{"record":{"id":"740e421f0c7adc68","repo":"gravitational/teleport","slug":"v-v","errorCode":null,"errorMessage":"%v: %v","messagePattern":"%v: %v","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/touchid/api_darwin.go","lineNumber":437,"sourceCode":"}\n\nfunc (touchIDImpl) DeleteNonInteractive(credentialID string) error {\n\tidC := C.CString(credentialID)\n\tdefer C.free(unsafe.Pointer(idC))\n\n\tswitch res := C.DeleteNonInteractive(idC); res {\n\tcase 0: // aka success\n\t\treturn nil\n\tcase errSecItemNotFound:\n\t\treturn ErrCredentialNotFound\n\tdefault:\n\t\treturn errorFromStatus(\"non-interactive delete\", int(res), \"\" /* msg */)\n\t}\n}\n\nfunc errorFromStatus(prefix string, status int, msg string) error {\n\tif msg != \"\" {\n\t\treturn fmt.Errorf(\"%v: %v\", prefix, msg)\n\t}\n\treturn fmt.Errorf(\"%v: status %d\", prefix, status)\n}\n","sourceCodeStart":419,"sourceCodeEnd":441,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/touchid/api_darwin.go#L419-L441","documentation":"errorFromStatus on macOS wraps a failure from a Security/framework (LocalAuthentication, CryptoTokenKit) call into a Go error. When a human-readable message (msg) is available, it is formatted as \"<prefix>: <msg>\". It is the standard error path for Guard, Register, Authenticate, FindCredentials, ListCredentials and DeleteCredential, so this error is just the wrapper — the real cause is in the msg text.","triggerScenarios":"Any Touch ID operation that returns a non-zero status with an associated error message, e.g. user cancels the Touch ID prompt, biometry is not enrolled, keychain/Secure Enclave key operations fail, or LAContext evaluation fails with a localized error description.","commonSituations":"User cancels or times out the Touch ID dialog; device has no enrolled biometrics; keychain access is denied or the Secure Enclave key was deleted; macOS version incompatibilities in the token APIs.","solutions":["Read the msg portion of the error to identify the underlying macOS failure and address it accordingly.","Prompt the user to retry if the message indicates cancellation (userCanceled is not a real failure).","Direct users to enroll biometrics in System Settings if the message says biometry is not available/enrolled.","Re-register credentials if the error indicates the Secure Enclave credential or key was deleted or inaccessible."],"exampleFix":"// before (treating every wrapped status as fatal)\nif err := api.Register(cc); err != nil { return trace.Wrap(err) }\n// after (handle user cancellation gracefully)\nif err := api.Register(cc); err != nil {\n    if strings.Contains(err.Error(), \"canceled\") { return nil } // user dismissed prompt\n    return trace.Wrap(err)\n}","handlingStrategy":"try-catch","validationCode":"if !IsAvailable() {\n    return errors.New(\"touchid not available on this device; skip Touch ID flows\")\n}","typeGuard":"func isTouchIDUserCancel(err error) bool {\n    return err != nil && strings.Contains(strings.ToLower(err.Error()), \"cancel\")\n}","tryCatchPattern":"err := api.Authenticate(prompt)\nswitch {\ncase err == nil:\n    // success\ncase isTouchIDUserCancel(err):\n    // user dismissed the dialog — not a real failure\ndefault:\n    // inspect the msg text for the underlying macOS failure\n    log.WithError(err).Warn(\"touchid operation failed\")\n}","preventionTips":["Check IsAvailable() and biometric enrollment before invoking Touch ID APIs.","Treat cancellation messages as non-fatal.","Log the full wrapped message; the msg portion identifies the underlying macOS cause."],"tags":["touchid","macos","error-wrapping"],"backgroundTag":"macos-security-framework-error","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}