{"record":{"id":"25e90eae63fcb262","repo":"astrid-runtime/astrid","slug":"windows-returned-an-invalid-current-user-sid","errorCode":null,"errorMessage":"Windows returned an invalid current-user SID","messagePattern":"Windows returned an invalid current-user SID","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-core/src/platform_fs/windows/acl.rs","lineNumber":181,"sourceCode":"                token.0,\n                TokenUser,\n                token_info.as_mut_ptr().cast::<c_void>(),\n                length,\n                &raw mut length,\n            )\n        } == 0\n        {\n            return Err(io::Error::last_os_error());\n        }\n\n        let result = Self {\n            _token: token,\n            token_info,\n        };\n        // SAFETY: `as_ptr` points into the initialized TOKEN_USER buffer owned\n        // by `result`.\n        if unsafe { IsValidSid(result.as_ptr()) } == 0 {\n            return Err(io::Error::new(\n                io::ErrorKind::InvalidData,\n                \"Windows returned an invalid current-user SID\",\n            ));\n        }\n        Ok(result)\n    }\n\n    pub(super) fn as_ptr(&self) -> PSID {\n        let token_user = self.token_info.as_ptr().cast::<TOKEN_USER>();\n        // SAFETY: `token_info` was filled by `GetTokenInformation(TokenUser)`,\n        // is aligned as `usize`, and lives for the returned SID pointer.\n        unsafe { (*token_user).User.Sid }\n    }\n}\n\n#[repr(align(4))]\npub(super) struct SidBytes([u8; SECURITY_MAX_SID_SIZE as usize]);\n","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-core/src/platform_fs/windows/acl.rs#L163-L199","documentation":"astrid-core resolves the current process token to build a SID identifying the current user, which it uses to construct and validate private-file ACLs on Windows. Before using the TOKEN_USER buffer, it calls Win32 IsValidSid; if the OS returned a SID that fails that check, it raises io::ErrorKind::InvalidData with this message. This is a defensive guard against a corrupt or unexpected token response, not a user-code mistake.","triggerScenarios":"Calling any private-path API (e.g. private_temp, private lock acquisition, guarded file creation) on Windows triggers RequiredSids/CurrentUserSid::get(); the error fires only when OpenProcessToken/GetTokenInformation succeeded but IsValidSid rejects the returned TokenUser SID pointer.","commonSituations":"Corrupted process token state, security-software or token-manipulation tools interfering with the process token, running inside unusual sandboxes/job objects that mangle token information, or OS-level bugs. Extremely rare in normal operation.","solutions":["Restart the offending process to obtain a fresh, healthy process token.","Check for security software, hooking DLLs, or job/sandbox configuration that tampers with the process token; exclude the process or disable token manipulation.","Verify the process is running as an authenticated interactive/service identity, not a stripped token; run under a normal user account.","File a bug with the library maintainers including the Windows version if the error persists on a stock system."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match CurrentUserSid::get() {\n    Ok(sid) => { /* proceed */ }\n    Err(e) if e.kind() == io::ErrorKind::InvalidData\n        && e.to_string().contains(\"invalid current-user SID\") => {\n        // token corruption: restart process / alert operator\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Run the process under a normal authenticated account without token-manipulation tooling.","Avoid security software or sandboxes that hook token APIs for this process.","Treat this error as environmental: log it with OS/token context for diagnosis."],"tags":["windows","security","sid","io-error"],"backgroundTag":"invalid-token-sid","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}