{"record":{"id":"1fc6dbc33ea5e882","repo":"larksuite/cli","slug":"secret-provider-q-has-source-q-but-ref-requests","errorCode":null,"errorMessage":"secret provider %q has source %q but ref requests %q","messagePattern":"secret provider %q has source %q but ref requests %q","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/types.go","lineNumber":213,"sourceCode":"\t\t\t}\n\t\t}\n\t}\n\treturn DefaultProviderAlias\n}\n\n// LookupProvider resolves a provider config from the registry.\n// Returns the provider config or an error if not found.\n// Special case: env source with \"default\" provider returns a synthetic empty env provider.\nfunc LookupProvider(ref *SecretRef, cfg *SecretsConfig) (*ProviderConfig, error) {\n\tproviderName := ResolveDefaultProvider(ref, cfg)\n\n\tif cfg != nil && cfg.Providers != nil {\n\t\tif pc, ok := cfg.Providers[providerName]; ok {\n\t\t\tif pc == nil {\n\t\t\t\treturn nil, fmt.Errorf(\"secret provider %q is configured as null\", providerName)\n\t\t\t}\n\t\t\tif pc.Source != ref.Source {\n\t\t\t\treturn nil, fmt.Errorf(\"secret provider %q has source %q but ref requests %q\",\n\t\t\t\t\tproviderName, pc.Source, ref.Source)\n\t\t\t}\n\t\t\treturn pc, nil\n\t\t}\n\t}\n\n\t// Special case: default env provider (implicit, per OpenClaw resolve.ts)\n\tif ref.Source == \"env\" && providerName == DefaultProviderAlias {\n\t\treturn &ProviderConfig{Source: \"env\"}, nil\n\t}\n\n\treturn nil, fmt.Errorf(\"secret provider %q is not configured (ref: %s:%s:%s)\",\n\t\tproviderName, ref.Source, providerName, ref.ID)\n}\n\n// CandidateApp represents a bindable app from OpenClaw's feishu channel config.\ntype CandidateApp struct {\n\tLabel     string","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/types.go#L195-L231","documentation":"LookupProvider compares the provider's configured Source with the Source in the secret ref; a mismatch means the named provider cannot serve this ref kind (e.g. an env provider asked for a file ref). This prevents silently resolving a secret through the wrong backend.","triggerScenarios":"A ref like {\"source\":\"file\",\"id\":\"token\",\"provider\":\"default\"} where provider \"default\" is configured with source \"env\".","commonSituations":"Reusing one provider name across refs of different sources after refactoring; renaming sources in config without updating refs; misunderstanding that `provider` does not override `source`.","solutions":["Make the ref's source match the provider's configured source","Configure a provider with the ref's source and reference it by name","Drop the explicit `provider` field so the implicit default (or an explicit one) is used consistently"],"exampleFix":"// before\n{\"source\": \"file\", \"id\": \"token\", \"provider\": \"default\"} // default has source env\n// after\n{\"source\": \"env\", \"id\": \"TOKEN\"}","handlingStrategy":"validation","validationCode":"for _, ref := range refs {\n    p, ok := cfg.Secrets.Providers[ref.Provider]\n    if ok && p.Source != ref.Source {\n        return fmt.Errorf(\"ref %s:%s uses provider %q with source %q\", ref.Source, ref.ID, ref.Provider, p.Source)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember `provider` names a backend; it never overrides `source`","Name providers by their source (e.g. env-default, exec-vault) to prevent mismatches","Cross-check refs against provider sources in a lint script"],"tags":["config","secrets","providers","mismatch"],"backgroundTag":"provider-source-mismatch","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}