{"record":{"id":"1c30aeececa12292","repo":"elsa-workflows/elsa-core","slug":"secret-store-store-name-does-not-support-writing-secrets","errorCode":null,"errorMessage":"Secret store '{store.Name}' does not support writing secrets.","messagePattern":"Secret store '(.+?)' does not support writing secrets\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs","lineNumber":219,"sourceCode":"\n    private static SecretVersion GetLatestActiveVersion(Secret secret)\n    {\n        if (secret.Status != SecretStatus.Active)\n            throw new InvalidOperationException($\"Secret '{secret.Name}' is not active.\");\n\n        return secret.LatestActiveVersion ?? throw new InvalidOperationException($\"Secret '{secret.Name}' has no active version.\");\n    }\n\n    private void ValidateName(string name)\n    {\n        if (!nameValidator.IsValid(name, out var error))\n            throw new InvalidOperationException(error);\n    }\n\n    private static void EnsureCanWrite(ISecretStore store)\n    {\n        if (!store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write))\n            throw new InvalidOperationException($\"Secret store '{store.Name}' does not support writing secrets.\");\n    }\n\n    private static IEnumerable<Secret> ApplyFilters(IEnumerable<Secret> secrets, ListSecretsRequest request)\n    {\n        var query = secrets.Where(x => x.Status != SecretStatus.Deleted);\n\n        if (!string.IsNullOrWhiteSpace(request.Search))\n        {\n            var search = request.Search.Trim();\n            query = query.Where(x =>\n                x.Name.Contains(search, StringComparison.OrdinalIgnoreCase) ||\n                x.DisplayName.Contains(search, StringComparison.OrdinalIgnoreCase) ||\n                (x.Description?.Contains(search, StringComparison.OrdinalIgnoreCase) ?? false));\n        }\n\n        var typeNames = GetFilterValues(request.TypeName, request.TypeNames);\n        if (typeNames.Count > 0)\n            query = query.Where(x => typeNames.Contains(x.TypeName));","sourceCodeStart":201,"sourceCodeEnd":237,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs#L201-L237","documentation":"EnsureCanWrite validates that the target ISecretStore advertises the Write capability via SecretStoreCapabilities before mutating it. Read-only stores (e.g. config/deployment-backed stores) reject writes with this InvalidOperationException. It is a capability check, not an authentication failure.","triggerScenarios":"CreateSecretAsync or RotateAsync targeting a store whose Descriptor.Capabilities lacks SecretStoreCapabilities.Write — e.g. writing to a configuration-backed read-only store or specifying a store selector that resolves to one.","commonSituations":"Secret name routed to a read-only environment store; app configured with only a config-backed store; capability flags misconfigured in a custom store's Descriptor; trying to rotate infra-managed secrets from application code.","solutions":["Write the secret to a store that supports Write (register an encrypted/writable store).","Move the secret value into the read-only store's own configuration mechanism (appsettings/env/deployment).","Update the custom store's Descriptor.Capabilities to include Write if it actually supports it.","Check store selection/naming so the operation targets the intended writable store."],"exampleFix":"// before\nawait secretManager.CreateSecretAsync(new CreateSecretRequest { Name = \"ConnectionString\" }); // resolves to read-only config store\n// after\nawait secretManager.CreateSecretAsync(new CreateSecretRequest { Name = \"ConnectionString\", StoreName = \"ElsaEncryptedStore\" }); // writable store","handlingStrategy":"validation","validationCode":"var store = storeRegistry.GetStore(storeName);\nif (store is null || !store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write))\n    throw new InvalidOperationException($\"Store '{storeName}' is read-only; choose a writable store.\");","typeGuard":"bool CanWrite(ISecretStore store) => store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write);","tryCatchPattern":"try { await manager.CreateSecretAsync(request, ct); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"does not support writing\")) { logger.LogError(\"Target store is read-only; provision '{Name}' via deployment config instead\", request.Name); throw; }","preventionTips":["Mark infrastructure-managed secrets as config/env values, not runtime secrets","Verify store capabilities before wiring secret writes","Set an explicit StoreName on write requests"],"tags":["secrets","read-only","capability"],"backgroundTag":"unsupported-operation","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}