Tencent/WeKnora · error

failed to get file from OSS: %w

Error message

failed to get file from OSS: %w

What it means

This error is returned by ossFileService.GetFile when the client.GetObject call fails. Path parsing and key validation have already passed, so this reflects an OSS-level failure. The SDK error is wrapped so callers can inspect the OSS error code (NoSuchKey, AccessDenied, signature errors, etc.).

Source

Thrown at internal/application/service/file/oss.go:304

		return nil, err
	}
	if err := utils.SafeObjectKey(objectName); err != nil {
		return nil, fmt.Errorf("invalid file path: %w", err)
	}

	var client *oss.Client
	if bucketName == s.tempBucketName && s.tempClient != nil {
		client = s.tempClient
	} else {
		client = s.client
	}

	resp, err := client.GetObject(ctx, &oss.GetObjectRequest{
		Bucket: oss.Ptr(bucketName),
		Key:    oss.Ptr(objectName),
	})
	if err != nil {
		return nil, fmt.Errorf("failed to get file from OSS: %w", err)
	}

	return resp.Body, nil
}

// DeleteFile removes a file from OSS.
func (s *ossFileService) DeleteFile(ctx context.Context, filePath string) error {
	bucketName, objectName, err := parseOssFilePath(filePath)
	if err != nil {
		return err
	}
	if err := utils.SafeObjectKey(objectName); err != nil {
		return fmt.Errorf("invalid file path: %w", err)
	}

	var client *oss.Client
	if bucketName == s.tempBucketName && s.tempClient != nil {
		client = s.tempClient

View on GitHub (pinned to 988cbb0330)

Solutions

1. Unwrap the error and check for NoSuchKey — treat as 'file not found' rather than a system error.
2. Confirm temp-bucket routing: if bucketName == tempBucketName, ensure tempClient is configured.
3. Verify credentials and oss:GetObject permission on the bucket/key.
4. Check that the OSS endpoint/region matches the bucket.
5. Retry transient network/5xx failures with backoff.

Example fix

// before
body, err := svc.GetFile(ctx, filePath)
if err != nil {
    return fmt.Errorf("download failed: %w", err)
}
// after
body, err := svc.GetFile(ctx, filePath)
var svcErr *oss.ServiceError
if errors.As(err, &svcErr) && svcErr.Code == "NoSuchKey" {
    return ErrFileNotFound
}

// pre-checks before GetFile
if !strings.HasPrefix(filePath, "oss://") { return ErrWrongBackend }
if _, key, _ := parseOssFilePath(filePath); utils.SafeObjectKey(key) != nil { return ErrBadPath }

func isOSSNoSuchKey(err error) bool {
    var svcErr *oss.ServiceError
    return errors.As(err, &svcErr) && svcErr.Code == "NoSuchKey"
}

reader, err := svc.GetFile(ctx, filePath)
var svcErr *oss.ServiceError
switch {
case err == nil:
    defer reader.Close()
case errors.As(err, &svcErr) && svcErr.Code == "NoSuchKey":
    return ErrFileNotFound
case errors.As(err, &svcErr) && svcErr.Code == "AccessDenied":
    return ErrPermission
default:
    return fmt.Errorf("get failed: %w", err) // retry transient
}

When it happens

Trigger: Calling GetFile with a valid oss:// path where GetObject fails: object deleted or never uploaded, bucket mismatch, temp-bucket path routed to the wrong client, missing oss:GetObject permission, expired credentials, or network failure.

Common situations: Downloading a file whose DB record outlived the OSS object (temp objects reaped after TTL); temp bucket configured in DB paths but tempClient not configured in this environment; expired STS credentials; wrong-region endpoint causing 403/404-style failures.

Related errors

• failed to copy file in OSS: %w
• failed to upload file to OSS (multipart): %w
• failed to upload file to OSS: %w
• failed to upload bytes to OSS: %w
• invalid file path: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/f4653909078c45db. Report an issue: GitHub.