{"record":{"id":"b1e77e3572b333f6","repo":"prestodb/presto","slug":"could-not-read-secret-file-secretfile","errorCode":null,"errorMessage":"Could not read secret file \" + secretFile","messagePattern":"Could not read secret file \" \\+ secretFile","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"critical","filePath":"presto-lark-sheets/src/main/java/com/facebook/presto/lark/sheets/LarkSheetsUtil.java","lineNumber":49,"sourceCode":"public final class LarkSheetsUtil\n{\n    static final int RADIX = 26;\n    private static final String[] ALPHABETS = buildAlphabetTable();\n    private static final int MASK_REMAIN = 6;\n\n    private LarkSheetsUtil() {}\n\n    public static String loadAppSecret(String secretFile)\n    {\n        JsonCodec<Map<String, String>> codec = JsonCodec.mapJsonCodec(String.class, String.class);\n\n        final Map<String, String> content;\n        try {\n            byte[] bytes = Files.readAllBytes(Paths.get(secretFile));\n            content = codec.fromBytes(bytes);\n        }\n        catch (Exception e) {\n            throw new IllegalArgumentException(\"Could not read secret file \" + secretFile, e);\n        }\n\n        String secret = content.get(\"app-secret\");\n        if (emptyToNull(secret) == null) {\n            throw new IllegalArgumentException(\"app-secret not provided in \" + secretFile);\n        }\n        return secret;\n    }\n\n    public static String mask(String str)\n    {\n        if (str != null && str.length() > MASK_REMAIN) {\n            char[] chars = str.toCharArray();\n            Arrays.fill(chars, 0, chars.length - MASK_REMAIN, '*');\n            return new String(chars);\n        }\n        return str;\n    }","sourceCodeStart":31,"sourceCodeEnd":67,"githubUrl":"https://github.com/prestodb/presto/blob/55bb57d202de3b926896fa966c2c4a44c779634e/presto-lark-sheets/src/main/java/com/facebook/presto/lark/sheets/LarkSheetsUtil.java#L31-L67","documentation":"LarkSheetsUtil.loadAppSecret reads the configured secret file from disk, decodes it (codec.fromBytes) into a key/value map, and surfaces any read/decode failure as IllegalArgumentException('Could not read secret file <path>', e). This fires at connector initialization when the app credential cannot be loaded.","triggerScenarios":"Files.readAllBytes throws (file missing, path wrong, no read permission) or codec.fromBytes throws (corrupt/invalid encoding) when loadAppSecret parses the configured secretFile path.","commonSituations":"Typo in the properties file path (lark.sheets secret-file config); file not mounted in a container; wrong file format produced by an incompatible secret-generation tool; read permissions after deployment user change.","solutions":["Verify the secret file path in the connector properties and correct it.","Regenerate the secret file with the expected codec/format and redeploy.","Fix file permissions so the Presto process user can read it.","Check the file exists in the deployed environment (container volume mount, image includes it)."],"exampleFix":"# before\nlark.sheets.secret-file=/etc/secrets/lark/secret.bin   # file missing\n# after\nlark.sheets.secret-file=/etc/secrets/lark/app-secret.properties  # correct, existing path","handlingStrategy":"validation","validationCode":"Path p = Paths.get(secretFile);\nif (!Files.isRegularFile(p)) throw new IllegalStateException(\"Secret file missing: \" + p);\nif (!Files.isReadable(p)) throw new IllegalStateException(\"Secret file not readable: \" + p);\n// plus verify decodability with the same codec before startup","typeGuard":null,"tryCatchPattern":"try {\n    Properties props = LarkSheetsPropertiesUtil.load(config);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"Could not read secret file\")) {\n        // check path, mount, permissions, file format\n    } else { throw e; }\n}","preventionTips":["Validate secret file existence and readability in deployment health checks","Mount secret files explicitly in container images/volumes","Generate secrets only with the connector's expected codec/format","Avoid hand-editing secret files; regenerate via tooling"],"tags":["config","io","secret","startup"],"backgroundTag":"file-not-found","analyzedSha":"55bb57d202de3b926896fa966c2c4a44c779634e","analyzedAt":"2026-09-04T12:50:26.162Z","contentChangedAt":"2026-09-04T12:50:26.162Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}