{"record":{"id":"83f489dfaa44fbe1","repo":"elsa-workflows/elsa-core","slug":"secret-reference-name-is-not-compatible-with-required-scope","errorCode":null,"errorMessage":"Secret '{reference.Name}' is not compatible with required scope '{reference.Scope}'.","messagePattern":"Secret '(.+?)' is not compatible with required scope '(.+?)'\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretResolver.cs","lineNumber":17,"sourceCode":"namespace Elsa.Secrets.Services;\n\npublic class DefaultSecretResolver(ISecretManager secretManager) : ISecretResolver\n{\n    public Task<string> ResolveAsync(string name, CancellationToken cancellationToken = default) => ResolveAsync(new SecretReference(name), cancellationToken);\n\n    public async Task<string> ResolveAsync(SecretReference reference, CancellationToken cancellationToken = default)\n    {\n        var secret = await secretManager.GetAsync(reference.Name, cancellationToken);\n        if (secret == null)\n            throw new InvalidOperationException($\"Secret '{reference.Name}' was not found.\");\n\n        if (!string.IsNullOrWhiteSpace(reference.TypeName) && !string.Equals(secret.TypeName, reference.TypeName, StringComparison.OrdinalIgnoreCase))\n            throw new InvalidOperationException($\"Secret '{reference.Name}' is not compatible with required type '{reference.TypeName}'.\");\n\n        if (!string.IsNullOrWhiteSpace(reference.Scope) && !string.Equals(secret.Scope, reference.Scope, StringComparison.OrdinalIgnoreCase))\n            throw new InvalidOperationException($\"Secret '{reference.Name}' is not compatible with required scope '{reference.Scope}'.\");\n\n        var payload = await secretManager.ResolvePayloadAsync(secret, cancellationToken);\n        return payload.Value!;\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretResolver.cs#L1-L23","documentation":"ResolveAsync optionally validates that the secret's Scope matches the SecretReference.Scope (case-insensitive) and throws InvalidOperationException on mismatch. This enforces that secrets are only consumed within their intended scope (environment/tenant/module). Fires only when the reference specifies a Scope.","triggerScenarios":"Resolving a SecretReference with Scope set while the stored secret's Scope differs (or is null), e.g. reference scoped to 'Production' but secret scoped to 'Staging'.","commonSituations":"Promoting configuration between environments where scope labels differ; multi-tenant setups with per-tenant scoped secrets; scope renamed during refactoring.","solutions":["Align the reference Scope with the secret's actual Scope.","Update the secret's Scope to the expected value if appropriate.","Create a correctly scoped secret for the target environment/tenant.","Remove Scope from the reference if cross-scope access is intended."],"exampleFix":"// before\nvar value = await resolver.ResolveAsync(new SecretReference(\"SftpPassword\", scope: \"Production\"));\n// after\nvar value = await resolver.ResolveAsync(new SecretReference(\"SftpPassword\", scope: \"Staging\")); // matches secret.Scope","handlingStrategy":"validation","validationCode":"var secret = await secretManager.GetAsync(reference.Name, ct);\nif (secret is not null && !string.IsNullOrEmpty(reference.Scope) &&\n    !string.Equals(secret.Scope, reference.Scope, StringComparison.OrdinalIgnoreCase))\n    throw new InvalidOperationException($\"Scope mismatch for secret '{reference.Name}'.\");","typeGuard":"bool ScopeMatches(Secret? s, string? expected) =>\n    string.IsNullOrEmpty(expected) || string.Equals(s?.Scope, expected, StringComparison.OrdinalIgnoreCase);","tryCatchPattern":"try { var value = await resolver.ResolveAsync(reference, ct); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"not compatible with required scope\")) { logger.LogError(\"Secret {Name} scope mismatch: {Msg}\", reference.Name, ex.Message); throw; }","preventionTips":["Standardize scope labels across environments","Set Scope consistently at secret creation","Verify scope after environment promotion"],"tags":["secrets","scope-mismatch","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}