{"record":{"id":"0b950c04498a90d9","repo":"Hmbown/CodeWhale","slug":"provider-auth-source-secret-must-include-secret-id","errorCode":null,"errorMessage":"provider auth source secret must include secret_id","messagePattern":"provider auth source secret must include secret_id","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/config/src/auth_source.rs","lineNumber":41,"sourceCode":"\nimpl ProviderAuthSourceToml {\n    pub fn validate(&self) -> Result<()> {\n        match self.source {\n            AuthSourceKind::Command => {\n                if self.command.is_empty() || self.command.iter().all(|part| part.trim().is_empty())\n                {\n                    bail!(\n                        \"provider auth source command must include at least one non-empty argv item\"\n                    );\n                }\n            }\n            AuthSourceKind::Secret => {\n                if self\n                    .secret_id\n                    .as_deref()\n                    .is_none_or(|secret_id| secret_id.trim().is_empty())\n                {\n                    bail!(\"provider auth source secret must include secret_id\");\n                }\n            }\n        }\n        Ok(())\n    }\n\n    #[must_use]\n    pub fn source_class(&self) -> &'static str {\n        match self.source {\n            AuthSourceKind::Command => \"command\",\n            AuthSourceKind::Secret => \"secret\",\n        }\n    }\n}\n","sourceCodeStart":23,"sourceCodeEnd":56,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/config/src/auth_source.rs#L23-L56","documentation":"Config validation: a provider auth block declared source = \"secret\" must name the secret via `secret_id`. ProviderAuthSourceToml::validate() bails when secret_id is missing, None, or trims to empty. It exists so a secret-backed provider can never be constructed without an identifier to look up.","triggerScenarios":"In config.toml, an auth table with source = \"secret\" but no secret_id key, secret_id = \"\", or secret_id = \"   \" (whitespace only).","commonSituations":"Migrating a provider from command auth to secret auth and forgetting the identifier; typo'd key name (secret-id vs secret_id); assuming the secret is discovered from the provider name automatically.","solutions":["Add the identifier: secret_id = \"<name-of-secret-in-store>\" under the same auth table","If you actually wanted command-based auth, set source = \"command\" with a valid command argv","Verify the secret_id matches an entry your secret backend can resolve before restarting"],"exampleFix":"# before\n[providers.acme.auth]\nsource = \"secret\"\n\n# after\n[providers.acme.auth]\nsource = \"secret\"\nsecret_id = \"acme-api-key\"","handlingStrategy":"validation","validationCode":"if matches!(auth.source, AuthSourceKind::Secret)\n    && auth.secret_id.as_deref().is_none_or(|s| s.trim().is_empty())\n{\n    anyhow::bail!(\"fix config: secret auth needs secret_id\");\n}","typeGuard":null,"tryCatchPattern":"match cfg.validate() {\n    Ok(()) => { /* safe to start */ }\n    Err(e) if e.to_string().contains(\"must include secret_id\") => {\n        show_config_hint(\"secret_id = \\\"<name>\\\"\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Use the key name secret_id (snake_case) in TOML","Confirm the secret exists in your backend under that exact id before restart"],"tags":["config","toml","auth","secrets","validation"],"backgroundTag":"config-validation-failed","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}