{"record":{"id":"6f7845101823c25e","repo":"xpipe-io/xpipe","slug":"secret-is-not-accessible","errorCode":null,"errorMessage":"Secret is not accessible","messagePattern":"Secret is not accessible","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java","lineNumber":253,"sourceCode":"        var ar = JsonNodeFactory.instance.arrayNode();\n        for (var e : entries) {\n            var node = JsonNodeFactory.instance.objectNode();\n            node.put(\"name\", e.getPrincipal().getName());\n            node.put(\"principal\", e.getPrincipal().getUuid().toString());\n            node.put(\"iteration\", e.getIteration());\n            node.put(\"secret\", e.getEncrypted());\n            node.set(\"token\", JacksonMapper.getDefault().valueToTree(e.getToken()));\n            ar.add(node);\n        }\n\n        var secretsNode = JsonNodeFactory.instance.objectNode();\n        secretsNode.set(\"secrets\", ar);\n        return secretsNode;\n    }\n\n    public MultiPrincipalSecret withUpdatedPrincipals() {\n        if (!isAnyAccessible()) {\n            throw new IllegalStateException(\"Secret is not accessible\");\n        }\n\n        var scope = getScope();\n        var targetScope = DataStoreAccessScope.getTargetScope(scope);\n        return with(secret, targetScope);\n    }\n\n    public InPlaceSecretValue getInternalSecret() {\n        return secret;\n    }\n}\n","sourceCodeStart":235,"sourceCodeEnd":265,"githubUrl":"https://github.com/xpipe-io/xpipe/blob/d85ca821baa46092a320ebb13546d7240adb74f8/app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java#L235-L265","documentation":"MultiPrincipalSecret.withUpdatedPrincipals() re-encrypts the secret for the target access scope. It refuses to run when no principal's copy of the secret is currently accessible (isAnyAccessible() is false), because there would be no readable secret material to carry into the new scope. The library throws IllegalStateException since the caller has asked for an operation that is impossible in the current state.","triggerScenarios":"Calling withUpdatedPrincipals() when every underlying encrypted value fails to decrypt — e.g. the vault key/principal that stored the secret is unavailable, the secret was stored by another user, or encryption state was invalidated (Encrypt All mode changes).","commonSituations":"Opening a vault on a machine where the storage passphrase/principal differs from the one that encrypted the secrets; after enabling 'encrypt all' or changing encryption settings so old secrets are no longer readable; programmatically migrating secrets with a partially-loaded vault.","solutions":["Ensure the secret is readable first: check isAnyAccessible() and unlock the vault / supply the correct storage passphrase before calling withUpdatedPrincipals().","Re-enter or reset the vault credentials so at least one principal can decrypt the secret, then retry.","If the secret can never be decrypted, re-create it with fresh values instead of migrating it."],"exampleFix":"// before\nsecret.withUpdatedPrincipals(); // throws if nothing is accessible\n// after\nif (secret.isAnyAccessible()) {\n    secret.withUpdatedPrincipals();\n} else {\n    throw new UserException(\"Secret is locked; unlock the vault first\");\n}","handlingStrategy":"try-catch","validationCode":"if (!secret.isAnyAccessible()) {\n    throw new IllegalStateException(\"Unlock the vault before re-encrypting this secret\");\n}","typeGuard":"boolean canRescope(MultiPrincipalSecret s) { return s.isAnyAccessible(); }","tryCatchPattern":"try {\n    secret.withUpdatedPrincipals();\n} catch (IllegalStateException e) {\n    // prompt user to unlock the vault / fix encryption principal\n}","preventionTips":["Check isAnyAccessible() before any scope-migration call.","Keep vault credentials consistent across machines.","Handle Encrypt All mode changes by re-validating secrets afterwards."],"tags":["java","secrets","encryption","illegal-state"],"backgroundTag":"insufficient-permissions","analyzedSha":"d85ca821baa46092a320ebb13546d7240adb74f8","analyzedAt":"2026-09-06T14:30:08.251Z","contentChangedAt":"2026-09-06T14:30:08.251Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}