{"record":{"id":"5224c1583bb146af","repo":"Tencent/WeKnora","slug":"failed-to-generate-ks3-presigned-url-w","errorCode":null,"errorMessage":"failed to generate KS3 presigned URL: %w","messagePattern":"failed to generate KS3 presigned URL: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/ks3.go","lineNumber":288,"sourceCode":"}\n\nfunc (s *ks3FileService) GetFileURL(ctx context.Context, filePath string) (string, error) {\n\t_, objectKey, err := parseKS3FilePath(filePath)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif err := utils.SafeObjectKey(objectKey); err != nil {\n\t\treturn \"\", fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\n\turl, err := s.client.GeneratePresignedUrl(&ks3s3.GeneratePresignedUrlInput{\n\t\tBucket:     ks3aws.String(s.bucketName),\n\t\tKey:        ks3aws.String(objectKey),\n\t\tHTTPMethod: ks3s3.HTTPMethod(\"GET\"),\n\t\tExpires:    int64((24 * time.Hour).Seconds()),\n\t})\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to generate KS3 presigned URL: %w\", err)\n\t}\n\n\treturn url, nil\n}\n","sourceCodeStart":270,"sourceCodeEnd":293,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/ks3.go#L270-L293","documentation":"ks3FileService.GetFileURL wraps GeneratePresignedUrl errors with \"failed to generate KS3 presigned URL: %w\". URL signing is done client-side from the AK/SK, so failures usually mean invalid credentials, unsupported signer configuration, or bad input (expired/zero time, malformed key) — not a network round-trip.","triggerScenarios":"GeneratePresignedUrl returns an error: empty or malformed access/secret keys, signer version incompatible with presigning (V2 config issues), or SDK-side parameter validation failing for the 24h expiry request.","commonSituations":"Placeholder credentials in dev config; secret key containing characters that break V2 signing; KS3 SDK version where presigning requires different config; bucket name with invalid characters.","solutions":["Verify accessKey/secretKey are non-empty and correct; presigning signs locally, so wrong-credential errors surface here rather than at request time.","Check the wrapped error for SDK messages about SignerVersion/expiry; try the SDK's recommended signer version for presigned URLs.","Confirm the bucket and object key characters are URL-signable (no spaces/control chars); re-save the file if the key is malformed.","As a workaround, stream downloads through GetFile instead of presigned URLs while fixing credentials.","Upgrade the ks3sdklib/aws-sdk-go dependency if the error indicates an SDK bug in GeneratePresignedUrl."],"exampleFix":"// before\nclient := ks3s3.New(&ks3aws.Config{Credentials: credentials.NewStaticCredentials(\"\", \"\", \"\")}) // empty creds\n// after\nclient := ks3s3.New(&ks3aws.Config{Credentials: credentials.NewStaticCredentials(ak, sk, \"\"), SignerVersion: \"V2\"})","handlingStrategy":"try-catch","validationCode":"if accessKey == \"\" || secretKey == \"\" {\n\treturn errors.New(\"KS3 credentials not configured\")\n}","typeGuard":null,"tryCatchPattern":"url, err := svc.GetFileURL(ctx, path)\nif err != nil {\n\t// presigning failed (usually credential/config): fall back to\n\t// streaming the file through GetFile behind an authenticated endpoint\n\treturn streamDownload(ctx, path)\n}","preventionTips":["Fail fast at startup when AK/SK are empty (CheckKS3Connectivity)","Keep ks3sdklib/aws-sdk-go updated; match SignerVersion to what your account supports","Avoid exotic characters in object keys (they come from UUIDs by default)"],"tags":["ks3","presigned-url","credentials","aws-sdk","go"],"backgroundTag":"presigned-url-generation-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}