{"record":{"id":"d582aad98e3aacf3","repo":"OpenNHP/opennhp","slug":"source-is-required-when-data-source-type-is-no","errorCode":null,"errorMessage":"--source is required when --data-source-type is not stream and --ztdo-id is not specified","messagePattern":"--source is required when --data-source-type is not stream and --ztdo-id is not specified","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/db/main/main.go","lineNumber":64,"sourceCode":"\t\t\t&cli.StringFlag{Name: \"data-private-key\", Value: \"\", Usage: \"data private key with base64 format\"},\n\t\t\t&cli.StringFlag{Name: \"provider-public-key\", Value: \"\", Usage: \"provider public key with base64 format\"},\n\t\t},\n\t\tBefore: func(c *cli.Context) error {\n\t\t\tif c.String(\"mode\") == \"encrypt\" {\n\t\t\t\tif c.String(\"data-source-type\") != \"\" {\n\t\t\t\t\tif !slices.Contains([]string{\"online\", \"offline\", \"stream\"}, c.String(\"data-source-type\")) {\n\t\t\t\t\t\treturn fmt.Errorf(\"invalid --data-source-type, allowed values are online, offline and stream\")\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"ztdo-id\") != \"\" { // update ztdo\n\t\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"output\") != \"\" || c.String(\"metadata\") != \"\" || c.String(\"data-source-type\") != \"\" {\n\t\t\t\t\t\treturn fmt.Errorf(\"--source, --output, --data-source-type and --metadata are not allowed when --ztdo-id is specified\")\n\t\t\t\t\t}\n\t\t\t\t} else { // create ztdo\n\t\t\t\t\tif c.String(\"data-source-type\") != \"stream\" {\n\t\t\t\t\t\tif c.String(\"source\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--source is required when --data-source-type is not stream and --ztdo-id is not specified\")\n\t\t\t\t\t\t}\n\t\t\t\t\t} else {\n\t\t\t\t\t\tif c.String(\"access-url\") == \"\" {\n\t\t\t\t\t\t\treturn fmt.Errorf(\"--access-url is required when --data-source-type is stream\")\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tif c.String(\"smart-policy\") == \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--smart-policy is required in encrypt mode\")\n\t\t\t\t}\n\n\t\t\t\t// only be available in decrypt mode\n\t\t\t\tif c.String(\"ztdo\") != \"\" || c.String(\"data-private-key\") != \"\" || c.String(\"provider-public-key\") != \"\" {\n\t\t\t\t\treturn fmt.Errorf(\"--ztdo, --data-private-key and --provider-public-key are only allowed in decrypt mode\")\n\t\t\t\t}\n\t\t\t} else if c.String(\"mode\") == \"decrypt\" {\n\t\t\t\tif c.String(\"source\") != \"\" || c.String(\"smart-policy\") != \"\" || c.String(\"access-url\") != \"\" {","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/db/main/main.go#L46-L82","documentation":"In encrypt mode without --ztdo-id, the CLI creates a new ZTDO and requires the source of the data to encrypt. When --data-source-type is anything other than 'stream' (online/offline or unset), --source must point at the file to encrypt; otherwise this validation error fires in the Before hook.","triggerScenarios":"Running `nhp-device run --mode encrypt --smart-policy ... --output ...` while omitting --source, or passing --data-source-type online/offline without --source.","commonSituations":"Users assuming streaming defaults supply the source implicitly; scripts that conditionally set --data-source-type stream but fail to set --source on the non-stream path; typos like --src instead of --source leaving the flag empty.","solutions":["Add --source <path-to-file> to the encrypt command","Or switch to streaming by passing --data-source-type stream and providing --access-url instead","Or pass --ztdo-id if the intent was to update an existing ZTDO, where --source is not needed"],"exampleFix":"// before\nnhp-device run --mode encrypt --data-source-type offline --smart-policy policy.wasm --output out.ztdo\n// after\nnhp-device run --mode encrypt --data-source-type offline --source ./data.csv --smart-policy policy.wasm --output out.ztdo","handlingStrategy":"validation","validationCode":"if (flags.mode === 'encrypt' && !flags['ztdo-id'] && flags['data-source-type'] !== 'stream' && !flags.source) {\n  throw new Error('--source (or stream --access-url) is required for create-encrypt');\n}","typeGuard":"const needsSource = (flags) => flags.mode === 'encrypt' && !flags['ztdo-id'] && flags['data-source-type'] !== 'stream';","tryCatchPattern":null,"preventionTips":["Check the required-flag matrix (source vs access-url) before switching --data-source-type","Assert non-empty flag values in shell scripts with ${SOURCE:?} style expansion","Prefer --ztdo-id updates when the data source is unchanged"],"tags":["cli","validation","flags"],"backgroundTag":"missing-required-flag","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}