{"record":{"id":"5458b68779ee4602","repo":"ruvnet/ruflo","slug":"no-secret","errorCode":"NO_SECRET","errorMessage":"HMAC secret required for signed tokens","messagePattern":"HMAC secret required for signed tokens","errorType":"exception","errorClass":"TokenGeneratorError","httpStatus":null,"severity":"error","filePath":"v3/@claude-flow/security/src/token-generator.ts","lineNumber":230,"sourceCode":"      expiresAt: new Date(now.getTime() + expirationMinutes * 60 * 1000),\n      attempts: 0,\n      maxAttempts,\n    };\n  }\n\n  /**\n   * Generates a signed token using HMAC.\n   *\n   * @param payload - Data to include in token\n   * @param expirationSeconds - Token expiration\n   * @returns Signed token\n   */\n  generateSignedToken(\n    payload: Record<string, unknown>,\n    expirationSeconds?: number\n  ): SignedToken {\n    if (!this.config.hmacSecret) {\n      throw new TokenGeneratorError(\n        'HMAC secret required for signed tokens',\n        'NO_SECRET'\n      );\n    }\n\n    const expiration = expirationSeconds ?? this.config.defaultExpiration;\n    const now = new Date();\n    const expiresAt = new Date(now.getTime() + expiration * 1000);\n\n    const tokenData = {\n      ...payload,\n      iat: now.getTime(),\n      exp: expiresAt.getTime(),\n      nonce: this.generate(8),\n    };\n\n    const token = Buffer.from(JSON.stringify(tokenData)).toString('base64url');\n    const signature = this.sign(token);","sourceCodeStart":212,"sourceCodeEnd":248,"githubUrl":"https://github.com/ruvnet/ruflo/blob/fa13ee4ad60ac2090b1480656eb233521790d640/v3/@claude-flow/security/src/token-generator.ts#L212-L248","documentation":"TokenGenerator.generateSignedToken was called with no hmacSecret configured (the constructor defaulted it to empty string). Signed tokens derive their HMAC from that secret; without it a forged 'signature' would be meaningless, so the operation is refused with NO_SECRET.","triggerScenarios":"Thrown at v3/@claude-flow/security/src/token-generator.ts:230 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Provide an HMAC secret in the token generator configuration.","Use unsigned tokens only in contexts where integrity is not required."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fa13ee4ad60ac2090b1480656eb233521790d640","analyzedAt":"2026-08-18T21:34:22.708Z","contentChangedAt":"2026-08-18T21:34:22.708Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}