{"record":{"id":"7282d4c00de231d9","repo":"zeroclaw-labs/zeroclaw","slug":"microsoft365-token-cache-encrypted-is-enabled-but","errorCode":null,"errorMessage":"microsoft365: token_cache_encrypted is enabled but encryption is not yet implemented; refusing to store tokens in plaintext. Set token_cache_encrypted to false or wait for encryption support.","messagePattern":"microsoft365: token_cache_encrypted is enabled but encryption is not yet implemented; refusing to store tokens in plaintext\\. Set token_cache_encrypted to false or wait for encryption support\\.","errorType":"validation","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/zeroclaw-tools/src/microsoft365/auth.rs","lineNumber":42,"sourceCode":"}\n\n/// Thread-safe token cache with disk persistence.\npub struct TokenCache {\n    inner: RwLock<Option<CachedTokenState>>,\n    /// Serialises the slow acquire/refresh path so only one caller performs the\n    /// network round-trip while others wait and then read the updated cache.\n    acquire_lock: Mutex<()>,\n    config: super::types::Microsoft365ResolvedConfig,\n    cache_path: PathBuf,\n}\n\nimpl TokenCache {\n    pub fn new(\n        config: super::types::Microsoft365ResolvedConfig,\n        zeroclaw_dir: &std::path::Path,\n    ) -> anyhow::Result<Self> {\n        if config.token_cache_encrypted {\n            anyhow::bail!(\n                \"microsoft365: token_cache_encrypted is enabled but encryption is not yet \\\n                 implemented; refusing to store tokens in plaintext. Set token_cache_encrypted \\\n                 to false or wait for encryption support.\"\n            );\n        }\n\n        // Scope cache file to (tenant_id, client_id, auth_flow) so config\n        // changes never reuse tokens from a different account/flow.\n        let mut hasher = DefaultHasher::new();\n        config.tenant_id.hash(&mut hasher);\n        config.client_id.hash(&mut hasher);\n        config.auth_flow.hash(&mut hasher);\n        let fingerprint = format!(\"{:016x}\", hasher.finish());\n\n        let cache_path = zeroclaw_dir.join(format!(\"ms365_token_cache_{fingerprint}.json\"));\n        let cached = Self::load_from_disk(&cache_path);\n        Ok(Self {\n            inner: RwLock::new(cached),","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/zeroclaw-labs/zeroclaw/blob/88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc/crates/zeroclaw-tools/src/microsoft365/auth.rs#L24-L60","documentation":"Error \"microsoft365: token_cache_encrypted is enabled but encryption is not yet implemented; refusing to store tokens in plaintext. Set token_cache_encrypted to false or wait for encryption support.\" thrown in zeroclaw-labs/zeroclaw.","triggerScenarios":"Thrown at crates/zeroclaw-tools/src/microsoft365/auth.rs:42 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set token_cache_encrypted to false, or wait for encryption support before enabling it."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88bb9c8533fc57ed7a03e36ca7c9ed2bf8336dcc","analyzedAt":"2026-08-23T01:07:41.857Z","schemaVersion":2},"datasetVersion":"2026-08-23T08:06:27.607Z"}