Error message

failed to generate KS3 presigned URL: %w

What it means

ks3FileService.GetFileURL wraps GeneratePresignedUrl errors with "failed to generate KS3 presigned URL: %w". URL signing is done client-side from the AK/SK, so failures usually mean invalid credentials, unsupported signer configuration, or bad input (expired/zero time, malformed key) — not a network round-trip.

Source

Thrown at internal/application/service/file/ks3.go:288

}

func (s *ks3FileService) GetFileURL(ctx context.Context, filePath string) (string, error) {
	_, objectKey, err := parseKS3FilePath(filePath)
	if err != nil {
		return "", err
	}
	if err := utils.SafeObjectKey(objectKey); err != nil {
		return "", fmt.Errorf("invalid file path: %w", err)
	}

	url, err := s.client.GeneratePresignedUrl(&ks3s3.GeneratePresignedUrlInput{
		Bucket:     ks3aws.String(s.bucketName),
		Key:        ks3aws.String(objectKey),
		HTTPMethod: ks3s3.HTTPMethod("GET"),
		Expires:    int64((24 * time.Hour).Seconds()),
	})
	if err != nil {
		return "", fmt.Errorf("failed to generate KS3 presigned URL: %w", err)
	}

	return url, nil
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Verify accessKey/secretKey are non-empty and correct; presigning signs locally, so wrong-credential errors surface here rather than at request time.
2. Check the wrapped error for SDK messages about SignerVersion/expiry; try the SDK's recommended signer version for presigned URLs.
3. Confirm the bucket and object key characters are URL-signable (no spaces/control chars); re-save the file if the key is malformed.
4. As a workaround, stream downloads through GetFile instead of presigned URLs while fixing credentials.
5. Upgrade the ks3sdklib/aws-sdk-go dependency if the error indicates an SDK bug in GeneratePresignedUrl.

Example fix

// before
client := ks3s3.New(&ks3aws.Config{Credentials: credentials.NewStaticCredentials("", "", "")}) // empty creds
// after
client := ks3s3.New(&ks3aws.Config{Credentials: credentials.NewStaticCredentials(ak, sk, ""), SignerVersion: "V2"})

if accessKey == "" || secretKey == "" {
	return errors.New("KS3 credentials not configured")
}

url, err := svc.GetFileURL(ctx, path)
if err != nil {
	// presigning failed (usually credential/config): fall back to
	// streaming the file through GetFile behind an authenticated endpoint
	return streamDownload(ctx, path)
}

When it happens

Trigger: GeneratePresignedUrl returns an error: empty or malformed access/secret keys, signer version incompatible with presigning (V2 config issues), or SDK-side parameter validation failing for the 24h expiry request.

Common situations: Placeholder credentials in dev config; secret key containing characters that break V2 signing; KS3 SDK version where presigning requires different config; bucket name with invalid characters.

Related errors

• failed to get file from KS3: %w
• E2BAPIKey is required for the E2B backend
• invalid file path: %w
• failed to delete file from KS3: %w
• parse rss credentials: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/5224c1583bb146af. Report an issue: GitHub.