{"record":{"id":"4030b2f4486c1b30","repo":"xpipe-io/xpipe","slug":"principal-name-is-not-accessible","errorCode":null,"errorMessage":"Principal ${name} is not accessible","messagePattern":"Principal (.+?) is not accessible","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java","lineNumber":167,"sourceCode":"                    if (iteration > maxAccessibleIteration) {\n                        maxAccessibleIteration = iteration;\n                        maxAccessibleSecret = secret.inPlace();\n                    }\n                }\n            }\n        }\n\n        if (entries.isEmpty()) {\n            return null;\n        }\n\n        return new MultiPrincipalSecret(entries, maxAccessibleSecret);\n    }\n\n    public static MultiPrincipalSecret of(SecretValue internalSecret, Set<EncryptionPrincipal> principals) {\n        for (EncryptionPrincipal principal : principals) {\n            if (!principal.isAccessible()) {\n                throw new IllegalArgumentException(\"Principal \" + principal.getName() + \" is not accessible\");\n            }\n        }\n\n        var l = new ArrayList<Entry>();\n        for (EncryptionPrincipal principal : principals) {\n            var enc = AesSecretValue.encrypt(internalSecret.getSecret(), principal.getSecretKey());\n            l.add(new Entry(principal, enc.getEncryptedValue(), 1, EncryptionToken.of(principal)));\n        }\n        return new MultiPrincipalSecret(l, internalSecret.inPlace());\n    }\n\n    public MultiPrincipalSecret with(InPlaceSecretValue secret, DataStoreAccessScope scope) {\n        if (!supportsScopeEncryption(scope)) {\n            throw new IllegalArgumentException(\"Scope \" + scope + \" is not supported\");\n        }\n\n        var secretUnchanged = secret == null || Arrays.equals(secret.getSecret(), this.secret.getSecret());\n        if (secretUnchanged && getScope().equals(scope) && isScopeValid()) {","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/xpipe-io/xpipe/blob/d85ca821baa46092a320ebb13546d7240adb74f8/app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java#L149-L185","documentation":"MultiPrincipalSecret.of() encrypts an internal secret for each provided EncryptionPrincipal. Before encrypting, every principal must report isAccessible() == true (i.e. its key material can be loaded). If any principal is inaccessible, the factory refuses and throws this IllegalArgumentException rather than producing a partially-encrypted secret.","triggerScenarios":"Calling MultiPrincipalSecret.of(secret, principals) where at least one principal in the set returns false from isAccessible() — e.g. its underlying key/credential is missing, rotated, or from a now-unavailable storage backend.","commonSituations":"Restoring a secrets file on a machine whose keyring/account no longer matches; principals referencing removed user accounts or stale hardware keys; passing a mix of valid and legacy principals.","solutions":["Filter the principal set to only principals where isAccessible() is true before calling of()","Re-create or re-link the inaccessible principal (restore its key/credentials)","Remove stale principals from the configured set"],"exampleFix":"// before\nvar s = MultiPrincipalSecret.of(secret, allPrincipals);\n// after\nvar usable = allPrincipals.stream().filter(EncryptionPrincipal::isAccessible).collect(toSet());\nvar s = MultiPrincipalSecret.of(secret, usable);","handlingStrategy":"validation","validationCode":"var usable = principals.stream().filter(EncryptionPrincipal::isAccessible).collect(java.util.stream.Collectors.toSet());\nif (usable.size() != principals.size()) { /* drop or repair inaccessible principals */ }","typeGuard":"java.util.function.Predicate<EncryptionPrincipal> accessible = EncryptionPrincipal::isAccessible;","tryCatchPattern":"try { MultiPrincipalSecret.of(secret, principals); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"is not accessible\")) { /* filter principals and retry */ } else throw e; }","preventionTips":["Check isAccessible() on every principal before encryption","Prune stale principals after key/account changes","Log which principal failed for diagnostics"],"tags":["secrets","encryption","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"d85ca821baa46092a320ebb13546d7240adb74f8","analyzedAt":"2026-09-06T14:30:08.251Z","contentChangedAt":"2026-09-06T14:30:08.251Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}