{"record":{"id":"8e364dedb092bf7d","repo":"t8y2/dbx","slug":"token-is-empty","errorCode":null,"errorMessage":"token is empty","messagePattern":"token is empty","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"agents/drivers/argo-go/config.go","lineNumber":756,"sourceCode":"\t}\n\ttoken := firstNonEmpty(parameter(values, \"delegationtoken\"), parameter(values, \"token\"), config.Password)\n\tif token == \"\" {\n\t\treturn errors.New(\"Hive delegation token authentication requires delegationToken, token, or password\")\n\t}\n\tconfig.DelegationToken = token\n\tidentifier, password, err := decodeHadoopDelegationToken(token)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"decode Hive delegation token: %w\", err)\n\t}\n\tconfig.Username = base64.StdEncoding.EncodeToString(identifier)\n\tconfig.Password = base64.StdEncoding.EncodeToString(password)\n\treturn nil\n}\n\nfunc decodeHadoopDelegationToken(value string) ([]byte, []byte, error) {\n\tencoded := strings.Join(strings.Fields(strings.TrimSpace(value)), \"\")\n\tif encoded == \"\" {\n\t\treturn nil, nil, errors.New(\"token is empty\")\n\t}\n\tvar decoded []byte\n\tvar decodeErr error\n\tfor _, encoding := range []*base64.Encoding{\n\t\tbase64.RawURLEncoding,\n\t\tbase64.URLEncoding,\n\t\tbase64.RawStdEncoding,\n\t\tbase64.StdEncoding,\n\t} {\n\t\tdecoded, decodeErr = encoding.DecodeString(encoded)\n\t\tif decodeErr == nil {\n\t\t\tbreak\n\t\t}\n\t}\n\tif decodeErr != nil {\n\t\treturn nil, nil, decodeErr\n\t}\n\treader := strings.NewReader(string(decoded))","sourceCodeStart":738,"sourceCodeEnd":774,"githubUrl":"https://github.com/t8y2/dbx/blob/c0390bff16418b651f4728520d99adf8ce48829a/agents/drivers/argo-go/config.go#L738-L774","documentation":"decodeHadoopDelegationToken parses a Hadoop delegation token: it joins/trimmes whitespace and requires a non-empty base64 payload before decoding. If the encoded input is empty after normalization, it returns this error, which the caller wraps as 'decode Hive delegation token: token is empty'.","triggerScenarios":"Calling decodeHadoopDelegationToken (via applyDelegationToken) with a token string that is empty or only whitespace after strings.Fields/TrimSpace normalization.","commonSituations":"A parameter like token=\"   \" or delegationToken=\"\" passing the firstNonEmpty check despite being whitespace-only; an env var set to an empty string; a token accidentally stripped during templating/YAML interpolation.","solutions":["Provide a real base64-encoded Hadoop delegation token string","Trim-check the token source (env var, file, secret) to confirm it is non-empty","Fix upstream secret injection — an empty secret often means the secret was never mounted/created"],"exampleFix":"// before\nvalues[\"delegationToken\"] = os.Getenv(\"HIVE_TOKEN\") // may be \"\"\n// after\ntok := strings.TrimSpace(os.Getenv(\"HIVE_TOKEN\"))\nif tok == \"\" { return fmt.Errorf(\"HIVE_TOKEN is not set\") }\nvalues[\"delegationToken\"] = tok","handlingStrategy":"validation","validationCode":"if strings.TrimSpace(tokenStr) == \"\" {\n    return errors.New(\"delegation token is empty; check token source\")\n}","typeGuard":null,"tryCatchPattern":"identifier, password, err := decodeHadoopDelegationToken(token)\nif err != nil {\n    return fmt.Errorf(\"delegation token unusable: %w\", err)\n}","preventionTips":["Verify the token env var/secret is populated before the process starts","Trim and check tokens after templating/interpolation, which can drop values","Fail fast on empty secrets at startup rather than at connect time"],"tags":["go","hive","delegation-token","base64","validation"],"backgroundTag":"empty-auth-token","analyzedSha":"c0390bff16418b651f4728520d99adf8ce48829a","analyzedAt":"2026-09-05T23:05:10.900Z","contentChangedAt":"2026-09-05T23:05:10.900Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}