{"record":{"id":"1608601f0918f225","repo":"microsoft/aspire","slug":"aspireradius042","errorCode":"ASPIRERADIUS042","errorMessage":"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter '{binding.Parameter.Name}'. Bind a parameter created with secret: true. Diagnostic: ASPIRERADIUS042.","messagePattern":"Secret store '(.+?)' binds key '(.+?)' to the non-secret parameter '(.+?)'\\. Bind a parameter created with secret: true\\. Diagnostic: ASPIRERADIUS042\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":171,"sourceCode":"        // ASPIRERADIUS040 — type-aware required keys.\n        foreach (var required in store.Type.RequiredKeys())\n        {\n            if (!declaredKeys.Contains(required, StringComparer.Ordinal))\n            {\n                throw new InvalidOperationException(\n                    $\"Secret store '{store.Name}' of type '{store.Type.ToRadiusTypeString()}' is missing \" +\n                    $\"the required key '{required}'. Diagnostic: ASPIRERADIUS040.\");\n            }\n        }\n\n        // ASPIRERADIUS042 / ASPIRERADIUS047 — inline bindings must be secret and use valid encoding.\n        if (population.HasInlineData)\n        {\n            foreach (var (key, binding) in population.Data)\n            {\n                if (!binding.Parameter.Secret)\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter \" +\n                        $\"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. \" +\n                        \"Diagnostic: ASPIRERADIUS042.\");\n                }\n\n                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is \" +\n                        $\"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.\");\n                }\n            }\n        }\n\n        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,\n        // which awaits the SealedSecret controller. On any other population mode it would silently\n        // no-op, so reject an explicit override rather than mislead the author.\n        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)","sourceCodeStart":153,"sourceCodeEnd":189,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L153-L189","documentation":"ASPIRERADIUS042 requires that inline data bindings (WithData population) target secret parameters. When population.HasInlineData, ValidateStore iterates population.Data and throws for any binding whose Parameter.Secret is false — the value comes from a Secret at deploy time, so a non-secret parameter would be a type/semantics mismatch.","triggerScenarios":"Calling store.WithData().Add(key, parameter) where the parameter resource was created without secret: true, then validating the model.","commonSituations":"Reusing an ordinary value parameter for a secret binding; a helper that creates parameters without setting secret; refactoring parameter creation and losing the secret flag.","solutions":["Create the bound parameter with secret: true (e.g. WithParameter(..., secret: true)).","Bind a different, already-secret parameter instead.","Remove the inline binding if it should not target a secret parameter."],"exampleFix":"// before\nvar p = resource.WithParameter(\"apiKey\", \"...\");\nstore.WithData().Add(\"apiKey\", p);\n// after\nvar p = resource.WithParameter(\"apiKey\", secret: true);\nstore.WithData().Add(\"apiKey\", p);","handlingStrategy":"validation","validationCode":"foreach (var (key, binding) in population.Data)\n    if (!binding.Parameter.Secret)\n        throw new InvalidOperationException($\"{key} must bind a parameter created with secret: true\");","typeGuard":null,"tryCatchPattern":"try { /* validation runs */ }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS042\")) { /* recreate the parameter with secret: true */ }","preventionTips":["Always create inline-bound parameters with secret: true","Wrap parameter creation in a helper that enforces the secret flag","Validate the model in tests before deployment"],"tags":["validation","radius","secrets"],"backgroundTag":"invalid-argument-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}