{"record":{"id":"4248edcaf3626a46","repo":"OpenNHP/opennhp","slug":"ztdo-data-private-key-and-provider-public-k","errorCode":null,"errorMessage":"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode","messagePattern":"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":79,"sourceCode":"\t\t\t\t} else { // create ztdo\n\t\t\t\t\tif c.String(\"data-source-type\") != \"stream\" {\n\t\t\t\t\t\tif c.String(\"source\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--source is required when --data-source-type is not stream and --ztdo-id is not specified\")\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tif c.String(\"access-url\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--access-url is required when --data-source-type is stream\")\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode\n\t\t\t\tif c.String(\"ztdo\") != \"\" || c.String(\"data-private-key\") != \"\" || c.String(\"provider-public-key\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else if c.String(\"mode\") == \"decrypt\" {\n\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"smart-policy\") != \"\" || c.String(\"access-url\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--source, --smart-policy and --access-url are only allowed in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in encrypt mode\n\t\t\t\tif c.String(\"ztdo\") == \"\" || c.String(\"output\") == \"\" || c.String(\"data-private-key\") == \"\" || c.String(\"provider-public-key\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn nil\n\t\t\t}\n\n\t\t\treturn nil\n\t\t},\n\t\tAction: func(c *cli.Context) error {\n\t\t\tmode := c.String(\"mode\")","sourceCodeStart":61,"sourceCodeEnd":97,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L61-L97","documentation":"The run command's Before hook enforces mode separation: --ztdo, --data-private-key and --provider-public-key are decryption inputs and are rejected when --mode encrypt is selected. This prevents silently mixing encrypt inputs with decrypt credentials.","triggerScenarios":"Running `nhp-device run --mode encrypt ...` while any of --ztdo, --data-private-key, or --provider-public-key is set to a non-empty value.","commonSituations":"A generic wrapper script that always forwards all flags; reusing a decrypt command line and flipping only --mode to encrypt; leftover credentials in an alias or Makefile target.","solutions":["Remove --ztdo, --data-private-key and --provider-public-key from the encrypt invocation","If decryption was intended, change --mode to decrypt and supply the full required decrypt flag set","Split wrapper scripts so encrypt and decrypt paths pass disjoint flag sets"],"exampleFix":"// before\nnhp-device run --mode encrypt --source ./data.csv --smart-policy p.wasm --ztdo ./out.ztdo --data-private-key KEY\n// after\nnhp-device run --mode encrypt --source ./data.csv --smart-policy p.wasm --output ./out.ztdo","handlingStrategy":"validation","validationCode":"if (flags.mode === 'encrypt' && ['ztdo','data-private-key','provider-public-key'].some(f => flags[f])) {\n  throw new Error('decrypt-only flags passed in encrypt mode');\n}","typeGuard":"const hasDecryptCredentials = (flags) => Boolean(flags['ztdo'] || flags['data-private-key'] || flags['provider-public-key']);","tryCatchPattern":null,"preventionTips":["Keep encrypt and decrypt flag sets disjoint in wrapper scripts","Review aliases/Makefile targets for stale decrypt flags","Flip --mode only after pruning the opposite mode's flags"],"tags":["cli","validation","flags"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}