{"record":{"id":"e0207480f0b59901","repo":"OpenNHP/opennhp","slug":"failed-to-refresh-sdp-s","errorCode":null,"errorMessage":"Failed to refresh SDP: %s","messagePattern":"Failed to refresh SDP: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"endpoints/agent/udpagent.go","lineNumber":1276,"sourceCode":"}\n\nfunc (a *UdpAgent) StartConfidentialComputing(ztdoId string, taId string, function string, params map[string]any) (any, error) {\n\tvar err error\n\tvar policyId string\n\n\toutput, refreshSdp, decrypted := a.PreCheckDataAccess(ztdoId)\n\n\tif refreshSdp {\n\t\ta.dataAccessRefreshMutex.Lock()\n\t\tdefer a.dataAccessRefreshMutex.Unlock()\n\n\t\t// secondly check again\n\t\toutput, refreshSdp, decrypted = a.PreCheckDataAccess(ztdoId)\n\n\t\tif refreshSdp {\n\t\t\toutput, err = a.RefreshDataAccess(ztdoId, decrypted, output)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"Failed to refresh SDP: %s\", err.Error())\n\t\t\t}\n\t\t}\n\t}\n\n\t// inject data path to params\n\tparams[\"path\"] = output\n\n\tvar exist bool\n\tif policyId, exist = a.smartPolicyIdentifier[ztdoId]; !exist {\n\t\treturn nil, fmt.Errorf(\"Error: fail to find policyId for ztdoId %s.\\n\", ztdoId)\n\t}\n\n\ttaRes, err := a.CallTrustedApplication(taId, function, params, policyId)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"fail to call trusted application with error: %s\\n\", err.Error())\n\t} else {\n\t\tvar structResult map[string]any\n","sourceCodeStart":1258,"sourceCodeEnd":1294,"githubUrl":"https://github.com/OpenNHP/opennhp/blob/6e04ca5ff03222a699c24205cd4bf8fee9af7ffe/endpoints/agent/udpagent.go#L1258-L1294","documentation":"In the confidential-computing data access flow, if PreCheckDataAccess indicates the smart data policy (SDP) must be refreshed, the agent calls RefreshDataAccess; any failure there is wrapped as 'Failed to refresh SDP'. It means the agent could not obtain/update the current policy needed before invoking the trusted application.","triggerScenarios":"AccessData flow where PreCheckDataAccess(ztdoId) sets refreshSdp=true (policy expired/absent) and RefreshDataAccess then fails — e.g. AC/server unreachable, ztdoId unknown, or policy decryption failing.","commonSituations":"Expired smart data policy during long-running sessions; network/auth problems with the NHP server; ztdoId typo or object deleted upstream.","solutions":["Inspect the wrapped inner error (the %s payload) for the root cause (network, auth, policy)","Verify the ztdoId exists and the agent can reach the NHP server/AC","Retry after re-knocking or re-establishing the NHP channel so the policy refresh can succeed"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// ensure channel is reachable before data access\nif a.device == nil || a.device.GetDecryptedMsgQueue() == nil {\n    return fmt.Errorf(\"agent channel not established; knock first\")\n}","typeGuard":null,"tryCatchPattern":"output, err := a.AccessData(ztdoId, ...)\nif err != nil && strings.Contains(err.Error(), \"Failed to refresh SDP\") {\n    // re-knock / re-establish session then retry once\n    if err := a.Knock(); err == nil {\n        output, err = a.AccessData(ztdoId, ...)\n    }\n}","preventionTips":["Refresh SDP proactively before policy expiry instead of on-demand","Monitor the wrapped inner error for recurring network/auth problems","Validate ztdoId against the provider before access"],"tags":["network","dhp","sdp","confidential-computing"],"backgroundTag":"http-request-failed","analyzedSha":"6e04ca5ff03222a699c24205cd4bf8fee9af7ffe","analyzedAt":"2026-09-07T15:44:59.941Z","contentChangedAt":"2026-09-07T15:44:59.941Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}