{"record":{"id":"ba9f6fe23668db01","repo":"Hmbown/CodeWhale","slug":"codewhale-owned-credential-file-dacl-is-not-curren","errorCode":null,"errorMessage":"Codewhale-owned credential file DACL is not current-user-only","messagePattern":"Codewhale-owned credential file DACL is not current-user-only","errorType":"exception","errorClass":"std::io::Error","httpStatus":null,"severity":"error","filePath":"crates/tui/src/external_credentials.rs","lineNumber":514,"sourceCode":"        return Err(io::Error::from_raw_os_error(result as i32));\n    }\n    let _entries = WindowsLocalAllocation(entries.cast());\n    if count != 1 || entries.is_null() {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file DACL must grant only one user\",\n        ));\n    }\n    // SAFETY: `count == 1` proves the first returned entry is initialized.\n    let entry = unsafe { &*entries };\n    let trustee_sid: PSID = entry.Trustee.ptstrName.cast();\n    let current_user_only = entry.Trustee.TrusteeForm == TRUSTEE_IS_SID\n        && !trustee_sid.is_null()\n        && unsafe { EqualSid(trustee_sid, user.sid()) } != 0\n        && matches!(entry.grfAccessMode, SET_ACCESS | GRANT_ACCESS)\n        && entry.grfAccessPermissions == FILE_ALL_ACCESS;\n    if !current_user_only {\n        return Err(io::Error::new(\n            io::ErrorKind::PermissionDenied,\n            \"Codewhale-owned credential file DACL is not current-user-only\",\n        ));\n    }\n    Ok(())\n}\n\n#[cfg(windows)]\nstruct CurrentWindowsUser {\n    token: windows_sys::Win32::Foundation::HANDLE,\n    token_info: Vec<usize>,\n}\n\n#[cfg(windows)]\nimpl CurrentWindowsUser {\n    fn open() -> io::Result<Self> {\n        use windows_sys::Win32::Foundation::{GetLastError, HANDLE};\n        use windows_sys::Win32::Security::{","sourceCodeStart":496,"sourceCodeEnd":532,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/external_credentials.rs#L496-L532","documentation":"Windows DACL entry check in verify_windows_owner_only_handle: GetExplicitEntriesFromAclW returned an entry count other than one (or a null entries pointer), so the DACL grants access to more than a single trustee and the file fails the owner-only requirement.","triggerScenarios":"Thrown at crates/tui/src/external_credentials.rs:514 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reset the file's ACL to grant only the current user access (e.g. icacls /inheritance:r plus a single grant).","Re-create the credential via the secure auth flow so a correct owner-only DACL is applied.","Move the credential file out of directories that inject inherited ACEs."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}