{"record":{"id":"942b0a9d27226b87","repo":"gravitational/teleport","slug":"v-status-d","errorCode":null,"errorMessage":"%v: status %d","messagePattern":"(.+?): status (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/touchid/api_darwin.go","lineNumber":439,"sourceCode":"func (touchIDImpl) DeleteNonInteractive(credentialID string) error {\n\tidC := C.CString(credentialID)\n\tdefer C.free(unsafe.Pointer(idC))\n\n\tswitch res := C.DeleteNonInteractive(idC); res {\n\tcase 0: // aka success\n\t\treturn nil\n\tcase errSecItemNotFound:\n\t\treturn ErrCredentialNotFound\n\tdefault:\n\t\treturn errorFromStatus(\"non-interactive delete\", int(res), \"\" /* msg */)\n\t}\n}\n\nfunc errorFromStatus(prefix string, status int, msg string) error {\n\tif msg != \"\" {\n\t\treturn fmt.Errorf(\"%v: %v\", prefix, msg)\n\t}\n\treturn fmt.Errorf(\"%v: status %d\", prefix, status)\n}\n","sourceCodeStart":421,"sourceCodeEnd":441,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/touchid/api_darwin.go#L421-L441","documentation":"errorFromStatus on macOS wraps a failure into a Go error. When no human-readable message is available, it falls back to formatting the raw numeric status code: \"<prefix>: status <N>\". The numeric code comes from the underlying framework call (e.g. errSec codes or LAError codes), so it must be decoded to understand the failure.","triggerScenarios":"Any Touch ID operation (Guard, Register, Authenticate, FindCredentials, ListCredentials, DeleteCredential) returning a non-zero status with an empty message string, e.g. a raw OSStatus from Security framework calls that lack a localized description.","commonSituations":"Low-level keychain errors (e.g. status -25291 unavailable, -25300 item not found); DeviceCheck/Secure Enclave calls failing without a message; running in environments where biometrics APIs return bare status codes (CI, headless context, no T2/Apple silicon).","solutions":["Map the numeric status to its OSStatus/errSec meaning (e.g. errSecItemNotFound = -25300) to identify the cause.","If the status indicates the credential/key is missing, re-register the credential with Register.","Check device capabilities (IsAvailable/Touch ID enrollment) before calling to avoid unsupported-environment statuses.","Improve diagnostics by passing the localized description from the underlying NSError into errorFromStatus's msg parameter."],"exampleFix":"// before\nreturn errorFromStatus(\"key generation\", int(res), \"\") // loses detail\n// after\nreturn errorFromStatus(\"key generation\", int(res), localizedDescription(for: res))","handlingStrategy":"fallback","validationCode":"if !IsAvailable() {\n    return errors.New(\"touchid unavailable; use password or hardware-key flow\")\n}","typeGuard":"func isStatusError(err error) bool {\n    var target *statusError\n    return errors.As(err, &target)\n}\n// or by message shape:\nfunc hasRawStatus(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"status \")\n}","tryCatchPattern":"err := api.ListCredentials()\nif err != nil {\n    if strings.Contains(err.Error(), \"status -25300\") { // errSecItemNotFound\n        return nil // nothing registered yet — not a failure\n    }\n    if strings.Contains(err.Error(), \"status \") {\n        return trace.Wrap(err, \"touchid failed with raw OSStatus; map the code to its errSec meaning\")\n    }\n    return trace.Wrap(err)\n}","preventionTips":["Learn common OSStatus codes (-25300 item not found, -25291 keychain unavailable, -25299 duplicate item).","Prefer flows that surface a message (msg != \"\") so errors are self-describing.","Gate Touch ID calls behind device-capability checks to avoid unsupported-environment statuses."],"tags":["touchid","macos","error-wrapping","status-code"],"backgroundTag":"macos-security-framework-error","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}