{"record":{"id":"23845c18ff20c2f0","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-credential-file-owner-is-not-the-c","errorCode":null,"errorMessage":"Codewhale-owned credential file owner is not the current user","messagePattern":"Codewhale-owned credential file owner is not the current user","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/external_credentials.rs","lineNumber":485,"sourceCode":"            &mut owner,\n            std::ptr::null_mut(),\n            &mut dacl,\n            std::ptr::null_mut(),\n            &mut descriptor,\n        )\n    };\n    if result != ERROR_SUCCESS {\n        return Err(io::Error::from_raw_os_error(result as i32));\n    }\n    let _descriptor = WindowsLocalAllocation(descriptor.cast());\n    if owner.is_null() || unsafe { EqualSid(owner, user.sid()) } == 0 {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file owner is not the current user\",\n        ));\n    }\n    if dacl.is_null() {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file must have an owner-only DACL\",\n        ));\n    }\n    let mut count = 0;\n    let mut entries: *mut EXPLICIT_ACCESS_W = std::ptr::null_mut();\n    // SAFETY: `dacl` is owned by the live security descriptor; Windows\n    // allocates the returned entries, released below.\n    let result = unsafe { GetExplicitEntriesFromAclW(dacl, &mut count, &mut entries) };\n    if result != ERROR_SUCCESS {\n        return Err(io::Error::from_raw_os_error(result as i32));\n    }\n    let _entries = WindowsLocalAllocation(entries.cast());\n    if count != 1 || entries.is_null() {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file DACL must grant only one user\",\n        ));","sourceCodeStart":467,"sourceCodeEnd":503,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/external_credentials.rs#L467-L503","documentation":"Windows ownership check in verify_windows_owner_only_handle: GetSecurityInfo succeeded but the file's owner SID is null or does not equal the current user's SID, so the credential file is not owner-only and is rejected with PermissionDenied.","triggerScenarios":"Thrown at crates/tui/src/external_credentials.rs:485 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Re-create the credential file as the current user so ownership is set correctly (e.g. re-run the auth flow).","Use takeown/icacls or File Explorer to reset ownership to the current user.","Avoid copying credential files across user accounts; let the owning tool create them."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}