{"record":{"id":"683c980a37893b8b","repo":"hasura/graphql-engine","slug":"could-not-read-auth-config","errorCode":null,"errorMessage":"could not read auth config","messagePattern":"could not read auth config","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"v3/crates/engine/bin/engine/main.rs","lineNumber":145,"sourceCode":"    }\n\n    tracing_util::shutdown_tracer();\n}\n\n#[allow(clippy::print_stdout)]\nasync fn start_engine(server: &ServerOptions) -> Result<(), StartupError> {\n    let metadata_resolve_configuration = metadata_resolve::configuration::Configuration {\n        unstable_features: resolve_unstable_features(&server.unstable_features),\n    };\n\n    let expose_internal_errors = if server.expose_internal_errors {\n        ExposeInternalErrors::Expose\n    } else {\n        ExposeInternalErrors::Censor\n    };\n\n    let raw_auth_config =\n        std::fs::read_to_string(&server.authn_config_path).expect(\"could not read auth config\");\n    let opendd_metadata_json =\n        std::fs::read_to_string(&server.metadata_path).expect(\"could not read metadata\");\n\n    let (resolved_metadata, auth_config) = engine::resolve_metadata(\n        &opendd_metadata_json,\n        &raw_auth_config,\n        &metadata_resolve_configuration,\n    )\n    .map_err(StartupError::ReadSchema)?;\n\n    let state = engine::build_state(\n        expose_internal_errors,\n        auth_config,\n        resolved_metadata,\n        server.auth_mode_header.clone(),\n        server.ndc_response_size_limit,\n    )\n    .map_err(StartupError::ReadSchema)?;","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/hasura/graphql-engine/blob/724551b9ae87845594ef0408cff0e50eb6c90dc5/v3/crates/engine/bin/engine/main.rs#L127-L163","documentation":"Thrown by the engine binary's main() when std::fs::read_to_string fails on the authn config file path provided via CLI/server options. It is an expect() panic in the CLI wrapper, meaning the server cannot start without a readable authentication configuration file.","triggerScenarios":"Running the engine binary with --authn-config-path (or equivalent server option) pointing to a nonexistent file, a file without read permission, or a directory; or the path being relative to a different working directory.","commonSituations":"Wrong or misspelled path in container/deployment args, missing file in a Docker image, running from a different cwd so a relative path no longer resolves, or restrictive file permissions on secrets.","solutions":["Verify the path exists and is readable: ls -l <path> and cat it","Use an absolute path or resolve it relative to a known root before passing it to the server","If running in Docker/k8s, confirm the file is mounted/copied into the image at the expected location","Check file permissions (chmod +r) for the user running the engine"],"exampleFix":"// before\nlet raw_auth_config =\n    std::fs::read_to_string(&server.authn_config_path).expect(\"could not read auth config\");\n\n// after (graceful startup error)\nlet raw_auth_config = std::fs::read_to_string(&server.authn_config_path)\n    .map_err(|e| StartupError::ReadAuth(e.into()))?;","handlingStrategy":"validation","validationCode":"let p = &server.authn_config_path;\nif !p.is_file() { eprintln!(\"auth config not found: {}\", p.display()); std::process::exit(1); }\nif let Err(e) = std::fs::metadata(p) { eprintln!(\"cannot stat auth config: {e}\"); std::process::exit(1); }","typeGuard":null,"tryCatchPattern":"Match on io::ErrorKind (NotFound, PermissionDenied) and print the path and OS error, then exit with a clear startup diagnostic instead of panicking.","preventionTips":["Use absolute paths in deployment configs","Add a pre-flight file-existence check in launch scripts","Mount config files read-only into containers at fixed paths"],"tags":["config","auth","filesystem","startup","rust"],"backgroundTag":"config-file-not-found","analyzedSha":"724551b9ae87845594ef0408cff0e50eb6c90dc5","analyzedAt":"2026-08-28T07:32:55.105Z","schemaVersion":2},"datasetVersion":"2026-08-28T11:17:15.048Z"}