{"record":{"id":"1ae49108e01a06f3","repo":"hcengineering/platform","slug":"server-secret-not-set-datalake-storage-adapter-in","errorCode":null,"errorMessage":"Server secret not set, datalake storage adapter initialized with default secret","messagePattern":"Server secret not set, datalake storage adapter initialized with default secret","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"foundations/server/packages/datalake/src/index.ts","lineNumber":80,"sourceCode":"  retryCount?: number\n  retryInterval?: number\n}\n\n/**\n * @public\n */\nexport class DatalakeService implements StorageAdapter {\n  private readonly client: DatalakeClient\n  private readonly retryCount: number\n  private readonly retryInterval: number\n\n  constructor (\n    readonly cfg: DatalakeConfig,\n    readonly options: DatalakeClientOptions = {}\n  ) {\n    const secret = getMetadata(serverToken.metadata.Secret)\n    if (secret === undefined) {\n      console.warn('Server secret not set, datalake storage adapter initialized with default secret')\n    }\n    const token = generateToken(systemAccountUuid, undefined)\n    this.client = createDatalakeClient(cfg, token)\n    this.retryCount = options.retryCount ?? 5\n    this.retryInterval = options.retryInterval ?? 50\n  }\n\n  async initialize (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {}\n\n  async close (): Promise<void> {}\n\n  async exists (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<boolean> {\n    // workspace/buckets not supported, assume that always exist\n    return true\n  }\n\n  @withContext('make')\n  async make (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/server/packages/datalake/src/index.ts#L62-L98","documentation":"The Datalake storage adapter constructor reads the server secret from server token metadata (getMetadata(serverToken.metadata.Secret)). If no server secret is configured in the environment, it falls back to generating tokens with a default secret and prints this console warning. Tokens signed with the default secret are insecure and may be rejected by storage services expecting the real secret.","triggerScenarios":"Constructing the datalake storage adapter in a server process where the SERVER_SECRET (server token secret metadata) environment/config variable is undefined.","commonSituations":"Fresh deployment where the server secret env var was never set; running locally without copying the production env; docker-compose missing the secret entry; typo in the env variable name.","solutions":["Set the server secret environment variable (e.g. SERVER_SECRET) before starting the server","Restart the process after setting the secret so the token metadata is populated","Verify with a startup check/log that getMetadata(serverToken.metadata.Secret) resolves","Never run production with the default secret — rotate any tokens issued while it was unset"],"exampleFix":"// before\ndocker run hcserver\n// after\ndocker run -e SERVER_SECRET=<secret> hcserver","handlingStrategy":"validation","validationCode":"if (process.env.SERVER_SECRET === undefined) {\n  throw new Error('SERVER_SECRET must be set before initializing datalake adapter')\n}","typeGuard":"function hasServerSecret(meta: { Secret?: string }): meta is { Secret: string } {\n  return typeof meta.Secret === 'string' && meta.Secret.length > 0\n}","tryCatchPattern":"try {\n  const adapter = new DatalakeStorageAdapter(cfg)\n  if (adapter.initializedWithDefaultSecret) logger.error('datalake using default secret — refusing in production')\n} catch (err) {\n  logger.error('datalake init failed', { err })\n  process.exit(1)\n}","preventionTips":["Fail fast at startup when SERVER_SECRET is missing in production","Add the secret to deployment templates/secret managers (k8s secrets, docker secrets)","Document required env vars in deployment README","Never commit default secrets; rotate tokens issued with defaults"],"tags":["security","configuration","datalake"],"backgroundTag":"missing-server-secret","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}