{"record":{"id":"6910d295026c3555","repo":"OpenNHP/opennhp","slug":"smart-policy-is-required-in-encrypt-mode","errorCode":null,"errorMessage":"--smart-policy is required in encrypt mode","messagePattern":"--smart-policy is required in encrypt mode","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":74,"sourceCode":"\n\t\t\t\tif c.String(\"ztdo-id\") != \"\" { // update ztdo\n\t\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"output\") != \"\" || c.String(\"metadata\") != \"\" || c.String(\"data-source-type\") != \"\" {\n\t\t\t\t\t\treturn fmt.Errorf(\"--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified\")\n\t\t\t\t\t}\n\t\t\t\t} else { // create ztdo\n\t\t\t\t\tif c.String(\"data-source-type\") != \"stream\" {\n\t\t\t\t\t\tif c.String(\"source\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--source is required when --data-source-type is not stream and --ztdo-id is not specified\")\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tif c.String(\"access-url\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--access-url is required when --data-source-type is stream\")\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode\n\t\t\t\tif c.String(\"ztdo\") != \"\" || c.String(\"data-private-key\") != \"\" || c.String(\"provider-public-key\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else if c.String(\"mode\") == \"decrypt\" {\n\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"smart-policy\") != \"\" || c.String(\"access-url\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--source, --smart-policy and --access-url are only allowed in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in encrypt mode\n\t\t\t\tif c.String(\"ztdo\") == \"\" || c.String(\"output\") == \"\" || c.String(\"data-private-key\") == \"\" || c.String(\"provider-public-key\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --output, --data-private-key and --provider-public-key are required in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\treturn nil\n\t\t\t}","sourceCodeStart":56,"sourceCodeEnd":92,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L56-L92","documentation":"Encrypt mode always requires a wasm smart-policy file that defines how the data is encrypted/policy-enforced. The Before hook checks c.String(\"smart-policy\") and returns this error for every encrypt-mode run (create or update) where the flag is empty.","triggerScenarios":"Any `nhp-device run --mode encrypt ...` invocation that omits --smart-policy, regardless of --ztdo-id or --data-source-type.","commonSituations":"Omitting the flag because decrypt mode does not need it; assuming a default policy exists; path variables expanding to empty in shell scripts.","solutions":["Add --smart-policy <path-to-wasm-policy-file> to the command","Verify the shell variable holding the policy path is non-empty before invoking","If you actually wanted decryption, use --mode decrypt with --ztdo/--data-private-key/--provider-public-key"],"exampleFix":"// before\nnhp-device run --mode encrypt --source ./data.csv --output ./out.ztdo\n// after\nnhp-device run --mode encrypt --source ./data.csv --output ./out.ztdo --smart-policy ./policy.wasm","handlingStrategy":"validation","validationCode":"if (flags.mode === 'encrypt' && !flags['smart-policy']) {\n  throw new Error('--smart-policy wasm file is required in encrypt mode');\n}","typeGuard":"const isEncryptMode = (flags) => flags.mode === 'encrypt';","tryCatchPattern":null,"preventionTips":["Ship the wasm policy alongside deployment artifacts and reference a fixed path","Check the file exists (test -f) before invoking","Remember encrypt always needs --smart-policy; decrypt does not"],"tags":["cli","validation","flags"],"backgroundTag":"missing-required-flag","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}