{"record":{"id":"0df0072771999351","repo":"OpenNHP/opennhp","slug":"source-smart-policy-and-access-url-are-only","errorCode":null,"errorMessage":"--source, --smart-policy and --access-url are only allowed in encrypt mode","messagePattern":"--source, --smart-policy and --access-url are only allowed in encrypt mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":83,"sourceCode":"\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tif c.String(\"access-url\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--access-url is required when --data-source-type is stream\")\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode\n\t\t\t\tif c.String(\"ztdo\") != \"\" || c.String(\"data-private-key\") != \"\" || c.String(\"provider-public-key\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else if c.String(\"mode\") == \"decrypt\" {\n\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"smart-policy\") != \"\" || c.String(\"access-url\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--source, --smart-policy and --access-url are only allowed in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in encrypt mode\n\t\t\t\tif c.String(\"ztdo\") == \"\" || c.String(\"output\") == \"\" || c.String(\"data-private-key\") == \"\" || c.String(\"provider-public-key\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\tmode := c.String(\"mode\")\n\t\t\tsource := c.String(\"source\")\n\t\t\tdsType := c.String(\"data-source-type\")\n\t\t\tsmartPolicy := c.String(\"smart-policy\")\n\t\t\tmetadata := c.String(\"metadata\")","sourceCodeStart":65,"sourceCodeEnd":101,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L65-L101","documentation":"Guard inside the nhp-db CLI 'encrypt' mode branch: while validating flags it detects that --source, --smart-policy or --access-url was passed together with decrypt-only options, which means the operator mixed flags from the two mutually exclusive modes. The specific input at fault is whichever of --ztdo / --data-private-key / --provider-public-key was non-empty while --mode=encrypt.","triggerScenarios":"Running `nhp-device run --mode decrypt --ztdo ... --data-private-key ... --provider-public-key ...` while also passing --source, --smart-policy, or --access-url.","commonSituations":"A single command template carrying all possible flags; switching --mode from encrypt to decrypt without pruning source-side flags; automation that appends --access-url for telemetry URLs mistakenly.","solutions":["Remove --source, --smart-policy and --access-url from the decrypt invocation","Keep only decrypt flags: --ztdo, --output, --data-private-key, --provider-public-key","Fix wrapper scripts to build flag sets per mode"],"exampleFix":"// before\nnhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P --source in.csv\n// after\nnhp-device run --mode decrypt --ztdo a.ztdo --output out.csv --data-private-key K --provider-public-key P","handlingStrategy":"validation","validationCode":"if (flags.mode === 'decrypt' && ['source','smart-policy','access-url'].some(f => flags[f])) {\n  throw new Error('encrypt-only flags passed in decrypt mode');\n}","typeGuard":"const hasEncryptInputs = (flags) => Boolean(flags.source || flags['smart-policy'] || flags['access-url']);","tryCatchPattern":null,"preventionTips":["Build decrypt invocations from a minimal flag template","Strip source-side flags when converting encrypt commands to decrypt","Test wrapper scripts in both modes after edits"],"tags":["cli","validation","flags"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}