{"record":{"id":"b8d28f06957c7cf3","repo":"JuliusBrussee/caveman","slug":"envelope-organization-scope-is-required","errorCode":null,"errorMessage":"envelope: organization scope is required","messagePattern":"envelope: organization scope is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/envelope/envelope.go","lineNumber":173,"sourceCode":"\t}\n\tns := gcm.NonceSize()\n\tif len(ciphertext) < ns {\n\t\treturn nil, fmt.Errorf(\"envelope: ciphertext too short\")\n\t}\n\tnonce, ct := ciphertext[:ns], ciphertext[ns:]\n\tplaintext, err := gcm.Open(nil, nonce, ct, aad)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"envelope: open: %w\", err)\n\t}\n\treturn plaintext, nil\n}\n\nfunc scopeAAD(scope Scope) ([]byte, string, error) {\n\tscope.OrganizationID = strings.TrimSpace(scope.OrganizationID)\n\tscope.ProjectID = strings.TrimSpace(scope.ProjectID)\n\tscope.Kind = strings.TrimSpace(scope.Kind)\n\tif scope.OrganizationID == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: organization scope is required\")\n\t}\n\tif scope.Kind == \"\" {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: object kind is required\")\n\t}\n\taad, err := json.Marshal(struct {\n\t\tVersion        int    `json:\"version\"`\n\t\tOrganizationID string `json:\"organization_id\"`\n\t\tProjectID      string `json:\"project_id\"`\n\t\tKind           string `json:\"kind\"`\n\t}{2, scope.OrganizationID, scope.ProjectID, scope.Kind})\n\tif err != nil {\n\t\treturn nil, \"\", fmt.Errorf(\"envelope: encode scope: %w\", err)\n\t}\n\tsum := sha256.Sum256(aad)\n\treturn aad, hex.EncodeToString(sum[:]), nil\n}\n","sourceCodeStart":155,"sourceCodeEnd":190,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/shared/platform/envelope/envelope.go#L155-L190","documentation":"Validation guard in scopeAAD(): the tenant-scoped seal/open path was called with a Scope whose OrganizationID is empty or whitespace-only. AAD binding requires an organization identifier, so the call cannot proceed.","triggerScenarios":"Thrown at shared/platform/envelope/envelope.go:173 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Populate Scope.OrganizationID from the authenticated tenant context before calling SealForScope/OpenForScope","Trim and validate scope fields at the API boundary before reaching the envelope layer"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}