{"record":{"id":"5ba0110e5a1ac075","repo":"Tencent/WeKnora","slug":"sandbox-resolve-config-q-missing-workspace-cont","errorCode":null,"errorMessage":"sandbox: resolve config %q: missing workspace context","messagePattern":"sandbox: resolve config %q: missing workspace context","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/tenant_sandbox_resolve.go","lineNumber":98,"sourceCode":"\t\tdisabled, err := policy.WorkspaceScriptsDisabled(ctx, tenantID)\n\t\tif err != nil {\n\t\t\tlogger.Warnf(ctx,\n\t\t\t\t\"[sandbox] failed to read workspace sandbox policy for %d: %v\",\n\t\t\t\ttenantID, err)\n\t\t} else if disabled {\n\t\t\treturn sandbox.NewDisabledManager(), nil\n\t\t}\n\t}\n\n\t// ② No named workspace config means sandbox execution is disabled. There is\n\t// no deployment-level provider fallback anymore.\n\tif configID == \"\" || configID == types.SandboxConfigIDGlobalDefault {\n\t\treturn sandbox.NewDisabledManager(), nil\n\t}\n\n\t// ③ Named config: must not silently fall back to another backend.\n\tif tenantID == 0 {\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"sandbox: resolve config %q: missing workspace context\", configID)\n\t}\n\tif resolver == nil {\n\t\treturn nil, fmt.Errorf(\n\t\t\t\"sandbox: resolve config %q: per-tenant resolver unavailable\", configID)\n\t}\n\tmgr, err := resolver.Resolve(ctx, tenantID, configID)\n\tif err != nil {\n\t\tlogger.Warnf(ctx,\n\t\t\t\"[sandbox] failed to resolve config %q for workspace %d: %v\",\n\t\t\tconfigID, tenantID, err)\n\t\treturn nil, err\n\t}\n\treturn mgr, nil\n}\n","sourceCodeStart":80,"sourceCodeEnd":114,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/tenant_sandbox_resolve.go#L80-L114","documentation":"resolveTenantSandboxForConfig rejects a named config resolution when tenantID is 0, meaning no workspace/tenant context was provided. Named sandbox configs are tenant-scoped, so without a tenant the resolver must refuse rather than silently pick a backend.","triggerScenarios":"Thrown at internal/application/service/tenant_sandbox_resolve.go:98 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the caller passes a valid tenantID (workspace context) when resolving","Check that middleware/context propagation sets the tenant ID","For unscoped paths, resolve without a named config so a disabled manager is returned"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}