{"record":{"id":"f4653909078c45db","repo":"Tencent/WeKnora","slug":"failed-to-get-file-from-oss-w","errorCode":null,"errorMessage":"failed to get file from OSS: %w","messagePattern":"failed to get file from OSS: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/application/service/file/oss.go","lineNumber":304,"sourceCode":"\t\treturn nil, err\n\t}\n\tif err := utils.SafeObjectKey(objectName); err != nil {\n\t\treturn nil, fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\n\tvar client *oss.Client\n\tif bucketName == s.tempBucketName && s.tempClient != nil {\n\t\tclient = s.tempClient\n\t} else {\n\t\tclient = s.client\n\t}\n\n\tresp, err := client.GetObject(ctx, &oss.GetObjectRequest{\n\t\tBucket: oss.Ptr(bucketName),\n\t\tKey:    oss.Ptr(objectName),\n\t})\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get file from OSS: %w\", err)\n\t}\n\n\treturn resp.Body, nil\n}\n\n// DeleteFile removes a file from OSS.\nfunc (s *ossFileService) DeleteFile(ctx context.Context, filePath string) error {\n\tbucketName, objectName, err := parseOssFilePath(filePath)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif err := utils.SafeObjectKey(objectName); err != nil {\n\t\treturn fmt.Errorf(\"invalid file path: %w\", err)\n\t}\n\n\tvar client *oss.Client\n\tif bucketName == s.tempBucketName && s.tempClient != nil {\n\t\tclient = s.tempClient","sourceCodeStart":286,"sourceCodeEnd":322,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/application/service/file/oss.go#L286-L322","documentation":"This error is returned by ossFileService.GetFile when the client.GetObject call fails. Path parsing and key validation have already passed, so this reflects an OSS-level failure. The SDK error is wrapped so callers can inspect the OSS error code (NoSuchKey, AccessDenied, signature errors, etc.).","triggerScenarios":"Calling GetFile with a valid oss:// path where GetObject fails: object deleted or never uploaded, bucket mismatch, temp-bucket path routed to the wrong client, missing oss:GetObject permission, expired credentials, or network failure.","commonSituations":"Downloading a file whose DB record outlived the OSS object (temp objects reaped after TTL); temp bucket configured in DB paths but tempClient not configured in this environment; expired STS credentials; wrong-region endpoint causing 403/404-style failures.","solutions":["Unwrap the error and check for NoSuchKey — treat as 'file not found' rather than a system error.","Confirm temp-bucket routing: if bucketName == tempBucketName, ensure tempClient is configured.","Verify credentials and oss:GetObject permission on the bucket/key.","Check that the OSS endpoint/region matches the bucket.","Retry transient network/5xx failures with backoff."],"exampleFix":"// before\nbody, err := svc.GetFile(ctx, filePath)\nif err != nil {\n    return fmt.Errorf(\"download failed: %w\", err)\n}\n// after\nbody, err := svc.GetFile(ctx, filePath)\nvar svcErr *oss.ServiceError\nif errors.As(err, &svcErr) && svcErr.Code == \"NoSuchKey\" {\n    return ErrFileNotFound\n}","handlingStrategy":"type-guard","validationCode":"// pre-checks before GetFile\nif !strings.HasPrefix(filePath, \"oss://\") { return ErrWrongBackend }\nif _, key, _ := parseOssFilePath(filePath); utils.SafeObjectKey(key) != nil { return ErrBadPath }","typeGuard":"func isOSSNoSuchKey(err error) bool {\n    var svcErr *oss.ServiceError\n    return errors.As(err, &svcErr) && svcErr.Code == \"NoSuchKey\"\n}","tryCatchPattern":"reader, err := svc.GetFile(ctx, filePath)\nvar svcErr *oss.ServiceError\nswitch {\ncase err == nil:\n    defer reader.Close()\ncase errors.As(err, &svcErr) && svcErr.Code == \"NoSuchKey\":\n    return ErrFileNotFound\ncase errors.As(err, &svcErr) && svcErr.Code == \"AccessDenied\":\n    return ErrPermission\ndefault:\n    return fmt.Errorf(\"get failed: %w\", err) // retry transient\n}","preventionTips":["Treat NoSuchKey as 'not found', not a system failure.","Ensure tempClient is configured wherever temp-bucket paths exist.","Check oss:GetObject permission for the service role.","Match endpoint region to bucket region.","Close the returned reader to avoid connection leaks."],"tags":["oss","download","getobject","alibaba-cloud","permissions"],"backgroundTag":"oss-getobject-failed","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}