{"record":{"id":"8f1558f798e702a0","repo":"Hmbown/CodeWhale","slug":"external-credential-access-is-disabled-for","errorCode":null,"errorMessage":"external credential access is disabled for {}","messagePattern":"external credential access is disabled for (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/config/src/external_credentials.rs","lineNumber":363,"sourceCode":"            source,\n            path,\n            consent_version: EXTERNAL_CREDENTIAL_CONSENT_VERSION,\n        }\n    }\n\n    /// Validate that this record is a current read-only consent for one exact\n    /// provider/source/path tuple without minting an I/O capability.\n    ///\n    /// This is intentionally side-effect free so inventory and picker surfaces\n    /// can acknowledge dormant consent without inspecting the external file.\n    pub fn validate_read_scope(\n        &self,\n        provider: ProviderKind,\n        source: ExternalCredentialSource,\n        resolved_path: &Path,\n    ) -> Result<()> {\n        if self.access == ExternalCredentialAccess::Disabled {\n            bail!(\n                \"external credential access is disabled for {}\",\n                provider.as_str()\n            );\n        }\n        if self.access == ExternalCredentialAccess::Managed {\n            bail!(\n                \"managed external credential access is unsupported for {}; no schema-safe preservation adapter is available\",\n                provider.as_str()\n            );\n        }\n        if self.consent_version != EXTERNAL_CREDENTIAL_CONSENT_VERSION {\n            bail!(\n                \"external credential consent for {} uses unsupported version {}; revoke and consent again\",\n                provider.as_str(),\n                self.consent_version\n            );\n        }\n        if self.provider != provider.as_str() {","sourceCodeStart":345,"sourceCodeEnd":381,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/config/src/external_credentials.rs#L345-L381","documentation":"Thrown by validate_read_scope when the ExternalCredentialsPolicy for a provider has access = Disabled: reading that provider's externally stored credentials is turned off entirely, so read_grant refuses to serve them. This is a deliberate policy gate, not a lookup failure — the credential may exist but the configuration forbids access.","triggerScenarios":"read_grant(provider, source, path) where config sets external credential access to \"disabled\" for that provider; enterprise/managed settings disabling external credential reads by default.","commonSituations":"Fresh installs or hardened profiles where external credential access ships disabled; users expecting CLI tools to read keychain/env credentials while policy blocks it.","solutions":["Change the policy for that provider to the allowed access mode in config.toml","If access should remain disabled, provide the credential inline instead of reading externally","Confirm with the machine/organization owner that enabling external access is intended","Restart/reload after editing the config so the new policy takes effect"],"exampleFix":"// before (config.toml)\n[external_credentials.openai]\naccess = \"disabled\"\n// after (config.toml)\n[external_credentials.openai]\naccess = \"read\"","handlingStrategy":"try-catch","validationCode":"// Inspect the effective policy before calling read_grant\nlet policy = load_external_credentials_policy(provider)?;\nif policy.access == ExternalCredentialAccess::Disabled {\n    // skip external read; supply credential another way\n}","typeGuard":null,"tryCatchPattern":"match read_grant(provider, source, &path) {\n    Err(e) if e.to_string().contains(\"disabled\") => fallback_to_inline_credential(provider),\n    other => other?,\n}","preventionTips":["Check the access policy in config before relying on external credentials","Document for your team which access mode each machine uses","Provide inline credentials where external access is disabled by policy"],"tags":["config","credentials","permissions","policy"],"backgroundTag":"permission-denied","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}