{"record":{"id":"2aa174ab7e087aa3","repo":"larksuite/cli","slug":"environment-variable-q-is-not-allowlisted-in-prov","errorCode":null,"errorMessage":"environment variable %q is not allowlisted in provider","messagePattern":"environment variable %q is not allowlisted in provider","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve.go","lineNumber":95,"sourceCode":"\t\treturn resolveExecRef(ref, providerName, providerConfig, getenv)\n\tdefault:\n\t\treturn \"\", fmt.Errorf(\"unsupported secret source %q\", ref.Source)\n\t}\n}\n\n// resolveEnvRef handles {source:\"env\"} SecretRef.\nfunc resolveEnvRef(ref *SecretRef, pc *ProviderConfig, getenv func(string) string) (string, error) {\n\t// Check allowlist if configured\n\tif len(pc.Allowlist) > 0 {\n\t\tallowed := false\n\t\tfor _, name := range pc.Allowlist {\n\t\t\tif name == ref.ID {\n\t\t\t\tallowed = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif !allowed {\n\t\t\treturn \"\", fmt.Errorf(\"environment variable %q is not allowlisted in provider\", ref.ID)\n\t\t}\n\t}\n\n\tvalue := getenv(ref.ID)\n\tif value == \"\" {\n\t\treturn \"\", fmt.Errorf(\"environment variable %q is missing or empty\", ref.ID)\n\t}\n\treturn value, nil\n}\n","sourceCodeStart":77,"sourceCodeEnd":105,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve.go#L77-L105","documentation":"resolveEnvRef resolves a secret reference from an environment variable, but only if that variable name appears in the provider's allowlist (pc.EnvKeys or equivalent). The library throws this error when the referenced variable is not present in the allowlist, even if the variable is actually set, to enforce explicit disclosure of which env vars a provider may read. This prevents accidental leakage of unrelated secrets into secret resolution.","triggerScenarios":"Calling resolveSecretRef with a SecretRef whose ID names an environment variable that is not listed in the provider config's allowlisted env keys; the allowlist loop iterates all names and `allowed` stays false.","commonSituations":"Typo in the env var name inside the secret ref (e.g. DB_PASS vs DB_PASSWORD); adding a new env var to the environment but forgetting to add it to the provider's allowlist in config; copying a secret ref between providers with different allowlists.","solutions":["Add the environment variable name to the provider's allowlist (the env-keys field in the provider config) using the exact name in ref.ID","Fix the SecretRef ID so it matches an already-allowlisted variable name","Verify the provider config file you intend is actually being loaded (a stale config may have an outdated allowlist)"],"exampleFix":"// before\nprovider:\n  env-keys: [\"API_KEY\"]\nref: env:DB_PASSWORD\n\n// after\nprovider:\n  env-keys: [\"API_KEY\", \"DB_PASSWORD\"]\nref: env:DB_PASSWORD","handlingStrategy":"validation","validationCode":"// before resolving, confirm the ref's env var is allowlisted\nfunc isEnvAllowlisted(providerCfg ProviderConfig, refID string) bool {\n    for _, k := range providerCfg.EnvKeys {\n        if k == refID {\n            return true\n        }\n    }\n    return false\n}\nif !isEnvAllowlisted(cfg, ref.ID) {\n    return fmt.Errorf(\"env var %q must be added to provider %q allowlist\", ref.ID, cfg.Name)\n}","typeGuard":null,"tryCatchPattern":"val, err := resolveSecretRef(ctx, ref)\nif err != nil {\n    var notAllowed *NotAllowlistedError\n    if errors.As(err, &notAllowed) {\n        log.Fatalf(\"add %q to the provider's env allowlist in config\", notAllowed.Var)\n    }\n    return err\n}","preventionTips":["Keep the provider's env allowlist and your .env file in sync — add new vars to both in the same change","Use exact-name linting or a startup check that diffs SecretRef IDs against the allowlist","Avoid copying refs between providers with different allowlists without re-checking"],"tags":["secrets","configuration","env"],"backgroundTag":"env-var-not-allowlisted","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}