{"record":{"id":"a31cd0afc6a5d655","repo":"temporalio/temporal","slug":"query-visiblity-request-is-invalid","errorCode":null,"errorMessage":"query visiblity request is invalid","messagePattern":"query visiblity request is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"common/archiver/constants.go","lineNumber":35,"sourceCode":"\t// ErrReasonInvalidArchiveRequest is the error reason for invalid archive request\n\tErrReasonInvalidArchiveRequest = \"archive request is invalid\"\n\t// ErrReasonReadHistory is the error reason for failing to read history\n\tErrReasonReadHistory = \"failed to read history batches\"\n\t// ErrReasonHistoryMutated is the error reason for mutated history\n\tErrReasonHistoryMutated = \"history was mutated\"\n)\n\nvar (\n\t// ErrInvalidURI is the error for invalid URI\n\tErrInvalidURI = errors.New(\"URI is invalid\")\n\t// ErrURISchemeMismatch is the error for mismatch between URI scheme and archiver\n\tErrURISchemeMismatch = errors.New(\"URI scheme does not match the archiver\")\n\t// ErrHistoryMutated is the error for mutated history\n\tErrHistoryMutated = errors.New(\"history was mutated\")\n\t// ErrInvalidGetHistoryRequest is the error for invalid GetHistory request\n\tErrInvalidGetHistoryRequest = errors.New(\"get archived history request is invalid\")\n\t// ErrInvalidQueryVisibilityRequest is the error for invalid Query Visibility request\n\tErrInvalidQueryVisibilityRequest = errors.New(\"query visiblity request is invalid\")\n\t// ErrNextPageTokenCorrupted is the error for corrupted GetHistory token\n\tErrNextPageTokenCorrupted = errors.New(\"next page token is corrupted\")\n\t// ErrHistoryNotExist is the error for non-exist history\n\tErrHistoryNotExist = errors.New(\"requested workflow history does not exist\")\n)\n","sourceCodeStart":17,"sourceCodeEnd":41,"githubUrl":"https://github.com/temporalio/temporal/blob/bde624efd13fbd3843654058db6d9c716166318b/common/archiver/constants.go#L17-L41","documentation":"This is a wrapping error from validateClientTLS: validateCAs rejected an entry in ClientTLS.RootCAData, the list of inline PEM root CAs used to verify the server (or mTLS peer). The underlying cause is typically an empty string in the list.","triggerScenarios":"Calling validateGroupTLS or validateWorkerTLS with ClientTLS.RootCAData containing an empty or whitespace-only entry.","commonSituations":"Client config generated from a template with an unfilled root CA value; env expansion to empty string; a YAML list item left blank; secret not yet mounted so data renders empty.","solutions":["Remove empty entries from RootCAData.","Fix the source of the empty value (missing secret, unset env var, bad template).","If CAs are on disk, switch to RootCAFiles and empty RootCAData.","Validate the PEM content parses as an x509 certificate before deployment."],"exampleFix":"// before\nClientTLS:\n  RootCAData: [\"\"]\n// after\nClientTLS:\n  RootCAData: [\"-----BEGIN CERTIFICATE-----...\"]","handlingStrategy":"validation","validationCode":"for i, ca := range cfg.RootCAData {\n\tif strings.TrimSpace(ca) == \"\" {\n\t\treturn fmt.Errorf(\"RootCAData[%d] is empty\", i)\n\t}\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fail fast on empty secret values before constructing client TLS config.","Guard env-based injection: require ROOT_CA_DATA to be non-empty at startup.","Validate rendered PEM with crypto/x509 before use."],"tags":["tls","config-validation","ca-certificates"],"backgroundTag":"tls-config-conflict","analyzedSha":"bde624efd13fbd3843654058db6d9c716166318b","analyzedAt":"2026-09-01T07:18:39.080Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}