{"record":{"id":"2dee7bb1c3a07bc6","repo":"elsa-workflows/elsa-core","slug":"error","errorCode":null,"errorMessage":"{error}","messagePattern":"\\{error\\}","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs","lineNumber":70,"sourceCode":"        var secret = await GetExistingAsync(name, cancellationToken);\n\n        secret.DisplayName = string.IsNullOrWhiteSpace(request.DisplayName) ? secret.Name : request.DisplayName.Trim();\n        secret.Description = string.IsNullOrWhiteSpace(request.Description) ? null : request.Description.Trim();\n        secret.UpdatedAt = DateTimeOffset.UtcNow;\n\n        await repository.SaveAsync(secret, cancellationToken);\n        return secret;\n    }\n\n    public async Task<Secret> RotateAsync(string name, RotateSecretRequest request, CancellationToken cancellationToken = default)\n    {\n        var secret = await GetExistingAsync(name, cancellationToken);\n        if (secret.Status == SecretStatus.Revoked)\n            throw new InvalidOperationException($\"Secret '{secret.Name}' is revoked and cannot be rotated.\");\n\n        var provider = typeRegistry.Get(secret.TypeName);\n        if (!provider.ValidateRotation(request, secret.StoreName, out var error))\n            throw new InvalidOperationException(error);\n\n        var store = storeRegistry.Get(secret.StoreName);\n        EnsureCanWrite(store);\n        var nextVersion = secret.Versions.Count == 0 ? 1 : secret.Versions.Max(x => x.Version) + 1;\n        var version = new SecretVersion { Version = nextVersion, ExpiresAt = request.ExpiresAt };\n        version.Payload = await store.WriteAsync(secret, version, CreatePayload(request), cancellationToken);\n\n        foreach (var activeVersion in secret.Versions.Where(x => x.Status == SecretStatus.Active))\n            activeVersion.Status = SecretStatus.Retired;\n\n        secret.Versions.Add(version);\n        secret.Status = SecretStatus.Active;\n        secret.UpdatedAt = DateTimeOffset.UtcNow;\n        await repository.SaveAsync(secret, cancellationToken);\n\n        return secret;\n    }\n","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs#L52-L88","documentation":"This error's message is dynamic: it is whatever error string the secret type provider's ValidateRotation method produced when it rejected the rotation request. RotateAsync calls provider.ValidateRotation and, on failure, throws InvalidOperationException with the provider-supplied message.","triggerScenarios":"Calling ISecretManager.RotateAsync with a RotateSecretRequest that fails the specific secret type provider's validation rules - e.g. missing required fields, invalid value format for that secret type, or disallowed rotation parameters.","commonSituations":"Rotating a custom secret type whose rotation requirements (e.g. new value length/format, required metadata) are not met; API clients sending the same body used for a different secret type.","solutions":["Read the thrown message - it names the exact validation failure - and correct the RotateSecretRequest accordingly.","Consult the secret type provider's rotation requirements (descriptor/documentation) and supply all required fields.","Test the request against provider.ValidateRotation in a pre-check before calling RotateAsync.","Catch InvalidOperationException around RotateAsync to surface the provider error to the user."],"exampleFix":"// before\nawait manager.RotateAsync(\"api-key\", new RotateSecretRequest { Value = \"\" }); // provider rejects empty value\n// after\nvar request = new RotateSecretRequest { Value = newKey };\nif (!provider.ValidateRotation(request, storeName, out var error))\n    throw new InvalidOperationException(\"Fix rotation request: \" + error);\nawait manager.RotateAsync(\"api-key\", request);","handlingStrategy":"try-catch","validationCode":"// Pre-check using the same provider used by the manager\nif (!typeRegistry.Get(secret.TypeName).ValidateRotation(request, secret.StoreName, out var error)) throw new InvalidOperationException(error);","typeGuard":null,"tryCatchPattern":"try { await manager.RotateAsync(name, request); }\ncatch (InvalidOperationException e) { /* surface e.Message - it is the provider's validation error */ }","preventionTips":["Read the provider error message; it names the exact failing rule.","Keep rotation requests type-specific; do not reuse bodies across secret types.","Add contract tests for each secret type's rotation requirements."],"tags":["secrets","validation","rotation","provider"],"backgroundTag":"schema-validation-failed","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}