{"record":{"id":"8b5323b433db11db","repo":"temporalio/temporal","slug":"get-archived-history-request-is-invalid","errorCode":null,"errorMessage":"get archived history request is invalid","messagePattern":"get archived history request is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/archiver/constants.go","lineNumber":33,"sourceCode":"\t// ErrReasonInvalidURI is the error reason for invalid URI\n\tErrReasonInvalidURI = \"URI is invalid\"\n\t// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request\n\tErrReasonInvalidArchiveRequest = \"archive request is invalid\"\n\t// ErrReasonReadHistory is the error reason for failing to read history\n\tErrReasonReadHistory = \"failed to read history batches\"\n\t// ErrReasonHistoryMutated is the error reason for mutated history\n\tErrReasonHistoryMutated = \"history was mutated\"\n)\n\nvar (\n\t// ErrInvalidURI is the error for invalid URI\n\tErrInvalidURI = errors.New(\"URI is invalid\")\n\t// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver\n\tErrURISchemeMismatch = errors.New(\"URI scheme does not match the archiver\")\n\t// ErrHistoryMutated is the error for mutated history\n\tErrHistoryMutated = errors.New(\"history was mutated\")\n\t// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request\n\tErrInvalidGetHistoryRequest = errors.New(\"get archived history request is invalid\")\n\t// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request\n\tErrInvalidQueryVisibilityRequest = errors.New(\"query visiblity request is invalid\")\n\t// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token\n\tErrNextPageTokenCorrupted = errors.New(\"next page token is corrupted\")\n\t// ErrHistoryNotExist is the error for non-exist history\n\tErrHistoryNotExist = errors.New(\"requested workflow history does not exist\")\n)\n","sourceCodeStart":15,"sourceCodeEnd":41,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/archiver/constants.go#L15-L41","documentation":"ServerTLS allows client CAs either as inline PEM data (ClientCAData) or as file paths (ClientCAFiles), but not both simultaneously. Providing both would make CA pool construction ambiguous, so validateServerTLS rejects the combination outright.","triggerScenarios":"Calling validateGroupTLS/validateServerTLS where both len(ClientCAFiles) > 0 and len(ClientCAData) > 0.","commonSituations":"Migrating from file-based to inline CA data but forgetting to clear the file list; base config sets files while an overlay adds data; operator pastes CA PEM into the wrong section of an already file-configured deployment.","solutions":["Keep one representation: clear ClientCAFiles and keep ClientCAData, or the reverse.","For containerized deployments, prefer inline ClientCAData so no mounted files are required.","Audit config merging so only one layer contributes client CAs.","Add a pre-deploy config check asserting mutual exclusivity of all File/Data TLS pairs."],"exampleFix":"// before\nServerTLS:\n  ClientCAFiles: [/etc/temporal/client-ca.pem]\n  ClientCAData: [\"-----BEGIN CERTIFICATE-----...\"]\n// after\nServerTLS:\n  ClientCAData: [\"-----BEGIN CERTIFICATE-----...\"]","handlingStrategy":"validation","validationCode":"if len(cfg.ClientCAFiles) > 0 && len(cfg.ClientCAData) > 0 {\n\treturn fmt.Errorf(\"choose either ClientCAFiles or ClientCAData, not both\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Standardize on one representation (inline data for containers, files for VMs).","During migration scripts, explicitly clear the abandoned field.","Add a pre-deploy lint that enforces mutual exclusivity of all TLS File/Data pairs."],"tags":["tls","config-validation","mutually-exclusive-fields"],"backgroundTag":"tls-config-conflict","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}