Tencent/WeKnora · error · AppError

opensearch: authentication failed

Error message

opensearch: authentication failed

What it means

A TypeCast whose target type name starts with `pg_` was found. Types like pg_lsn, pg_node_tree, or any pg_-prefixed system type are internal PostgreSQL representations, and casting to them is a known vector for probing or crashing the server, so the validator blocks them explicitly.

Source

Thrown at internal/application/repository/retriever/opensearch/errors.go:24

// Sentinel errors returned by Repository. The service-layer factory wraps
// these into typed AppError values (2200/2201) — the repository itself
// never imports internal/errors. The boundary is intentional (directional
// dependency).
var (
	// ErrIndexNotFound — alias / underlying index missing. Search and
	// delete-by-query operations return this when the per-dim alias has
	// not been created yet (no Save has been issued for that dim).
	ErrIndexNotFound = errors.New("opensearch: index not found")

	// ErrDimensionMismatch — embedding dimension violates the per-dim
	// invariant (e.g. dim <= 0, dim > 16000, or embeddings within a
	// single batch disagree).
	ErrDimensionMismatch = errors.New("opensearch: embedding dimension mismatch")

	// ErrAuth — cluster returned 401 / 403. Distinguished from ErrTransport
	// so the service layer can map to a clean 4xx instead of 503.
	ErrAuth = errors.New("opensearch: authentication failed")

	// ErrTransport — network / 5xx / opaque cluster error. Classified as
	// transient: ensureReady does NOT persist this in initErr, so the next
	// caller will retry.
	ErrTransport = errors.New("opensearch: transport error")

	// ErrVersionUnsupported — cluster is not OpenSearch, is OS 1.x, or is
	// OS 2.0~2.3 (pre-Lucene-HNSW-GA). probeVersion enforces.
	ErrVersionUnsupported = errors.New("opensearch: cluster version unsupported")

	// ErrConfigInvalid — IndexConfig / storeID / sanitizeIndexName guard
	// failed, or the k-NN plugin is missing on one or more cluster nodes.
	ErrConfigInvalid = errors.New("opensearch: invalid index config")

	// ErrFeatureNotEnabled — stubs.go returns this from methods whose real
	// implementation has not landed yet (CopyIndices / BatchUpdateChunk* /
	// swapToVersion, plus the read/write methods that a follow-up commit
	// will replace with production code).

View on GitHub (pinned to 988cbb0330)

Solutions

  1. Remove the cast to the pg_* type and use the column's native type; if a textual form is needed, cast to text instead.
  2. If the target type is a legitimate custom type that happens to be pg_-prefixed, rename it, or adjust the validator's system-type check to an explicit allowlist (trusted input only).
  3. Handle any needed conversion of pg_-typed values (e.g. pg_lsn) in application code after selecting them as text.

Example fix

// before
SELECT lsn::pg_lsn FROM wal_positions;

// after
SELECT lsn::text FROM wal_positions;
Defensive patterns

Strategy: validation

Validate before calling

var pgCast = regexp.MustCompile(`(?i)::\s*pg_[a-z_]+|cast\s*\(\s*[^)]+\s+as\s+pg_[a-z_]+`)
if pgCast.MatchString(sql) {
	// replace with a text cast or native type before validating
}

Try / catch

if err := validator.ValidateQuery(sql); err != nil {
	if strings.Contains(err.Error(), "casting to system type") {
		return fmt.Errorf("remove pg_* casts; cast to text instead: %w", err)
	}
}

Prevention

When it happens

Trigger: Validating expressions like `col::pg_lsn`, `x::pg_node_tree`, or explicit `CAST(v AS pg_snapshot)` in SELECT/WHERE/ORDER BY clauses.

Common situations: Copy-pasted DBA queries that inspect replication or catalog internals; generated queries that force-cast columns to system types; attempts to abuse pg_-prefixed types for exploitation.

Understand the failure class

Related errors

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/95a30811356cc796. Report an issue: GitHub.