{"record":{"id":"ffa557f0d964805f","repo":"larksuite/cli","slug":"dpapi-protect-failed-w","errorCode":null,"errorMessage":"dpapi protect failed: %w","messagePattern":"dpapi protect failed: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/keychain/keychain_windows.go","lineNumber":124,"sourceCode":"\tb.Data = nil\n\tb.Size = 0\n}\n\n// platformGet retrieves a value from the Windows registry.\nfunc platformGet(service, account string) (string, error) {\n\tv, ok := registryGet(service, account)\n\tif !ok {\n\t\treturn \"\", nil\n\t}\n\treturn v, nil\n}\n\n// platformSet stores a value in the Windows registry.\nfunc platformSet(service, account, data string) error {\n\tentropy := dpapiEntropy(service, account)\n\tprotected, err := dpapiProtect([]byte(data), entropy)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"dpapi protect failed: %w\", err)\n\t}\n\treturn registrySet(service, account, protected)\n}\n\n// platformRemove deletes a value from the Windows registry.\nfunc platformRemove(service, account string) error {\n\treturn registryRemove(service, account)\n}\n\n// registryGet retrieves a string value from the registry under the given service and account.\nfunc registryGet(service, account string) (string, bool) {\n\tkeyPath := registryPathForService(service)\n\tk, err := registry.OpenKey(registry.CURRENT_USER, keyPath, registry.QUERY_VALUE)\n\tif err != nil {\n\t\treturn \"\", false\n\t}\n\tdefer k.Close()\n","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/keychain/keychain_windows.go#L106-L142","documentation":"This error wraps a failure of Windows DPAPI (CryptProtectData) when the keychain encrypts a secret before storing it in the registry. platformSet derives per-service/account entropy, calls dpapiProtect to encrypt the plaintext, and if that OS call fails the error is wrapped and propagated — nothing is written to the registry. The %w keeps the underlying syscall/OLE error for errors.Is/As.","triggerScenarios":"platformSet on Windows calls dpapiProtect([]byte(data), entropy) and the CryptProtectData call returns an error — before any registry write occurs.","commonSituations":"Corrupted user profile or DPAPI master keys; running as a service account/CI without a loaded user profile; credential roaming issues after domain password reset without key backup; running in a container or restricted token lacking DPAPI access.","solutions":["Read the wrapped cause for the specific DPAPI/Win32 error code.","Ensure the process runs in an interactive user session with a loaded user profile (not a bare service/Session 0 context).","If the user profile or master keys are corrupted, restore DPAPI keys from backup or recreate the user profile.","As a fallback, switch the credential storage backend (e.g. plaintext-with-permissions or OS-independent store) if the CLI supports it."],"exampleFix":"// before: running under a service with no user profile\nC:\\> sc create svc binPath= lark-cli.exe   // DPAPI fails\n\n// after: run in the user's interactive session\nC:\\Users\\dev> lark-cli auth login","handlingStrategy":"validation","validationCode":"// Windows: verify a user profile with DPAPI is available before storing secrets\nif !isInteractiveSession() || !userProfileLoaded() {\n    return errors.New(\"DPAPI requires an interactive user session with a loaded profile\")\n}","typeGuard":null,"tryCatchPattern":"if err := keychain.Set(service, account, secret); err != nil {\n    if strings.HasPrefix(err.Error(), \"dpapi protect failed:\") {\n        return fmt.Errorf(\"cannot encrypt credential (profile/DPAPI issue), run in an interactive session: %w\", err)\n    }\n    return err\n}","preventionTips":["Never store secrets from Session 0 / service contexts that lack a user profile.","Back up DPAPI master keys for domain users before password resets.","Test credential storage after major Windows/profile changes.","Prefer a documented fallback backend when DPAPI is unavailable."],"tags":["windows","dpapi","keychain","encryption"],"backgroundTag":"dpapi-encryption-failed","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}