{"record":{"id":"213181844a5b9458","repo":"t8y2/dbx","slug":"password-is-required","errorCode":null,"errorMessage":"password is required","messagePattern":"password is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/rabbitmq/operations.go","lineNumber":799,"sourceCode":"\nfunc parseUserTags(tags string) []string {\n\tresult := make([]string, 0)\n\tfor _, tag := range strings.Split(tags, \",\") {\n\t\tif trimmed := strings.TrimSpace(tag); trimmed != \"\" {\n\t\t\tresult = append(result, trimmed)\n\t\t}\n\t}\n\treturn result\n}\n\nfunc (s *server) createUser(params jsonObject) (any, error) {\n\tname, err := userName(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tpassword := stringOrEmpty(params, \"password\")\n\tif password == \"\" {\n\t\treturn nil, errors.New(\"password is required\")\n\t}\n\tconnection, err := s.requireConnectionConfig(params)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif err := assertNotConnectedUser(\"create or modify\", name, stringOrDefault(connection, \"username\", \"guest\")); err != nil {\n\t\treturn nil, err\n\t}\n\tbody := jsonObject{\"password\": password, \"tags\": userTagsParam(params)}\n\tif _, err := managementSend(connection, http.MethodPut, \"/api/users/\"+urlEncodePathSegment(name), body); err != nil {\n\t\treturn nil, err\n\t}\n\treturn okResult(), nil\n}\n\nfunc userTagsParam(params jsonObject) string {\n\tvalue, exists := params[\"tags\"]\n\tif !exists || value == nil {","sourceCodeStart":781,"sourceCodeEnd":817,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/rabbitmq/operations.go#L781-L817","documentation":"createUser requires a 'password' parameter when creating or modifying a RabbitMQ user, because the management API PUT /api/users/{name} needs a password (or password_hash) to authenticate the user. The library rejects the call before contacting the server when password is an empty string. Note the check is password == \"\" (no trim), so whitespace technically passes.","triggerScenarios":"Calling createUser (via dispatch) with 'name' set correctly but 'password' absent or set to \"\". Commonly combined with requireConnectionConfig and assertNotConnectedUser checks that run after this guard.","commonSituations":"Provisioning scripts where the password comes from a secrets manager or env var (e.g. RABBITMQ_PASSWORD) that is unset; secrets injection failures in CI/CD leaving the variable empty; template configs with a placeholder password field left blank; preferring secrets over plaintext and passing an empty secret by mistake.","solutions":["Provide a non-empty 'password' parameter in the createUser params.","If the password comes from an env var or secret store, verify the secret exists and is populated before calling.","If intending passwordless/credentials via another mechanism, use the hash-based parameter your tooling supports instead of an empty password."],"exampleFix":"// before\nparams := jsonObject{\"name\": \"svc-user\", \"tags\": \"monitoring\"}\n_, err := createUser(params) // error: password is required\n// after\npwd := os.Getenv(\"RABBITMQ_PASSWORD\")\nif pwd == \"\" {\n    return errors.New(\"RABBITMQ_PASSWORD must be set\")\n}\nparams := jsonObject{\"name\": \"svc-user\", \"password\": pwd, \"tags\": \"monitoring\"}\n_, err := createUser(params)","handlingStrategy":"validation","validationCode":"pwd := os.Getenv(\"RABBITMQ_PASSWORD\")\nif pwd == \"\" {\n    return errors.New(\"password must be provided before creating user\")\n}\ncreateUser(jsonObject{\"name\": userName, \"password\": pwd})","typeGuard":"func hasPassword(params map[string]any) bool {\n    v, ok := params[\"password\"]\n    if !ok {\n        return false\n    }\n    s, isStr := v.(string)\n    return isStr && s != \"\"\n}","tryCatchPattern":null,"preventionTips":["Load passwords from a secrets manager and assert they are non-empty at startup, not at call time.","Check CI/CD secret injection actually populated the variable (empty secrets often fail silently).","Never leave placeholder/blank password fields in provisioning templates."],"tags":["validation","rabbitmq","missing-parameter","credentials"],"backgroundTag":"missing-required-parameter","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}