{"record":{"id":"808aa3df4e722f6f","repo":"nautechsystems/nautilus_trader","slug":"payload-protection-requires-an-active-payload-key","errorCode":null,"errorMessage":"Payload protection requires an active payload key","messagePattern":"Payload protection requires an active payload key","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"crates/adapters/blockchain/src/execution/client.rs","lineNumber":881,"sourceCode":"            .await\n            .map(Into::into)\n    }\n\n    /// Activates or resumes protected signed-transaction storage for this execution database.\n    ///\n    /// Run this while the execution client is disconnected. A full payload check must succeed\n    /// before a later execution connection is permitted.\n    ///\n    /// # Errors\n    ///\n    /// Returns an error if the client is connected, an active key or deployment identity is\n    /// unavailable, or any stored payload cannot be migrated and authenticated.\n    pub async fn protect_payload_storage(&self) -> anyhow::Result<()> {\n        let database = self.payload_operation_database().await?;\n        database.ensure_execution_transaction_schema().await?;\n        let keys = self\n            .load_payload_keys()?\n            .ok_or_else(|| anyhow::anyhow!(\"Payload protection requires an active payload key\"))?;\n        database.ensure_execution_payload_storage(&keys).await\n    }\n\n    /// Rewraps all protected payloads in this execution database with the configured active key.\n    ///\n    /// The prior active key must remain configured as a retired key until this method and a\n    /// subsequent full check both succeed.\n    ///\n    /// # Errors\n    ///\n    /// Returns an error if the client is connected, storage is not protected, required keys are\n    /// unavailable, or any bounded rewrap batch fails authentication.\n    pub async fn rewrap_payload_storage(&self, batch_size: usize) -> anyhow::Result<()> {\n        let batch_size = validate_payload_operation_batch_size(batch_size)?;\n        let database = self.payload_operation_database().await?;\n        let keys = self\n            .load_payload_keys()?\n            .ok_or_else(|| anyhow::anyhow!(\"Payload rewrap requires an active payload key\"))?;","sourceCodeStart":863,"sourceCodeEnd":899,"githubUrl":"https://github.com/nautechsystems/nautilus_trader/blob/18893faf8b356be3320add8de2f861b0b647cf06/crates/adapters/blockchain/src/execution/client.rs#L863-L899","documentation":"protect_payload_storage wraps all stored execution payloads with the configured encryption keys. It requires an active payload key; load_payload_keys returning None means no active key is configured, so payloads cannot be authenticated/encrypted and the method refuses to run.","triggerScenarios":"Calling protect_payload_storage when no active payload key is configured (load_payload_keys -> None), e.g., key material missing from configuration or keystore.","commonSituations":"Fresh deployment where payload encryption keys were never provisioned; key file/env var removed or rotated incorrectly leaving no active key; misconfigured keystore path.","solutions":["Configure an active payload key (set up key material so load_payload_keys returns Some)","Provision keys via the documented key setup/rotation procedure before enabling payload protection","Check that the keystore path/env configuration points at valid key files"],"exampleFix":"// before\n// no payload keys configured\nclient.protect_payload_storage().await?;\n// after\nclient.configure_payload_keys(active_key, vec![retired_keys]).await?; // ensure an active key exists\nclient.protect_payload_storage().await?;","handlingStrategy":"validation","validationCode":"if client.load_payload_keys()?.is_none() {\n    return Err(\"configure an active payload key before enabling payload protection\".into());\n}","typeGuard":null,"tryCatchPattern":"if let Err(e) = client.protect_payload_storage().await {\n    if e.to_string().contains(\"requires an active payload key\") {\n        // provision/configure the active key, then retry\n    }\n    return Err(e.into());\n}","preventionTips":["Provision payload keys as a mandatory startup step in deployments","Monitor keystore configuration so active keys are never removed during rotation","Document that retired rotations must always leave exactly one active key"],"tags":["security","encryption","configuration","keys"],"backgroundTag":"missing-credentials","analyzedSha":"18893faf8b356be3320add8de2f861b0b647cf06","analyzedAt":"2026-09-08T20:49:34.690Z","contentChangedAt":"2026-09-08T20:49:34.690Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}