{"record":{"id":"0a03d154e898e470","repo":"iflytek/astron-agent","slug":"tenant-application-credential-verification-is-not-configured","errorCode":null,"errorMessage":"Tenant application credential verification is not configured or incomplete","messagePattern":"Tenant application credential verification is not configured or incomplete","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java","lineNumber":51,"sourceCode":"    public HttpTenantGatewayAuthClient(\n            @Value(\"${tenant.verify-app-auth}\") String verifyAppAuthUrl,\n            @Value(\"${api.url.apiSecret:}\") String tenantInternalKey) {\n        this(new OkHttpClient(), verifyAppAuthUrl, tenantInternalKey);\n    }\n\n    HttpTenantGatewayAuthClient(\n            OkHttpClient httpClient, String verifyAppAuthUrl, String tenantInternalKey) {\n        this.httpClient = httpClient;\n        this.verifyAppAuthUrl = verifyAppAuthUrl;\n        this.tenantInternalKey = tenantInternalKey;\n    }\n\n    @Override\n    public Optional<String> verify(String apiKey, String apiSecret) {\n        if (!StringUtils.hasText(verifyAppAuthUrl)\n                || !StringUtils.hasText(apiKey)\n                || !StringUtils.hasText(apiSecret)) {\n            log.warn(\"Tenant application credential verification is not configured or incomplete\");\n            return Optional.empty();\n        }\n        String configuredInternalKey;\n        try {\n            configuredInternalKey =\n                    TenantInternalApiKey.requireConfigured(tenantInternalKey);\n        } catch (IllegalStateException exception) {\n            log.warn(\"Tenant internal authentication is not configured; verification was not sent\");\n            return Optional.empty();\n        }\n\n        JSONObject requestBody = new JSONObject();\n        requestBody.put(\"api_key\", apiKey);\n        requestBody.put(\"api_secret\", apiSecret);\n\n        Request request = new Request.Builder()\n                .url(verifyAppAuthUrl)\n                .header(TenantInternalApiKey.HEADER, configuredInternalKey)","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java#L33-L69","documentation":"HttpTenantGatewayAuthClient.verify fails closed when any of the tenant app-verification prerequisites is absent: the verifyAppAuthUrl is not configured, or apiKey/apiSecret are blank. It logs a warning and returns Optional.empty(), so the caller treats the credentials as unverified. No HTTP call is made.","triggerScenarios":"verify(apiKey, apiSecret) called while verifyAppAuthUrl property is missing/blank, or either credential argument is null/empty.","commonSituations":"Tenant gateway auth not configured in application.yml/env (missing verify-app-auth-url); caller passes empty key or secret from an unconfigured application record; property name typo after refactor; config not loaded in the active Spring profile.","solutions":["Set the tenant verify-app-auth-url configuration property (env var or application.yml) in the active profile.","Ensure the application being verified has a non-empty api_key and api_secret stored.","Confirm the config binds to HttpTenantGatewayAuthClient's @Value/@ConfigurationProperties field (name and profile).","If credentials are legitimately absent, surface a clear 'app not configured' error to the gateway caller instead of silently returning empty."],"exampleFix":"# before\n# (property absent)\n# after\ntenant:\n  gateway:\n    verify-app-auth-url: http://tenant-service:8080/internal/verify-app-auth","handlingStrategy":"validation","validationCode":"// startup readiness check\nif (!StringUtils.hasText(props.getVerifyAppAuthUrl())) {\n    throw new IllegalStateException(\"tenant verify-app-auth-url must be configured\");\n}","typeGuard":"boolean verifyConfigReady = StringUtils.hasText(verifyAppAuthUrl);\nboolean credsPresent = StringUtils.hasText(apiKey) && StringUtils.hasText(apiSecret);","tryCatchPattern":"Optional<String> appId = authClient.verify(apiKey, apiSecret);\nif (appId.isEmpty()) {\n    log.warn(\"app credentials unverified: config missing or verification rejected\");\n    return unauthorized();\n}","preventionTips":["Add the verify-app-auth-url property to all deployment profiles and helm values.","Fail fast at startup with a config validation bean.","Require api_key/api_secret non-null at application registration time.","Distinguish 'not configured' from 'verification failed' in responses/logs."],"tags":["configuration","authentication","tenant-gateway","fail-closed"],"backgroundTag":"missing-required-config","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}