{"record":{"id":"caded4487f4e5b2e","repo":"iflytek/astron-agent","slug":"invalid-tenant-bootstrap-credentials-w","errorCode":null,"errorMessage":"invalid tenant bootstrap credentials: %w","messagePattern":"invalid tenant bootstrap credentials: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"critical","filePath":"core/tenant/tools/database/bootstrap_credentials.go","lineNumber":53,"sourceCode":"}\n\nfunc (transaction sqlBootstrapTransaction) QueryRowContext(\n\tctx context.Context,\n\tquery string,\n\targs ...any,\n) bootstrapRowScanner {\n\treturn transaction.transaction.QueryRowContext(ctx, query, args...)\n}\n\nfunc reconcileTenantBootstrap(\n\tclient *sql.DB,\n\tcredentials config.TenantBootstrapCredentials,\n) error {\n\tif client == nil {\n\t\treturn errors.New(\"mysql client is nil\")\n\t}\n\tif err := credentials.Validate(); err != nil {\n\t\treturn fmt.Errorf(\"invalid tenant bootstrap credentials: %w\", err)\n\t}\n\n\tctx := context.Background()\n\ttransaction, err := client.BeginTx(ctx, nil)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"begin tenant bootstrap transaction failed: %w\", err)\n\t}\n\tdefer func() {\n\t\t_ = transaction.Rollback()\n\t}()\n\n\tif err := reconcileTenantBootstrapTransaction(\n\t\tctx,\n\t\tsqlBootstrapTransaction{transaction: transaction},\n\t\tcredentials,\n\t); err != nil {\n\t\treturn err\n\t}","sourceCodeStart":35,"sourceCodeEnd":71,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/tenant/tools/database/bootstrap_credentials.go#L35-L71","documentation":"reconcileTenantBootstrap validates the configured tenant bootstrap credentials (TenantBootstrapCredentials.Validate) before touching the database; invalid values abort with this wrapped error. It is a startup-time config guard ensuring the reserved tenant app/credentials are coherent before any SQL runs.","triggerScenarios":"initializeMysqlClient calls reconcileTenantBootstrap with credentials whose Validate() fails — e.g. missing TenantID, empty API key/secret, or malformed values in config/env.","commonSituations":"TENANT bootstrap env vars omitted or left empty in docker-compose/K8s manifests; secret contains whitespace or wrong length after templating; config struct partially populated because a YAML key was misnamed.","solutions":["Run credentials.Validate() logic mentally against your config: fill in the missing/invalid field reported by the wrapped %w error.","Fix the bootstrap env/config entries (tenant ID, API key, API secret) in the deployment manifest and restart the service.","Read the wrapped inner error (errors.Unwrap / %v of the chain) — it names exactly which field failed validation.","Add a config preflight check at startup that fails fast with the field name before opening the DB."],"exampleFix":"// before\ncreds := config.TenantBootstrapCredentials{TenantID: cfg.TenantID} // key/secret empty\nreconcileTenantBootstrap(client, creds)\n// after\ncreds := config.TenantBootstrapCredentials{\n    TenantID: cfg.TenantID,\n    APIKey:   cfg.APIKey,\n    APISecret: cfg.APISecret,\n}\nif err := creds.Validate(); err != nil {\n    log.Fatalf(\"bootstrap config invalid: %v\", err)\n}\nreconcileTenantBootstrap(client, creds)","handlingStrategy":"validation","validationCode":"creds := config.TenantBootstrapCredentials{TenantID: os.Getenv(\"TENANT_ID\"), APIKey: os.Getenv(\"TENANT_API_KEY\"), APISecret: os.Getenv(\"TENANT_API_SECRET\")}\nif err := creds.Validate(); err != nil {\n    log.Fatalf(\"tenant bootstrap config invalid: %v\", err)\n}","typeGuard":"func credsReady(c config.TenantBootstrapCredentials) bool {\n    return c.TenantID != \"\" && c.APIKey != \"\" && c.APISecret != \"\"\n}","tryCatchPattern":"if err := reconcileTenantBootstrap(client, creds); err != nil {\n    var cfgErr *fmt.wrapError\n    if errors.As(err, &cfgErr) && strings.HasPrefix(err.Error(), \"invalid tenant bootstrap credentials\") {\n        log.Fatalf(\"fix TENANT_* env vars: %v\", err)\n    }\n    return err\n}","preventionTips":["Validate all TENANT_* env vars at container start before DB init.","Keep one source of truth for bootstrap credentials in the deployment manifest.","Add the config check to CI so missing fields fail the build, not runtime."],"tags":["go","config","bootstrap","startup"],"backgroundTag":"invalid-config-value","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}