{"record":{"id":"282f9ff639c6c330","repo":"JuliusBrussee/caveman","slug":"production-kms-configuration-w","errorCode":null,"errorMessage":"production KMS configuration: %w","messagePattern":"production KMS configuration: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"shared/platform/env/env.go","lineNumber":74,"sourceCode":"// refusals and silently skip the rest. Whitespace and case are therefore folded\n// in — the direction that turns MORE deployments on, never fewer.\nfunc IsProduction() bool {\n\treturn runtimeenv.IsProduction()\n}\n\nfunc RefuseProductionDefaults() error {\n\tif !IsProduction() {\n\t\treturn nil\n\t}\n\tif err := validateProductionTextSecrets([]string{\n\t\t\"CAVE_KEY_HASH_PEPPER\",\n\t\t\"CAVE_JWT_SIGNING_KEY\",\n\t\t\"CAVE_BOOTSTRAP_TOKEN\",\n\t}); err != nil {\n\t\treturn err\n\t}\n\tif err := kms.ValidateProduction(); err != nil {\n\t\treturn fmt.Errorf(\"production KMS configuration: %w\", err)\n\t}\n\treturn validateProductionPublicURL()\n}\n\n// RefuseGatewayProductionDefaults validates only material the public data plane\n// consumes. Control-plane JWT/bootstrap secrets must never be injected into the\n// gateway merely to satisfy a shared configuration check.\nfunc RefuseGatewayProductionDefaults() error {\n\tif !IsProduction() {\n\t\treturn nil\n\t}\n\tif err := validateProductionTextSecrets([]string{\"CAVE_KEY_HASH_PEPPER\"}); err != nil {\n\t\treturn err\n\t}\n\tif Bool(\"CAVE_REPLAY_ENABLED\", false) {\n\t\tif err := validateProductionTextSecrets([]string{\"CAVE_ROUTER_REPLAY_TOKEN\"}); err != nil {\n\t\t\treturn err\n\t\t}","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/env/env.go#L56-L92","documentation":"Thrown by RefuseProductionDefaults in shared/platform/env/env.go:74 when the process is in production mode and kms.ValidateProduction() rejects the KMS configuration. It is a wrapper: the 'production KMS configuration:' prefix adds context to the underlying KMS error, which names the actual defect. This is one of the boot-time refusal gates - in production the process exits rather than run on default KMS settings.","triggerScenarios":"IsProduction() is true (CAVE_ENV folded to prod) and the KMS setup fails its own production validation - typically default/placeholder KMS values, a missing key reference, or a dev-local KMS emulator setting left in place. The text-secret checks for CAVE_KEY_HASH_PEPPER, CAVE_JWT_SIGNING_KEY, and CAVE_BOOTSTRAP_TOKEN run first; only after they pass does the KMS check fire.","commonSituations":"Deploying to prod with the local/dev KMS defaults still in the env; adding KMS-backed encryption to a stack whose deployment templates never gained the KMS variables; renaming KMS env vars in the library without updating the manifest.","solutions":["Read the wrapped error text after the colon - it states the precise KMS defect; fix that (key id, credentials, or endpoint) first.","Provide the production KMS configuration (key reference and auth) as specified by the kms package's ValidateProduction.","Audit the deployed env for leftover dev/local KMS values and remove emulator settings.","Re-run the binary/deploy; the gate passes once kms.ValidateProduction returns nil."],"exampleFix":"# before\nCAVE_ENV=prod\nKMS_PROVIDER=   # unset -> default\n\n# after\nCAVE_ENV=prod\nKMS_PROVIDER=cloud\nKMS_KEY_ID=projects/p/locations/eu/keyRings/cave/cryptoKeys/pepper","handlingStrategy":"try-catch","validationCode":"// pre-deploy: run the same gates CI runs\nif err := env.RefuseProductionDefaults(); err != nil {\n    return fmt.Errorf(\"deploy blocked: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"if err := env.RefuseProductionDefaults(); err != nil {\n    log.Fatalf(\"production config refused: %v\", err) // read the wrapped KMS error after the colon\n}","preventionTips":["Execute RefuseProductionDefaults against prod env in CI before any rollout.","Keep a dedicated prod env manifest with KMS values, reviewed like code.","Treat any 'production KMS configuration:' failure as a deploy blocker, never a warning."],"tags":["go","production","kms","config","security"],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}