{"record":{"id":"1ff9d03cf42c88fc","repo":"toeverything/AFFiNE","slug":"secure-byok-key-storage-is-not-available","errorCode":null,"errorMessage":"Secure BYOK key storage is not available.","messagePattern":"Secure BYOK key storage is not available\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/frontend/apps/electron/src/main/byok-storage/handlers.ts","lineNumber":73,"sourceCode":"        attachmentSources: string[];\n      }>;\n    }>;\n  };\n  sortOrder?: number | null;\n  enabled?: boolean | null;\n};\n\ntype WorkspaceByokKeyInput = Omit<\n  WorkspaceByokKey,\n  'credential' | 'definition'\n> & {\n  credential?: string | null;\n  definition?: WorkspaceByokKey['definition'];\n};\n\nfunction assertSupported() {\n  if (!safeStorage.isEncryptionAvailable()) {\n    throw new Error('Secure BYOK key storage is not available.');\n  }\n}\n\nfunction hasOwnField(\n  key: WorkspaceByokKeyInput,\n  field: keyof WorkspaceByokKey\n) {\n  return Object.prototype.hasOwnProperty.call(key, field);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null && !Array.isArray(value);\n}\n\nfunction isAllowedStringArray(\n  value: unknown,\n  allowed: Set<string>\n): value is string[] {","sourceCodeStart":55,"sourceCodeEnd":91,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/b4c8548c09da21b2898443559a5b846f0ccf5dd8/packages/frontend/apps/electron/src/main/byok-storage/handlers.ts#L55-L91","documentation":"assertSupported checks Electron safeStorage.isEncryptionAvailable(); when the OS provides no secure encryption backend, BYOK keys cannot be stored safely and this Error is thrown. Called before readWorkspaceKeys and writeWorkspaceKeys.","triggerScenarios":"Thrown at packages/frontend/apps/electron/src/main/byok-storage/handlers.ts:73 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use an OS with a supported secure storage backend (keychain/credential manager) for BYOK keys.","Install or unlock the system credential storage, then retry saving the key.","On unsupported environments, configure the provider key through another supported channel."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b4c8548c09da21b2898443559a5b846f0ccf5dd8","analyzedAt":"2026-08-18T21:16:52.546Z","contentChangedAt":"2026-08-18T21:16:52.546Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}