{"record":{"id":"342ae2dda938c2cf","repo":"tinyhumansai/openhuman","slug":"encryption-failed-e","errorCode":null,"errorMessage":"Encryption failed: {e}","messagePattern":"Encryption failed: (.+?)","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/openhuman/security/keyring/encrypted_store.rs","lineNumber":84,"sourceCode":"        }\n    }\n\n    /// Encrypt a plaintext secret. Returns hex-encoded ciphertext prefixed with `enc2:`.\n    /// Format: `enc2:<hex(nonce ‖ ciphertext ‖ tag)>` (12 + N + 16 bytes).\n    /// If encryption is disabled, returns the plaintext as-is.\n    pub fn encrypt(&self, plaintext: &str) -> Result<String> {\n        if !self.enabled || plaintext.is_empty() {\n            return Ok(plaintext.to_string());\n        }\n\n        let key_bytes = self.load_or_create_key()?;\n        let key = Key::from_slice(&key_bytes);\n        let cipher = ChaCha20Poly1305::new(key);\n\n        let nonce = ChaCha20Poly1305::generate_nonce(&mut OsRng);\n        let ciphertext = cipher\n            .encrypt(&nonce, plaintext.as_bytes())\n            .map_err(|e| anyhow::anyhow!(\"Encryption failed: {e}\"))?;\n\n        // Prepend nonce to ciphertext for storage\n        let mut blob = Vec::with_capacity(NONCE_LEN + ciphertext.len());\n        blob.extend_from_slice(&nonce);\n        blob.extend_from_slice(&ciphertext);\n\n        Ok(format!(\"enc2:{}\", hex_encode(&blob)))\n    }\n\n    /// Decrypt a secret.\n    /// - `enc2:` prefix → ChaCha20-Poly1305 (current format)\n    /// - `enc:` prefix → legacy XOR cipher (backward compatibility for migration)\n    /// - No prefix → returned as-is (plaintext config)\n    ///\n    /// **Warning**: Legacy `enc:` values are insecure. Use `decrypt_and_migrate` to\n    /// automatically upgrade them to the secure `enc2:` format.\n    pub fn decrypt(&self, value: &str) -> Result<String> {\n        if let Some(hex_str) = value.strip_prefix(\"enc2:\") {","sourceCodeStart":66,"sourceCodeEnd":102,"githubUrl":"https://github.com/tinyhumansai/openhuman/blob/749120085864ce16e0f273c7b86fac7740b39c5b/src/openhuman/security/keyring/encrypted_store.rs#L66-L102","documentation":"Error \"Encryption failed: {e}\" thrown in tinyhumansai/openhuman.","triggerScenarios":"Thrown at src/openhuman/security/keyring/encrypted_store.rs:84 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check `{e}` for whether key load or sealing failed","Verify the master key file/keychain entry is intact and 32 bytes","Regenerate the master key only with a migration plan (existing data becomes undecryptable)","Check that encryption is intentionally enabled for this environment"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"749120085864ce16e0f273c7b86fac7740b39c5b","analyzedAt":"2026-08-17T21:21:45.363Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}