dbt-labs/dbt-core · error

validated above

Error message

validated above

What it means

This is a Rust panic from `.expect("validated above")` on `config.get_str("user")` while building `SnowflakeAuthIR::KeypairPath`/`KeypairInline` in the Snowflake keypair auth parser. The library asserts that an earlier validation step guaranteed the `user` key exists; if the invariant is broken the thread panics instead of returning an `AuthError`. It is an internal-invariant assertion, not a user-facing error message.

Source

Thrown at crates/dbt-auth/src/snowflake/mod.rs:524

                                "Snowflake keypair authentication requires 'user'.",
                            ));
                        }
                        if config.contains_key("password") {
                            warn_ignored_auth_field(warning_printer, "keypair", "password");
                        }

                        // We found a passphrase, so we MUST find a key source to go with it
                        let path = config.get_str("private_key_path");
                        let raw = config.get_str("private_key");

                        match (path, raw) {
                            (Some(p), _) => Ok(SnowflakeAuthIR::KeypairPath {
                                user: config.get_str("user").expect("validated above"),
                                path: p,
                                passphrase: Some(value),
                            }),
                            (None, Some(r)) => Ok(SnowflakeAuthIR::KeypairInline {
                                user: config.get_str("user").expect("validated above"),
                                private_key: r,
                                passphrase: Some(value),
                            }),
                            (None, None) => Err(AuthError::config(
                                "Found 'private_key_passphrase' but missing 'private_key_path' or 'private_key'",
                            )),
                        }
                    }
                    "oauth_client_id" | "oauth_client_secret" => {
                        // TODO(versusfacit): reenable warnings when possible
                        // if config.contains_key("user") {
                        //     warn_ignored_auth_field(warning_printer, "OAuth", "user");
                        // }
                        // if config.contains_key("password") {
                        //     warn_ignored_auth_field(warning_printer, "OAuth", "password");
                        // }

                        let cid = config.get_str("oauth_client_id");

View on GitHub (pinned to 0267ce9170)

Solutions

1. Add a `user` key (as a plain string) to the snowflake profile config before calling configure
2. Check for a library bug where the validation branch for this authenticator does not actually check `user`; report/patch the mismatch
3. Upgrade dbt-auth — newer versions may return `AuthError::config("... requires 'user'")` instead of panicking

Example fix

// before
cfg = {"method": "keypair", "private_key_path": "/k.p8", "private_key_passphrase": "x"}
// after
cfg = {"method": "keypair", "user": "MY_USER", "private_key_path": "/k.p8", "private_key_passphrase": "x"}

let user = config.get_str("user").ok_or_else(|| AuthError::config("Snowflake keypair auth requires 'user'."))?;

fn has_str(config: &AdapterConfig, key: &str) -> bool { config.get_str(key).is_some() }

When it happens

Trigger: Calling `SnowflakeAuth::configure` (or the IR parser) with a snowflake keypair config where `private_key_path`/`private_key`/`private_key_passphrase` validation succeeds but the `user` key is absent or not a string — i.e. a code path where validation and extraction disagree (e.g. `user` present as a non-string YAML value).

Common situations: Config mistakes: `user` omitted or typed as a number/null in profiles.yml while using `method: keypair` with `private_key_path` or inline `private_key`; downstream code in dbt-core sending an AdapterConfig with user nested under a different key.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

Related errors

• metadata query plan always includes metadata SQL
• Schema not found for canonical FQN: {}
• `EnterGuard` values dropped out of order. Guards returned by
• {e} {:?}
• {e}

AI-assisted analysis of dbt-labs/dbt-core@0267ce9170 (2026-09-07). Data as JSON: /api/errors/8c98b913eb8db17c. Report an issue: GitHub.