{"record":{"id":"e2b1c6b3c2b005df","repo":"semaphoreui/semaphore","slug":"vault-storage-id-is-required","errorCode":null,"errorMessage":"vault storage id is required","messagePattern":"vault storage id is required","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"services/server/access_key_encryption_svc.go","lineNumber":90,"sourceCode":"type accessKeyEncryptionServiceImpl struct {\n\taccessKeyRepo     db.AccessKeyManager\n\tenvironmentRepo   db.EnvironmentManager\n\tsecretStorageRepo db.SecretStorageRepository\n\tprojectRepo       db.ProjectStore\n}\n\nfunc (s *accessKeyEncryptionServiceImpl) getDeserializer(key *db.AccessKey) (AccessKeyDeserializer, bool, error) {\n\n\tif key.SourceStorageType == nil {\n\t\treturn &LocalAccessKeyDeserializer{}, false, nil\n\t}\n\n\tswitch *key.SourceStorageType {\n\tcase db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile:\n\t\treturn &LocalAccessKeyDeserializer{}, true, nil\n\tcase db.AccessKeySourceStorageVault:\n\t\tif key.SourceStorageID == nil {\n\t\t\treturn &LocalAccessKeyDeserializer{}, false, errors.New(\"vault storage id is required\")\n\t\t}\n\tdefault:\n\t\treturn nil, false, fmt.Errorf(\"unsupported secret storage type '%s'\", *key.SourceStorageType)\n\t}\n\n\tstorage, err := s.secretStorageRepo.GetSecretStorage(*key.ProjectID, *key.SourceStorageID)\n\tif err != nil {\n\t\treturn nil, false, err\n\t}\n\n\tswitch storage.Type {\n\tcase db.SecretStorageTypeVault, db.SecretStorageTypeOpenBao:\n\t\treturn pro.NewVaultAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeDvls:\n\t\treturn pro.NewDvlsAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeAwsSm:\n\t\treturn pro.NewAwsSmAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeAzureKv:","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/services/server/access_key_encryption_svc.go#L72-L108","documentation":"getDeserializer requires SourceStorageID when an access key's secret is sourced from vault storage (db.AccessKeySourceStorageVault). Without a storage ID the service cannot look up which vault storage to use, so it returns this error (still handing back a local deserializer with readonly=false as a safe fallback result).","triggerScenarios":"SerializeSecret, DeserializeSecret, or DeleteSecret on an access key whose SourceStorageType is AccessKeySourceStorageVault while key.SourceStorageID is nil.","commonSituations":"Access keys created/imported before vault-storage fields existed; keys created programmatically with the storage type set but the storage ID left unset; data migration gaps.","solutions":["Set SourceStorageID on the access key to the ID of the intended vault secret storage for its project.","Recreate the access key selecting the vault storage in the UI so both fields are populated.","If the key should be local (env/file), change SourceStorageType to env or file instead of vault."],"exampleFix":"// before\nkey := db.AccessKey{SourceStorageType: &vaultType}\n// after\nstorageID := 3\nkey := db.AccessKey{SourceStorageType: &vaultType, SourceStorageID: &storageID}","handlingStrategy":"validation","validationCode":"if *key.SourceStorageType == db.AccessKeySourceStorageVault && key.SourceStorageID == nil {\n    return errors.New(\"vault-sourced key requires SourceStorageID\")\n}","typeGuard":"func vaultStorageIDSet(k db.AccessKey) bool {\n    return k.SourceStorageType == nil || *k.SourceStorageType != db.AccessKeySourceStorageVault || k.SourceStorageID != nil\n}","tryCatchPattern":"if err := svc.DeserializeSecret(&key); err != nil {\n    if strings.Contains(err.Error(), \"vault storage id is required\") {\n        return fmt.Errorf(\"key %q misconfigured: pick a vault storage for it\", key.Name)\n    }\n    return err\n}","preventionTips":["Enforce SourceStorageID at key-creation time when type is vault.","Backfill missing SourceStorageID values after migrations.","Validate access keys via API constraints, not just UI forms."],"tags":["secrets","vault","access-key","validation"],"backgroundTag":"missing-required-argument","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}