{"record":{"id":"4ef79cbe987618ca","repo":"semaphoreui/semaphore","slug":"unsupported-secret-storage-type-s","errorCode":null,"errorMessage":"unsupported secret storage type '%s'","messagePattern":"unsupported secret storage type '(.+?)'","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"services/server/access_key_encryption_svc.go","lineNumber":93,"sourceCode":"\tsecretStorageRepo db.SecretStorageRepository\n\tprojectRepo       db.ProjectStore\n}\n\nfunc (s *accessKeyEncryptionServiceImpl) getDeserializer(key *db.AccessKey) (AccessKeyDeserializer, bool, error) {\n\n\tif key.SourceStorageType == nil {\n\t\treturn &LocalAccessKeyDeserializer{}, false, nil\n\t}\n\n\tswitch *key.SourceStorageType {\n\tcase db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile:\n\t\treturn &LocalAccessKeyDeserializer{}, true, nil\n\tcase db.AccessKeySourceStorageVault:\n\t\tif key.SourceStorageID == nil {\n\t\t\treturn &LocalAccessKeyDeserializer{}, false, errors.New(\"vault storage id is required\")\n\t\t}\n\tdefault:\n\t\treturn nil, false, fmt.Errorf(\"unsupported secret storage type '%s'\", *key.SourceStorageType)\n\t}\n\n\tstorage, err := s.secretStorageRepo.GetSecretStorage(*key.ProjectID, *key.SourceStorageID)\n\tif err != nil {\n\t\treturn nil, false, err\n\t}\n\n\tswitch storage.Type {\n\tcase db.SecretStorageTypeVault, db.SecretStorageTypeOpenBao:\n\t\treturn pro.NewVaultAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeDvls:\n\t\treturn pro.NewDvlsAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeAwsSm:\n\t\treturn pro.NewAwsSmAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\tcase db.SecretStorageTypeAzureKv:\n\t\treturn pro.NewAzureKvAccessKeyDeserializer(s.accessKeyRepo, s.secretStorageRepo, s), storage.ReadOnly, nil\n\t}\n","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/semaphoreui/semaphore/blob/1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa/services/server/access_key_encryption_svc.go#L75-L111","documentation":"getDeserializer only supports env, file, and vault as access key secret source storage types. Any other SourceStorageType value hits the default branch and yields this error, refusing to build a deserializer for an unknown storage backend.","triggerScenarios":"SerializeSecret/DeserializeSecret/DeleteSecret on an access key whose *key.SourceStorageType is not one of db.AccessKeySourceStorageEnv, AccessKeySourceStorageFile, or AccessKeySourceStorageVault.","commonSituations":"Corrupted or hand-edited database rows; keys created by a newer Semaphore version with a storage type this build doesn't know; API clients posting invalid SourceStorageType values.","solutions":["Fix the access key's SourceStorageType to a supported value (env, file, or vault).","Align Semaphore versions so the key's storage type is known to this build (upgrade or re-create the key from a compatible version).","Audit keys created via API/imports to ensure only valid storage type constants are written."],"exampleFix":"// before\nkey.SourceStorageType = &weirdType // \"database\"\n// after\nvaultType := db.AccessKeySourceStorageVault\nkey.SourceStorageType = &vaultType","handlingStrategy":"validation","validationCode":"switch *key.SourceStorageType {\ncase db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile, db.AccessKeySourceStorageVault:\n    // ok\ndefault:\n    return fmt.Errorf(\"storage type %q not supported\", *key.SourceStorageType)\n}","typeGuard":"func knownStorageType(t *db.AccessKeySourceStorageType) bool {\n    if t == nil { return true }\n    switch *t {\n    case db.AccessKeySourceStorageEnv, db.AccessKeySourceStorageFile, db.AccessKeySourceStorageVault:\n        return true\n    }\n    return false\n}","tryCatchPattern":"if err := svc.DeserializeSecret(&key); err != nil {\n    if strings.Contains(err.Error(), \"unsupported secret storage type\") {\n        return fmt.Errorf(\"key %q uses a storage type unknown to this build; recreate it\", key.Name)\n    }\n    return err\n}","preventionTips":["Only set SourceStorageType from the exported db constants.","Keep server and runner builds on versions that share the same storage-type set.","Validate imported/API-created keys against the allowed type constants."],"tags":["secrets","storage","access-key","enum"],"backgroundTag":"unsupported-enum-value","analyzedSha":"1774ccb71a0a8b82eb74ea24c23ac9ab713de2fa","analyzedAt":"2026-09-07T11:00:33.293Z","contentChangedAt":"2026-09-07T11:00:33.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}