{"record":{"id":"4c942c7afddf31be","repo":"astrid-runtime/astrid","slug":"fskit-lease-callback-token-is-invalid","errorCode":null,"errorMessage":"FSKit lease callback token is invalid","messagePattern":"FSKit lease callback token is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/astrid-storage-provider-fskit/src/service.rs","lineNumber":144,"sourceCode":"    }\n    validate_launch_parent(&launch.parent)?;\n    validate_lease(&launch.lease)?;\n    crate::validate_mountpoint_layout(&launch.mountpoint)?;\n    if launch.mountpoint == launch.lease.resource_path\n        || launch.mountpoint.starts_with(&launch.lease.resource_path)\n        || launch.lease.resource_path.starts_with(&launch.mountpoint)\n    {\n        bail!(\"FSKit service mountpoint overlaps the lease resource\");\n    }\n    crate::validate_mountpoint_ancestors(&launch.mountpoint)?;\n    crate::validate_unmounted_mountpoint(&launch.mountpoint)?;\n    validate_control_path(&launch.control_path, &launch.lease.resource_path)?;\n    Ok(())\n}\n\nfn validate_lease(lease: &astrid_core::storage_filesystem::StorageMountLeaseV1) -> Result<()> {\n    if lease.lease_token.len() < 16 || lease.lease_token.len() > 4096 {\n        bail!(\"FSKit lease callback token is invalid\");\n    }\n    let now = SystemTime::now()\n        .duration_since(UNIX_EPOCH)\n        .context(\"read system clock\")?\n        .as_secs();\n    if lease.expires_at_epoch_secs < now {\n        bail!(\"FSKit lease is expired\");\n    }\n    if !lease.resource_path.is_absolute() || !lease.callback_path.is_absolute() {\n        bail!(\"FSKit lease paths must be absolute\");\n    }\n    #[cfg(target_os = \"macos\")]\n    astrid_core::fskit_socket::validate_callback_path(lease.mount_id, &lease.callback_path)\n        .map_err(anyhow::Error::msg)?;\n    #[cfg(not(target_os = \"macos\"))]\n    if lease.callback_path != lease.resource_path.join(\"control.sock\") {\n        bail!(\"FSKit callback path is not the kernel lease endpoint\");\n    }","sourceCodeStart":126,"sourceCodeEnd":162,"githubUrl":"https://github.com/astrid-runtime/astrid/blob/affd8760f44190dbdfbec23403f4c4b642c33112/crates/astrid-storage-provider-fskit/src/service.rs#L126-L162","documentation":"validate_lease checks that the StorageMountLeaseV1 lease_token is between 16 and 4096 bytes long. A token outside this range cannot be a valid kernel-issued callback token, so launch is rejected. This bounds the token to a sane size for storage and transmission.","triggerScenarios":"validate_lease (via validate_launch or live_managed_callback_lease_is_accepted) receives a lease whose lease_token is shorter than 16 chars or longer than 4096 chars, e.g. an empty, placeholder, or oversized token.","commonSituations":"Hand-constructed lease JSON in tests with a dummy short token; config where the token field was left empty; a truncated or corrupted lease file; older clients emitting tokens in a different format.","solutions":["Obtain the lease token from the real kernel/provider issuance path instead of hand-crafting it","Ensure the token string is 16-4096 characters and re-issue the lease if it was truncated","Re-read lease.json from the resource_path to get the admitted token and use that verbatim"],"exampleFix":"// before\n\"lease_token\": \"abc\"\n// after\n\"lease_token\": \"<kernel-issued token, 16..=4096 chars>\"","handlingStrategy":"validation","validationCode":"fn token_ok(lease: &StorageMountLeaseV1) -> bool {\n    (16..=4096).contains(&lease.lease_token.len())\n}","typeGuard":null,"tryCatchPattern":"match validate_lease(&lease) {\n    Err(e) if e.to_string().contains(\"callback token is invalid\") => reissue_lease(),\n    Err(e) => return Err(e),\n    Ok(()) => {}\n}","preventionTips":["Always obtain tokens from the kernel issuance path, never hand-write them","Check token length before persisting or transmitting leases","Watch for truncation when serializing leases through logs or env vars"],"tags":["fskit","lease","validation","token"],"backgroundTag":"invalid-argument-value","analyzedSha":"affd8760f44190dbdfbec23403f4c4b642c33112","analyzedAt":"2026-09-09T21:28:12.402Z","contentChangedAt":"2026-09-09T21:28:12.402Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}