{"record":{"id":"da7c8175197d106d","repo":"iflytek/astron-agent","slug":"missing-required-environment-variables-join-missing","errorCode":null,"errorMessage":"Missing required environment variables: {', '.join(missing)}","messagePattern":"Missing required environment variables: (.+?)","errorType":"validation","errorClass":"ValueError","httpStatus":null,"severity":"error","filePath":"core/workflow/infra/audit_system/audit_api/iflytek/ifly_audit_api.py","lineNumber":119,"sourceCode":"        :raises ValueError: If required environment variables are missing\n        \"\"\"\n        self.app_id = os.getenv(\"IFLYTEK_AUDIT_APP_ID\", \"\")\n        self.access_key_id = os.getenv(\"IFLYTEK_AUDIT_ACCESS_KEY_ID\", \"\")\n        self.access_key_secret = os.getenv(\"IFLYTEK_AUDIT_ACCESS_KEY_SECRET\", \"\")\n        self.hosts = os.getenv(\n            \"IFLYTEK_AUDIT_HOST\", \"http://audit-api.xfyun.cn/v1.0\"\n        ).split(\",\")\n\n        missing = []\n        if not self.app_id:\n            missing.append(\"IFLYTEK_AUDIT_APP_ID\")\n        if not self.access_key_id:\n            missing.append(\"IFLYTEK_AUDIT_ACCESS_KEY_ID\")\n        if not self.access_key_secret:\n            missing.append(\"IFLYTEK_AUDIT_ACCESS_KEY_SECRET\")\n\n        if missing and int(os.getenv(\"AUDIT_ENABLE\", \"0\")) == 1:\n            raise ValueError(\n                f\"Missing required environment variables: {', '.join(missing)}\"\n            )\n\n    def _signature(self, query_param: dict) -> str:\n        \"\"\"\n        Generate HMAC-SHA1 signature for request authentication.\n\n        Creates a cryptographic signature using HMAC-SHA1 algorithm based on\n        the sorted query parameters. This signature is used to authenticate\n        requests to the IFlyTek audit API.\n\n        :param query_param: Query parameters dictionary to be signed\n        :return: Base64 encoded signature string for API authentication\n        \"\"\"\n        # Use ordered dictionary to simulate TreeMap (sorted by key)\n        sorted_params = OrderedDict(sorted(query_param.items()))\n\n        # Remove signature parameter","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/core/workflow/infra/audit_system/audit_api/iflytek/ifly_audit_api.py#L101-L137","documentation":"IFlyAuditAPI.__init__ reads IFLYTEK_AUDIT_APP_ID, IFLYTEK_AUDIT_ACCESS_KEY_ID and IFLYTEK_AUDIT_ACCESS_KEY_SECRET from the environment. If any of them is empty AND AUDIT_ENABLE=1, it raises ValueError listing the missing variable names. The audit (content-security) integration is therefore strictly opt-in: enabling it without full credentials fails fast at construction time.","triggerScenarios":"Instantiating IFlyAuditAPI (directly or via the audit system bootstrap) with AUDIT_ENABLE=1 while one or more of IFLYTEK_AUDIT_APP_ID / IFLYTEK_AUDIT_ACCESS_KEY_ID / IFLYTEK_AUDIT_ACCESS_KEY_SECRET is unset or empty; note the check is skipped when AUDIT_ENABLE is 0/unset.","commonSituations":"Enabling the audit feature flag in a deployment (AUDIT_ENABLE=1) but forgetting to add the iFlytek audit credentials to the secret/env block; credentials present only in another environment/namespace; typos in variable names leaving the fallback '' in effect.","solutions":["Set the missing variables named in the error message (IFLYTEK_AUDIT_APP_ID, IFLYTEK_AUDIT_ACCESS_KEY_ID, IFLYTEK_AUDIT_ACCESS_KEY_SECRET) in the service environment/secret.","If content audit is not needed, keep AUDIT_ENABLE=0 (or unset) so the client is never constructed with partial config.","Check for typos in the env var names and that the secret is actually mounted into the workflow container.","Add a startup config check that validates the trio together whenever AUDIT_ENABLE=1."],"exampleFix":"// before (partial config)\nAUDIT_ENABLE=1\nIFLYTEK_AUDIT_APP_ID=my-app\n// after\nAUDIT_ENABLE=1\nIFLYTEK_AUDIT_APP_ID=my-app\nIFLYTEK_AUDIT_ACCESS_KEY_ID=ak-xxx\nIFLYTEK_AUDIT_ACCESS_KEY_SECRET=sk-xxx","handlingStrategy":"validation","validationCode":"import os\nREQUIRED = [\"IFLYTEK_AUDIT_APP_ID\", \"IFLYTEK_AUDIT_ACCESS_KEY_ID\", \"IFLYTEK_AUDIT_ACCESS_KEY_SECRET\"]\nif os.getenv(\"AUDIT_ENABLE\", \"0\") == \"1\":\n    missing = [k for k in REQUIRED if not os.getenv(k)]\n    assert not missing, f\"missing audit env vars: {missing}\"","typeGuard":null,"tryCatchPattern":"try:\n    audit_api = IFlyAuditAPI()\nexcept ValueError as e:\n    logger.error(f\"audit config incomplete: {e}\")\n    raise  # or fall back to a no-op audit client","preventionTips":["Treat AUDIT_ENABLE=1 as requiring the full credential trio in your deploy checklist/CI.","Keep audit credentials in the same secret/manifest as the feature flag so they ship together.","Run a startup smoke test that constructs IFlyAuditAPI when the flag is on."],"tags":["configuration","environment","content-safety","missing-credentials"],"backgroundTag":"missing-env-var","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}