{"record":{"id":"a7c5663f0d1af228","repo":"OpenNHP/opennhp","slug":"source-output-data-source-type-and-metad","errorCode":null,"errorMessage":"--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified","messagePattern":"--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":59,"sourceCode":"\t\t\t&cli.StringFlag{Name: \"metadata\", Value: \"\", Usage: \"metadata file\"},\n\t\t\t&cli.StringFlag{Name: \"output\", Value: \"\", Usage: \"Save path of the ztdo file or decrypted file\"},\n\t\t\t&cli.StringFlag{Name: \"access-url\", Value: \"\", Usage: \"ZTDO access url for online or offline mode or API url for streaming mode\"},\n\t\t\t&cli.StringFlag{Name: \"ztdo\", Value: \"\", Usage: \"path to the ztdo file\"},\n\t\t\t&cli.StringFlag{Name: \"ztdo-id\", Value: \"\", Usage: \"identifier of the ztdo file\"},\n\t\t\t&cli.StringFlag{Name: \"data-private-key\", Value: \"\", Usage: \"data private key with base64 format\"},\n\t\t\t&cli.StringFlag{Name: \"provider-public-key\", Value: \"\", Usage: \"provider public key with base64 format\"},\n\t\t},\n\t\tBefore: func(c *cli.Context) error {\n\t\t\tif c.String(\"mode\") == \"encrypt\" {\n\t\t\t\tif c.String(\"data-source-type\") != \"\" {\n\t\t\t\t\tif !slices.Contains([]string{\"online\", \"offline\", \"stream\"}, c.String(\"data-source-type\")) {\n\t\t\t\t\t\treturn fmt.Errorf(\"invalid --data-source-type, allowed values are online, offline and stream\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"ztdo-id\") != \"\" { // update ztdo\n\t\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"output\") != \"\" || c.String(\"metadata\") != \"\" || c.String(\"data-source-type\") != \"\" {\n\t\t\t\t\t\treturn fmt.Errorf(\"--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified\")\n\t\t\t\t\t}\n\t\t\t\t} else { // create ztdo\n\t\t\t\t\tif c.String(\"data-source-type\") != \"stream\" {\n\t\t\t\t\t\tif c.String(\"source\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--source is required when --data-source-type is not stream and --ztdo-id is not specified\")\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tif c.String(\"access-url\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--access-url is required when --data-source-type is stream\")\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L41-L77","documentation":"The `nhp-device run --mode encrypt` command's Before hook rejects encrypt invocations that pass --ztdo-id together with --source, --output, --data-source-type or --metadata. Passing --ztdo-id means 'update an existing ZTDO', an operation that only takes the id plus required encrypt fields, so creation-time source options are treated as conflicting. The CLI surfaces this as a hard validation error before any work runs.","triggerScenarios":"Running `nhp-device run --mode encrypt --ztdo-id <id>` while also setting any of --source, --output, --metadata, or --data-source-type (non-empty string values).","commonSituations":"Copy-pasting a full create-ZTDO command line and appending --ztdo-id to 'reuse' an existing record; scripting that always passes --source/--output regardless of mode; forgetting that --data-source-type defaults are irrelevant when updating.","solutions":["Remove --source, --output, --metadata and --data-source-type from the command when --ztdo-id is given","If you meant to create a new ZTDO, drop --ztdo-id instead and keep the source options","If you meant to update, invoke with only --mode encrypt, --ztdo-id, --smart-policy and required decrypt-style fields"],"exampleFix":"// before\nnhp-device run --mode encrypt --ztdo-id abc123 --source ./data.csv --output ./out.ztdo\n// after\nnhp-device run --mode encrypt --ztdo-id abc123 --smart-policy ./policy.wasm","handlingStrategy":"validation","validationCode":"const updateOnly = ['source','output','metadata','data-source-type'];\nif (flags['ztdo-id'] && updateOnly.some(f => flags[f])) {\n  throw new Error('--ztdo-id is mutually exclusive with ' + updateOnly.join(', '));\n}","typeGuard":"const isUpdateInvocation = (flags) => Boolean(flags['ztdo-id']);\nconst isCreateInvocation = (flags) => !flags['ztdo-id'];","tryCatchPattern":null,"preventionTips":["Build separate script wrappers for ZTDO create vs update","Never append --ztdo-id to an existing create command line","Lint CI scripts for the co-occurrence of --ztdo-id with source-side flags"],"tags":["cli","validation","flags"],"backgroundTag":"mutually-exclusive-flags","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}