{"record":{"id":"54d3c3df4dfb487d","repo":"JuliusBrussee/caveman","slug":"envelope-object-kind-is-required","errorCode":null,"errorMessage":"envelope: object kind is required","messagePattern":"envelope: object kind is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":176,"sourceCode":"\t\treturn nil, fmt.Errorf(\"envelope: ciphertext too short\")\n\t}\n\tnonce, ct := ciphertext[:ns], ciphertext[ns:]\n\tplaintext, err := gcm.Open(nil, nonce, ct, aad)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: open: %w\", err)\n\t}\n\treturn plaintext, nil\n}\n\nfunc scopeAAD(scope Scope) ([]byte, string, error) {\n\tscope.OrganizationID = strings.TrimSpace(scope.OrganizationID)\n\tscope.ProjectID = strings.TrimSpace(scope.ProjectID)\n\tscope.Kind = strings.TrimSpace(scope.Kind)\n\tif scope.OrganizationID == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: organization scope is required\")\n\t}\n\tif scope.Kind == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: object kind is required\")\n\t}\n\taad, err := json.Marshal(struct {\n\t\tVersion        int    `json:\"version\"`\n\t\tOrganizationID string `json:\"organization_id\"`\n\t\tProjectID      string `json:\"project_id\"`\n\t\tKind           string `json:\"kind\"`\n\t}{2, scope.OrganizationID, scope.ProjectID, scope.Kind})\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: encode scope: %w\", err)\n\t}\n\tsum := sha256.Sum256(aad)\n\treturn aad, hex.EncodeToString(sum[:]), nil\n}\n","sourceCodeStart":158,"sourceCodeEnd":190,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L158-L190","documentation":"Validation guard in scopeAAD(): Scope.Kind is empty after trimming. The kind (object type) is part of the additional authenticated data binding ciphertext to a logical object type, so sealing or opening without it is rejected.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:176 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set Scope.Kind to the logical object kind being sealed/opened before calling the scope-aware envelope APIs","Validate the scope struct at the call site so missing kinds never reach the envelope"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}