zeroclaw-labs/zeroclaw · error · anyhow::Error

microsoft365: token_cache_encrypted is enabled but encryptio

Error message

microsoft365: token_cache_encrypted is enabled but encryption is not yet implemented; refusing to store tokens in plaintext. Set token_cache_encrypted to false or wait for encryption support.

What it means

Error "microsoft365: token_cache_encrypted is enabled but encryption is not yet implemented; refusing to store tokens in plaintext. Set token_cache_encrypted to false or wait for encryption support." thrown in zeroclaw-labs/zeroclaw.

Source

Thrown at crates/zeroclaw-tools/src/microsoft365/auth.rs:42

}

/// Thread-safe token cache with disk persistence.
pub struct TokenCache {
    inner: RwLock<Option<CachedTokenState>>,
    /// Serialises the slow acquire/refresh path so only one caller performs the
    /// network round-trip while others wait and then read the updated cache.
    acquire_lock: Mutex<()>,
    config: super::types::Microsoft365ResolvedConfig,
    cache_path: PathBuf,
}

impl TokenCache {
    pub fn new(
        config: super::types::Microsoft365ResolvedConfig,
        zeroclaw_dir: &std::path::Path,
    ) -> anyhow::Result<Self> {
        if config.token_cache_encrypted {
            anyhow::bail!(
                "microsoft365: token_cache_encrypted is enabled but encryption is not yet \
                 implemented; refusing to store tokens in plaintext. Set token_cache_encrypted \
                 to false or wait for encryption support."
            );
        }

        // Scope cache file to (tenant_id, client_id, auth_flow) so config
        // changes never reuse tokens from a different account/flow.
        let mut hasher = DefaultHasher::new();
        config.tenant_id.hash(&mut hasher);
        config.client_id.hash(&mut hasher);
        config.auth_flow.hash(&mut hasher);
        let fingerprint = format!("{:016x}", hasher.finish());

        let cache_path = zeroclaw_dir.join(format!("ms365_token_cache_{fingerprint}.json"));
        let cached = Self::load_from_disk(&cache_path);
        Ok(Self {
            inner: RwLock::new(cached),

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Set token_cache_encrypted to false, or wait for encryption support before enabling it.

When it happens

Trigger: Thrown at crates/zeroclaw-tools/src/microsoft365/auth.rs:42 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/7282d4c00de231d9. Report an issue: GitHub.