{"record":{"id":"54f205f9bc407d69","repo":"hcengineering/platform","slug":"server-secret-not-set-hulylake-storage-adapter-in","errorCode":null,"errorMessage":"Server secret not set, hulylake storage adapter initialized with default secret","messagePattern":"Server secret not set, hulylake storage adapter initialized with default secret","errorType":"console","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"foundations/server/packages/hulylake/src/index.ts","lineNumber":78,"sourceCode":"  retryCount?: number\n  retryInterval?: number\n}\n\n/**\n * @public\n */\nexport class HulylakeService implements StorageAdapter {\n  private readonly client: HulylakeClient\n  private readonly retryCount: number\n  private readonly retryInterval: number\n\n  constructor (\n    readonly cfg: HulylakeConfig,\n    readonly options: HulylakeClientOptions = {}\n  ) {\n    const secret = getMetadata(serverToken.metadata.Secret)\n    if (secret === undefined) {\n      console.warn('Server secret not set, hulylake storage adapter initialized with default secret')\n    }\n    const token = generateToken(systemAccountUuid, undefined)\n    this.client = createHulylakeClient(cfg, token)\n    this.retryCount = options.retryCount ?? 5\n    this.retryInterval = options.retryInterval ?? 50\n  }\n\n  async initialize (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {}\n\n  async close (): Promise<void> {}\n\n  async exists (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<boolean> {\n    // workspace/buckets not supported, assume that always exist\n    return true\n  }\n\n  @withContext('make')\n  async make (ctx: MeasureContext, wsIds: WorkspaceIds): Promise<void> {","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/server/packages/hulylake/src/index.ts#L60-L96","documentation":"The Hulylake storage adapter constructor checks the server secret in server token metadata; if undefined it warns that tokens will be generated with a default secret. Like the datalake adapter, this weakens token signing security and can cause authentication mismatches against the storage backend.","triggerScenarios":"Constructing the Hulylake storage adapter in a process where the server secret (serverToken.metadata.Secret) is not configured in the environment.","commonSituations":"Missing SERVER_SECRET in deployment env; local dev setup without secrets file; Kubernetes secret not mounted; renamed env var across versions.","solutions":["Set the server secret env/config value before initializing the hulylake adapter","Restart the service so the new secret is picked up in token metadata","Add a fail-fast startup assertion for the secret in production environments","Rotate/reissue any tokens created under the default secret"],"exampleFix":"// before (k8s container spec)\nenv: []\n// after\nenv:\n  - name: SERVER_SECRET\n    valueFrom:\n      secretKeyRef: { name: hcserver, key: secret }","handlingStrategy":"validation","validationCode":"if (process.env.SERVER_SECRET === undefined) {\n  throw new Error('SERVER_SECRET must be set before initializing hulylake adapter')\n}","typeGuard":"function hasServerSecret(meta: { Secret?: string }): meta is { Secret: string } {\n  return typeof meta.Secret === 'string' && meta.Secret.length > 0\n}","tryCatchPattern":"try {\n  const adapter = new HulylakeStorageAdapter(cfg)\n  if (adapter.initializedWithDefaultSecret) logger.error('hulylake using default secret — refusing in production')\n} catch (err) {\n  logger.error('hulylake init failed', { err })\n  process.exit(1)\n}","preventionTips":["Fail fast at boot if the server secret is unset in production","Mount the secret via your platform's secret manager","Keep datalake and hulylake deployments sharing the same secret configuration checks","Rotate credentials after any period running on the default secret"],"tags":["security","configuration","hulylake"],"backgroundTag":"missing-server-secret","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}