{"record":{"id":"94a15aa5d1c8693b","repo":"OpenNHP/opennhp","slug":"tee-public-key-is-not-found-for-specified-token","errorCode":null,"errorMessage":"TEE public key is not found for specified token","messagePattern":"TEE public key is not found for specified token","errorType":"http","errorClass":null,"httpStatus":404,"severity":"error","filePath":"endpoints/server/kbs/attest/attest.go","lineNumber":160,"sourceCode":"\tpublicKey := jwtSigningKey.PublicKey\n\ttoken.Header[\"jwk\"] = map[string]any{\n\t\t\"alg\": \"ES256\",\n\t\t\"crv\": \"P-256\",\n\t\t\"kty\": \"EC\",\n\t\t\"x\":   base64.RawURLEncoding.EncodeToString(publicKey.X.Bytes()),\n\t\t\"y\":   base64.RawURLEncoding.EncodeToString(publicKey.Y.Bytes()),\n\t}\n\n\treturn token.SignedString(jwtSigningKey)\n}\n\nfunc GetTeePubKeyByToken(token string) (*rsa.PublicKey, error) {\n\tteePubKeys.RLock()\n\tdefer teePubKeys.RUnlock()\n\n\tpubKey, exists := teePubKeys.data[token]\n\tif !exists {\n\t\treturn nil, errors.New(\"TEE public key is not found for specified token\")\n\n\t}\n\treturn pubKey, nil\n}\n","sourceCodeStart":142,"sourceCodeEnd":165,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/server/kbs/attest/attest.go#L142-L165","documentation":"GetTeePubKeyByToken looks up a previously stored TEE RSA public key by the token presented in the GetResource request. The lookup is guarded by a read lock over the in-memory teePubKeys map; if the token is absent, this error is returned.","triggerScenarios":"GetResource is called with a token that was never stored (attestation never ran for it), the process restarted losing the in-memory map, or the token string is corrupted/truncated in transit.","commonSituations":"Client skips the attestation step and jumps straight to fetching resources; server restart between attestation and resource fetch; client sends an old/expired token after redeploy.","solutions":["Run the attestation flow (POST /attest) to obtain and store a valid token before calling GetResource","Persist or re-establish TEE pubkeys if the server restarts mid-session","Verify the client sends the exact token string returned by attestation","Check for load-balancing to a different instance that lacks the in-memory token"],"exampleFix":"// before\nres, err := GetResource(token, \"default/repo/key\")\n// after\nif err := client.Attest(); err != nil { return err } // stores tee pubkey under new token\nres, err := GetResource(token, \"default/repo/key\")","handlingStrategy":"validation","validationCode":"if token == \"\" {\n    return errors.New(\"no attestation token; run attest first\")\n}\npk, err := GetTeePubKeyByToken(token)","typeGuard":"func hasToken(tok string) bool { return tok != \"\" }","tryCatchPattern":"pk, err := GetTeePubKeyByToken(token)\nif err != nil {\n    if strings.Contains(err.Error(), \"not found\") {\n        // re-attest to refresh the in-memory token store, then retry\n        if aerr := client.Attest(); aerr != nil { return aerr }\n        pk, err = GetTeePubKeyByToken(token)\n    }\n    if err != nil { return err }\n}","preventionTips":["Always perform attestation before GetResource in client flows","Make the token store persistent (or session-affinity in LBs) across restarts/instances","Log token prefix (not full token) on miss to spot truncation"],"tags":["go","attestation","token","tee"],"backgroundTag":"token-not-found","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}