{"record":{"id":"d4995405f5329aac","repo":"JuliusBrussee/caveman","slug":"cachebench-unsupported-replay-provider","errorCode":null,"errorMessage":"cachebench: unsupported replay provider","messagePattern":"cachebench: unsupported replay provider","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cacheengine/cachebench/replay_http.go","lineNumber":249,"sourceCode":"\tcase \"gemini\":\n\t\tif !validReplaySecret(transport.credentials.GeminiAPIKey) {\n\t\t\treturn errors.New(\"cachebench: Gemini API key unavailable\")\n\t\t}\n\t\trequest.Header.Set(\"x-goog-api-key\", transport.credentials.GeminiAPIKey)\n\tcase \"bedrock\":\n\t\tif validReplaySecret(transport.credentials.BedrockAPIKey) {\n\t\t\trequest.Header.Set(\"authorization\", \"Bearer \"+transport.credentials.BedrockAPIKey)\n\t\t\treturn nil\n\t\t}\n\t\tif !validAWSRegion(region) || !transport.credentials.AWS.Valid() || !validReplaySecret(transport.credentials.AWS.AccessKeyID) || !validReplaySecret(transport.credentials.AWS.SecretAccessKey) || transport.credentials.AWS.SessionToken != \"\" && !validReplaySecret(transport.credentials.AWS.SessionToken) {\n\t\t\treturn errors.New(\"cachebench: Bedrock credentials unavailable\")\n\t\t}\n\t\tsigner := awssig.Signer{Region: region, Service: \"bedrock\"}\n\t\tif err := signer.Sign(request, transport.credentials.AWS, awssig.HashPayload(body), time.Now().UTC()); err != nil {\n\t\t\treturn errors.New(\"cachebench: Bedrock request signing failed\")\n\t\t}\n\tdefault:\n\t\treturn errors.New(\"cachebench: unsupported replay provider\")\n\t}\n\treturn nil\n}\n\nfunc validateReplayBaseURL(raw string, allowInsecureLoopback bool) (*url.URL, error) {\n\tparsed, err := url.Parse(strings.TrimSpace(raw))\n\tif err != nil || parsed.Host == \"\" || parsed.User != nil || parsed.RawQuery != \"\" || parsed.Fragment != \"\" {\n\t\treturn nil, errors.New(\"invalid absolute base URL\")\n\t}\n\tif parsed.Scheme == \"https\" {\n\t\treturn parsed, nil\n\t}\n\tif parsed.Scheme == \"http\" && allowInsecureLoopback && isLoopbackHost(parsed.Hostname()) {\n\t\treturn parsed, nil\n\t}\n\treturn nil, errors.New(\"HTTPS required; HTTP is test-only on explicit loopback\")\n}\n","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/766dce6b1394ebb56a3090748d5a0240a5aefb36/cacheengine/cachebench/replay_http.go#L231-L267","documentation":"authorize's provider switch fell through to its default case, meaning the provider string matched none of openai/anthropic/gemini/bedrock. Because Send validates the provider with validBoundedText (not against the known set) before calling authorize, this fires when the bounded string names an unknown provider that endpoint() happened to accept via a configured baseURL — a defensive backstop against replaying to an unauthenticated provider.","triggerScenarios":"Thrown at cacheengine/cachebench/replay_http.go:249 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix the provider string before it reaches authorize","Ensure the provider allowlist in endpoint() and authorize() stays in sync"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"766dce6b1394ebb56a3090748d5a0240a5aefb36","analyzedAt":"2026-08-18T03:14:35.516Z","contentChangedAt":"2026-08-18T03:14:35.516Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}