What causes "reader cannot read token payload" in t8y2/dbx?

Wrap the payload in an io.Reader before passing it (bytes.NewReader(payload)).

reader cannot read token payload

Error message

reader cannot read token payload

What it means

This error is returned when a token-callback payload reader does not implement io.Reader, so the driver cannot pull the raw token bytes out of it. The validation function copies up to the stated length from the supplied reader via io.ReadFull, but a non-io.Reader value cannot be drained. It is a programming/interface-contract error rather than a runtime I/O failure.

Source

Thrown at agents/drivers/hive-go/config.go:815

	}
	return identifier, password, nil
}

func readHadoopByteArray(reader io.ByteReader) ([]byte, error) {
	length, err := readHadoopVInt(reader)
	if err != nil {
		return nil, err
	}
	if length < 0 {
		return nil, fmt.Errorf("negative length %d", length)
	}
	if length > 64*1024*1024 {
		return nil, fmt.Errorf("length %d exceeds limit", length)
	}
	value := make([]byte, int(length))
	byteReader, ok := reader.(io.Reader)
	if !ok {
		return nil, errors.New("reader cannot read token payload")
	}
	if _, err := io.ReadFull(byteReader, value); err != nil {
		return nil, err
	}
	return value, nil
}

func readHadoopVInt(reader io.ByteReader) (int64, error) {
	firstByte, err := reader.ReadByte()
	if err != nil {
		return 0, err
	}
	first := int8(firstByte)
	if first >= -112 {
		return int64(first), nil
	}
	length := -111 - int(first)
	negative := false

View on GitHub (pinned to c0390bff16)

Solutions

Wrap the payload in an io.Reader before passing it (bytes.NewReader(payload)).
Implement Read(p []byte) (int, error) on the custom type so it satisfies io.Reader.
Use a plain *bytes.Buffer or *strings.Reader for in-memory payloads.

Example fix

// before
agent.SetTokenReader(myTokenHolder) // myTokenHolder is not io.Reader
// after
agent.SetTokenReader(bytes.NewReader(myTokenHolder.Payload()))

Defensive patterns

Strategy: validation

Validate before calling

func isReader(v any) bool {
	_, ok := v.(io.Reader)
	return ok
}
if !isReader(tokenProvider) {
	return fmt.Errorf("token provider %T does not implement io.Reader", tokenProvider)
}

Type guard

func asReader(v any) (io.Reader, bool) {
	r, ok := v.(io.Reader)
	return r, ok
}

Prevention

Always pass *bytes.Reader, *bytes.Buffer, or *strings.Reader for in-memory token payloads
Add a compile-time assertion: var _ io.Reader = (*MyTokenType)(nil)
Run `go vet` and interface satisfaction checks in CI

When it happens

Trigger: Calling the token payload reader function with a value that is not an io.Reader (e.g. a struct, a string, or a custom type without a Read method), typically when wiring a custom token provider callback into the Hive agent config.

Common situations: Passing a custom token cache object that exposes its own Read-like method but does not implement the io.Reader interface; wrapping a reader in a type the author assumed was compatible; refactoring code that previously passed an *bytes.Reader.

Related errors

AI-assisted analysis of t8y2/dbx@c0390bff16 (2026-09-05). Data as JSON: /api/errors/7a4c23acdf8831a4. Report an issue: GitHub.