{"record":{"id":"2a2a7d6f2c3c8e3f","repo":"iflytek/astron-agent","slug":"tenant-internal-authentication-is-not-configured","errorCode":null,"errorMessage":"Tenant internal authentication is not configured; verification was not sent","messagePattern":"Tenant internal authentication is not configured; verification was not sent","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java","lineNumber":59,"sourceCode":"        this.httpClient = httpClient;\n        this.verifyAppAuthUrl = verifyAppAuthUrl;\n        this.tenantInternalKey = tenantInternalKey;\n    }\n\n    @Override\n    public Optional<String> verify(String apiKey, String apiSecret) {\n        if (!StringUtils.hasText(verifyAppAuthUrl)\n                || !StringUtils.hasText(apiKey)\n                || !StringUtils.hasText(apiSecret)) {\n            log.warn(\"Tenant application credential verification is not configured or incomplete\");\n            return Optional.empty();\n        }\n        String configuredInternalKey;\n        try {\n            configuredInternalKey =\n                    TenantInternalApiKey.requireConfigured(tenantInternalKey);\n        } catch (IllegalStateException exception) {\n            log.warn(\"Tenant internal authentication is not configured; verification was not sent\");\n            return Optional.empty();\n        }\n\n        JSONObject requestBody = new JSONObject();\n        requestBody.put(\"api_key\", apiKey);\n        requestBody.put(\"api_secret\", apiSecret);\n\n        Request request = new Request.Builder()\n                .url(verifyAppAuthUrl)\n                .header(TenantInternalApiKey.HEADER, configuredInternalKey)\n                .post(RequestBody.create(requestBody.toJSONString(), JSON_MEDIA_TYPE))\n                .build();\n\n        try (Response response = httpClient.newCall(request).execute()) {\n            if (!response.isSuccessful()) {\n                log.warn(\"tenant verify app auth request failed, status={}\", response.code());\n                return Optional.empty();\n            }","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java#L41-L77","documentation":"Within verify(), TenantInternalApiKey.requireConfigured(tenantInternalKey) throws IllegalStateException when the internal shared key used to authenticate the console to the tenant service is not configured. The catch block logs \"Tenant internal authentication is not configured; verification was not sent\" and returns Optional.empty() — the verification HTTP request is never sent.","triggerScenarios":"verify() called with valid verifyAppAuthUrl/apiKey/apiSecret but the tenantInternalKey field (internal header key) is null/blank, so requireConfigured throws.","commonSituations":"Internal key property missing from application.yml/env after deployment; secret not mounted in k8s; key removed during config migration; wrong property name so the field never gets injected.","solutions":["Configure the tenant internal API key property/env var and restart the console backend.","Verify the secret is actually mounted/injected (kubectl describe pod, env dump) in the deployment.","Check that TenantInternalApiKey.requireConfigured's expected property name matches the configured key.","Confirm the header name constant and key format expected by the tenant service."],"exampleFix":"# before\n# (internal key absent)\n# after\ntenant:\n  gateway:\n    internal-api-key: ${TENANT_INTERNAL_API_KEY}","handlingStrategy":"validation","validationCode":"// startup check\nTenantInternalApiKey.requireConfigured(tenantInternalKey); // throws early at boot if blank","typeGuard":null,"tryCatchPattern":"Optional<String> appId = authClient.verify(apiKey, apiSecret);\nif (appId.isEmpty()) {\n    auditLog.warn(\"verification not performed — check tenant internal key configuration\");\n    return unauthorized();\n}","preventionTips":["Inject the internal key as a k8s secret and mount it explicitly.","Call requireConfigured during application startup, not per-request.","Add the key to deployment checklists and config schema validation.","Rotate console/tenant keys together to avoid drift."],"tags":["configuration","internal-auth","api-key","tenant-gateway"],"backgroundTag":"missing-api-key","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}