{"record":{"id":"64868b7e5f27601c","repo":"Hmbown/CodeWhale","slug":"managed-external-credential-access-is-unsupported-64868b","errorCode":null,"errorMessage":"managed external credential access is unsupported for {}; no schema-safe preservation adapter is available","messagePattern":"managed external credential access is unsupported for (.+?); no schema-safe preservation adapter is available","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/config/src/external_credentials.rs","lineNumber":408,"sourceCode":"    /// Validate that this record is a current read-only consent for one exact\n    /// provider/source/path tuple without minting an I/O capability.\n    ///\n    /// This is intentionally side-effect free so inventory and picker surfaces\n    /// can acknowledge dormant consent without inspecting the external file.\n    pub fn validate_read_scope(\n        &self,\n        provider: ProviderKind,\n        source: ExternalCredentialSource,\n        resolved_path: &Path,\n    ) -> Result<()> {\n        if self.access == ExternalCredentialAccess::Disabled {\n            bail!(\n                \"external credential access is disabled for {}\",\n                provider.as_str()\n            );\n        }\n        if self.access == ExternalCredentialAccess::Managed {\n            bail!(\n                \"managed external credential access is unsupported for {}; no schema-safe preservation adapter is available\",\n                provider.as_str()\n            );\n        }\n        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {\n            bail!(\n                \"external credential consent for {} uses unsupported version {}; revoke and consent again\",\n                provider.as_str(),\n                self.consent_version\n            );\n        }\n        if self.provider != provider.as_str() {\n            bail!(\n                \"external credential consent is scoped to provider {:?}, not {}\",\n                self.provider,\n                provider.as_str()\n            );\n        }","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/config/src/external_credentials.rs#L390-L426","documentation":"The external-credential access model has three levels (disabled/read-only/managed) but only read-only is implemented for validate_read_scope(); a consent with access = \"managed\" bails with this message because no schema-safe preservation adapter exists yet to write back into the external store. It is an explicit not-implemented guard, not a policy denial.","triggerScenarios":"A consent record carries access = \"managed\" (hand-edited config, forward-versioned file, or experimental tooling) and validate_read_scope() is called for that provider.","commonSituations":"Users hand-editing config to 'upgrade' a consent to managed; docs or examples that mention managed mode before it shipped; config files copied from a newer Codewhale that supports managed access.","solutions":["Re-create the consent with read-only access, the only supported mode","Remove the external-credential consent and use a different auth source until managed mode ships"],"exampleFix":"# before\n[[external_credentials]]\naccess = \"managed\"\n\n# after\n[[external_credentials]]\naccess = \"read_only\"","handlingStrategy":"validation","validationCode":"if consent.access == ExternalCredentialAccess::Managed {\n    // unsupported today: reject at UI/entry time with a clear message\n    return Err(anyhow!(\"managed access not implemented; use read_only\"));\n}","typeGuard":"fn supported_access(access: ExternalCredentialAccess) -> bool {\n    matches!(access, ExternalCredentialAccess::ReadOnly)\n}","tryCatchPattern":"match consent.validate_read_scope(provider, source, &path) {\n    Ok(()) => read_external_credential(&path),\n    Err(e) if e.to_string().contains(\"no schema-safe preservation adapter\") => {\n        downgrade_to_read_only_consent(provider) // re-consent read-only\n    }\n    Err(e) => Err(e),\n}","preventionTips":["Only create read_only consents with current tooling","Do not hand-edit access fields to unshipped modes","Re-create consents after downgrading from a newer Codewhale"],"tags":["security","consent","credentials","not-implemented"],"backgroundTag":"unsupported-access-mode","analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","schemaVersion":2},"datasetVersion":"2026-08-21T18:17:14.833Z"}