Skip to content

fix(sdk-core): handle 404 key not found in getEncryptedUserKeychain#9339

Draft
bitgo-ai-agent-dev[bot] wants to merge 1 commit into
masterfrom
WCN-1586-trade-republic-key-not-found
Draft

fix(sdk-core): handle 404 key not found in getEncryptedUserKeychain#9339
bitgo-ai-agent-dev[bot] wants to merge 1 commit into
masterfrom
WCN-1586-trade-republic-key-not-found

Conversation

@bitgo-ai-agent-dev

Copy link
Copy Markdown

What

  • In getEncryptedUserKeychain() (modules/sdk-core/src/bitgo/wallet/wallet.ts), catch ApiResponseError with HTTP status 404 inside tryKeyChain and fall through to the next key, rather than propagating the error to callers.
  • Added a unit test covering the case where all key-fetch requests return 404.

Why

  • Trade Republic customers are unable to add a user to their cold storage wallets because getEncryptedUserKeychain() throws ApiResponseError("key not found", 404) when the backend has no keychain record for a key ID.
  • Cold storage wallets (and KMS-backed wallets) may reference key IDs in wallet.keys that have no corresponding keychain record on the server — those keys are stored offline or in KMS, not in the regular key store. A 404 from GET /api/v2/{coin}/key/{id} is therefore expected and should be handled the same as a key that exists but has no encryptedPrv: skip it and try the next one.
  • When all keys are exhausted (all 404 or all missing encryptedPrv), the function throws MissingEncryptedKeychainError, which prepareSharedKeychain already handles correctly by returning {} (i.e. skipKeychain: true) — the correct cold-wallet code path.
  • Previously, MissingEncryptedKeychainError was only thrown when all keys had no encryptedPrv (index past end of array), but a 404 ApiResponseError was never caught, breaking the wallet share flow for cold storage wallets.

Test plan

  • New unit test: should share wallet when key fetch returns 404 (cold wallet with missing key records) — all three key fetches mock 404 and the share completes with skipKeychain: true.
  • Existing cold-wallet sharing tests (should share to cold wallet without passing skipKeychain) continue to pass.
  • All 15 Wallet Sharing unit tests pass.
  • sdk-core unit tests (525) pass.

Ticket: WCN-1586

When sharing a wallet (e.g. cold storage wallets), getEncryptedUserKeychain
iterates through wallet.keys and fetches each key from the backend. For cold
storage wallets like Trade Republic's, some key records may not exist on the
server (they return 404 "key not found" instead of a 200 with no encryptedPrv).

Previously this 404 ApiResponseError was uncaught and propagated to the caller,
breaking the wallet share flow even though the correct behaviour is to treat a
missing key record the same as a key with no encryptedPrv: skip it and try the
next key. If all keys are absent or have no encryptedPrv, the function throws
MissingEncryptedKeychainError, which prepareSharedKeychain already handles by
returning {} (skipKeychain: true) — the cold-wallet code path.

The fix catches ApiResponseError with status 404 inside tryKeyChain and falls
through to the next key, mirroring the existing no-encryptedPrv skip. No
behaviour change for hot wallets or any 4xx/5xx other than 404.

Ticket: WCN-1586
Session-Id: 5f46d7d1-4497-4665-8b70-7c1a40459cb2
Task-Id: 6119806c-2d1f-4106-896f-7bf304043f2c
@bitgo-ai-agent-dev
bitgo-ai-agent-dev Bot force-pushed the WCN-1586-trade-republic-key-not-found branch from 1888fe5 to 0f0b751 Compare July 23, 2026 09:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants