{"record":{"id":"fe95bba0fe3d207f","repo":"risingwavelabs/risingwave","slug":"unspecified-secret-ref-type-0","errorCode":null,"errorMessage":"unspecified secret ref type: {0}","messagePattern":"unspecified secret ref type: (.+?)","errorType":"exception","errorClass":"SecretError","httpStatus":null,"severity":"error","filePath":"src/common/secret/src/error.rs","lineNumber":34,"sourceCode":"use thiserror::Error;\nuse thiserror_ext::Construct;\n\nuse super::SecretId;\n\npub type SecretResult<T> = Result<T, SecretError>;\n\n#[derive(Error, Debug, Construct)]\npub enum SecretError {\n    #[error(\"secret not found: {0}\")]\n    ItemNotFound(SecretId),\n\n    #[error(\"decode utf8 error: {0}\")]\n    DecodeUtf8Error(#[from] std::string::FromUtf8Error),\n\n    #[error(\"I/O error: {0}\")]\n    IoError(#[from] std::io::Error),\n\n    #[error(\"unspecified secret ref type: {0}\")]\n    UnspecifiedRefType(SecretId),\n\n    #[error(\"failed to encrypt or decrypt the secret\")]\n    AesError,\n\n    #[error(\"ser/de proto message error: {0}\")]\n    ProtoError(#[from] bincode::Error),\n\n    #[error(transparent)]\n    Internal(#[from] anyhow::Error),\n}\n","sourceCodeStart":16,"sourceCodeEnd":46,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/common/secret/src/error.rs#L16-L46","documentation":"SecretError::UnspecifiedRefType is raised when a secret reference carries a SecretId but the reference's type field is not set (unspecified), so the secret resolver cannot tell how to interpret or look up the reference. The SecretId is included in the message for diagnosis.","triggerScenarios":"Constructing or deserializing a secret ref (e.g. from protobuf) where the type/ref-kind field is left at its default/unspecified value and then attempting to resolve it, producing SecretError::UnspecifiedRefType(id).","commonSituations":"A protobuf message for a secret reference was built without setting the ref type oneof/enum (default zero value); older clients or proto schema drift omitting a newly required field; hand-written serialization of a secret ref skipping the type.","solutions":["Set the reference type explicitly when building the secret ref in the client/SQL layer.","Upgrade/fix the component that produced the proto so it fills the ref type field.","Inspect the stored proto message for the given SecretId and re-create it with a valid type."],"exampleFix":"// before\nlet ref = SecretRef { id: some_id, ..Default::default() }; // type unspecified\nresolve(ref)?;\n\n// after\nlet ref = SecretRef { id: some_id, ref_type: RefType::Compat, ..Default::default() };\nresolve(ref)?;","handlingStrategy":"validation","validationCode":"// Validate a secret ref has a concrete type before resolving:\nfn ref_type_is_set(r: &SecretRef) -> bool {\n    !matches!(r.ref_type, None | Some(RefType::Unspecified))\n}","typeGuard":"fn valid_secret_ref(r: &SecretRef) -> Option<&SecretRef> {\n    match r.ref_type {\n        Some(RefType::Unspecified) | None => None,\n        Some(_) => Some(r),\n    }\n}","tryCatchPattern":"match resolver.resolve(&secret_ref).await {\n    Ok(secret) => secret,\n    Err(SecretError::UnspecifiedRefType(id)) => {\n        // producer bug: ref built without setting its type — reject and re-create\n        return Err(anyhow!(\"secret ref {id} has no type; rebuild the reference\"));\n    }\n    Err(e) => return Err(e.into()),\n}","preventionTips":["Always set the ref type field when constructing secret refs in proto/client code.","Avoid ..Default::default() on secret ref protos; fill required fields explicitly.","Keep proto definitions in sync across frontend/meta versions.","Validate refs at creation time instead of at resolution time."],"tags":["secret","proto","missing-field"],"backgroundTag":"missing-required-config-field","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}