{"record":{"id":"832850bb606630e3","repo":"risingwavelabs/risingwave","slug":"internal-error-entered-unreachable-code","errorCode":null,"errorMessage":"internal error: entered unreachable code","messagePattern":"internal error: entered unreachable code","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"src/frontend/src/handler/create_connection.rs","lineNumber":133,"sourceCode":"        };\n    }\n    let (database_id, schema_id) = session.get_database_and_schema_id_for_create(schema_name)?;\n    let mut with_properties = handler_args.with_options.clone().into_connector_props();\n    resolve_privatelink_in_with_option(&mut with_properties)?;\n    let create_connection_payload = resolve_create_connection_payload(with_properties, &session)?;\n\n    let catalog_writer = session.catalog_writer()?;\n\n    if session\n        .env()\n        .system_params_manager()\n        .get_params()\n        .load()\n        .enforce_secret()\n    {\n        use risingwave_pb::ddl_service::create_connection_request::Payload::ConnectionParams;\n        let ConnectionParams(cp) = &create_connection_payload else {\n            unreachable!()\n        };\n        enforce_secret_connection(\n            &cp.connection_type(),\n            cp.properties.keys().map(|s| s.as_str()),\n        )?;\n    }\n\n    catalog_writer\n        .create_connection(\n            connection_name,\n            database_id,\n            schema_id,\n            session.user_id(),\n            create_connection_payload,\n        )\n        .await?;\n\n    Ok(PgResponse::empty_result(StatementType::CREATE_CONNECTION))","sourceCodeStart":115,"sourceCodeEnd":151,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/frontend/src/handler/create_connection.rs#L115-L151","documentation":"When enforce_secret is enabled in system parameters, the create connection payload is expected to always be ConnectionParams; any other payload variant is an invariant violation and hits unreachable!(), surfacing as 'internal error: entered unreachable code'.","triggerScenarios":"CREATE CONNECTION issued while enforce_secret=true, but the RPC payload is not ConnectionParams — i.e. a client/CLI built against a different proto payload variant or a proxy rewriting the request.","commonSituations":"Version-skewed clients (older risectl/SDK) sending legacy payloads after the server enabled secret enforcement; custom tools constructing CreateConnectionRequest manually.","solutions":["Disable enforce_secret temporarily (ALTER SYSTEM SET enforce_secret = false) and retry to confirm payload mismatch","Upgrade the client/CLI/SDK to match the server's protobuf definitions","Send the request via the standard psql CREATE CONNECTION flow instead of a hand-built RPC"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"-- Check secret enforcement setting first\nSHOW PARAMETERS enforce_secret;","typeGuard":null,"tryCatchPattern":"try {\n  await conn.query(\"CREATE CONNECTION c WITH (...)\");\n} catch (e) {\n  if (String(e.message).includes('unreachable')) {\n    // check client/server version skew and payload type\n  }\n}","preventionTips":["Keep client and server versions aligned","Use psql/standard SQL for CREATE CONNECTION","Review enforce_secret setting and its requirements before use"],"tags":["internal","frontend","unreachable","secret"],"backgroundTag":"internal-invariant-violation","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}