{"record":{"id":"371e004f7203ba4e","repo":"Tencent/WeKnora","slug":"failed-to-generate-presigned-url-w-371e00","errorCode":null,"errorMessage":"failed to generate presigned URL: %w","messagePattern":"failed to generate presigned URL: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/s3.go","lineNumber":365,"sourceCode":"}\n\n// GetFileURL returns a presigned download URL for the file\nfunc (s *s3FileService) GetFileURL(ctx context.Context, filePath string) (string, error) {\n\tobjectName, err := s.parseS3FilePath(filePath)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\t// Create presign client\n\tpresignClient := s3.NewPresignClient(s.client)\n\n\t// Generate presigned URL\n\tpresignedReq, err := presignClient.PresignGetObject(ctx, &s3.GetObjectInput{\n\t\tBucket: aws.String(s.bucketName),\n\t\tKey:    aws.String(objectName),\n\t}, s3.WithPresignExpires(24*time.Hour))\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate presigned URL: %w\", err)\n\t}\n\n\treturn presignedReq.URL, nil\n}\n","sourceCodeStart":347,"sourceCodeEnd":370,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/s3.go#L347-L370","documentation":"GetFileURL wraps errors from the S3 presign client's PresignGetObject call with a 24-hour expiry. Presigning is done locally from credentials, so failures usually mean missing or invalid credentials, an invalid region/endpoint, or an expiry configuration problem — not object existence.","triggerScenarios":"PresignGetObject failing because credentials are not loadable/valid, the region or endpoint is misconfigured, or the presign client could not be constructed (custom endpoint without proper scheme).","commonSituations":"Static credentials empty at startup; region unset in config; custom endpoint proxy lacking https scheme; credential provider (IRSA/instance role) unavailable at presign time.","solutions":["Verify AWS credentials are present and valid (aws sts get-caller-identity with the same env/config)","Confirm region and endpoint configuration for the S3 client used to build the presigner","If using a custom endpoint, ensure it has a valid scheme and is reachable","Unwrap the %w chain to see the credential/signer error and fix accordingly"],"exampleFix":"// before\nurl, err := svc.GetFileURL(ctx, path)\n// after\nurl, err := svc.GetFileURL(ctx, path)\nif err != nil {\n    log.Printf(\"presign failed (check credentials/region): %v\", err)\n    return err\n}","handlingStrategy":"try-catch","validationCode":"// ensure credentials resolvable before presign\nif _, err := cfgProvider.Retrieve(ctx); err != nil {\n    return fmt.Errorf(\"no valid AWS credentials: %w\", err)\n}","typeGuard":null,"tryCatchPattern":"url, err := svc.GetFileURL(ctx, path)\nif err != nil {\n    // fallback: stream the file through the app instead\n    return streamViaGetFile(ctx, path)\n}","preventionTips":["Ensure region and credentials are set in config at startup","Validate custom endpoints have a proper scheme","Add a fallback to streaming via GetFile when presign fails","Keep presign expiry within your credential lifetime"],"tags":["aws","s3","presign","credentials"],"backgroundTag":"s3-presign-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}