{"record":{"id":"935de4e771ddbeb6","repo":"xpipe-io/xpipe","slug":"scope-scope-is-not-supported","errorCode":null,"errorMessage":"Scope ${scope} is not supported","messagePattern":"Scope (.+?) is not supported","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java","lineNumber":181,"sourceCode":"\n    public static MultiPrincipalSecret of(SecretValue internalSecret, Set<EncryptionPrincipal> principals) {\n        for (EncryptionPrincipal principal : principals) {\n            if (!principal.isAccessible()) {\n                throw new IllegalArgumentException(\"Principal \" + principal.getName() + \" is not accessible\");\n            }\n        }\n\n        var l = new ArrayList<Entry>();\n        for (EncryptionPrincipal principal : principals) {\n            var enc = AesSecretValue.encrypt(internalSecret.getSecret(), principal.getSecretKey());\n            l.add(new Entry(principal, enc.getEncryptedValue(), 1, EncryptionToken.of(principal)));\n        }\n        return new MultiPrincipalSecret(l, internalSecret.inPlace());\n    }\n\n    public MultiPrincipalSecret with(InPlaceSecretValue secret, DataStoreAccessScope scope) {\n        if (!supportsScopeEncryption(scope)) {\n            throw new IllegalArgumentException(\"Scope \" + scope + \" is not supported\");\n        }\n\n        var secretUnchanged = secret == null || Arrays.equals(secret.getSecret(), this.secret.getSecret());\n        if (secretUnchanged && getScope().equals(scope) && isScopeValid()) {\n            return this;\n        }\n\n        var iteration = getMaxIteration();\n        var l = new ArrayList<Entry>();\n        for (EncryptionPrincipal principal : scope.getPrincipals()) {\n            var existingEntry = entries.stream()\n                    .filter(entry -> entry.getPrincipal().equals(principal))\n                    .findFirst();\n\n            // Keep existing entry if possible if not accessible\n            if (!principal.isAccessible()) {\n                if (existingEntry.isPresent()) {\n                    l.add(existingEntry.get());","sourceCodeStart":163,"sourceCodeEnd":199,"githubUrl":"https://github.com/xpipe-io/xpipe/blob/d85ca821baa46092a320ebb13546d7240adb74f8/app/src/main/java/io/xpipe/app/secret/MultiPrincipalSecret.java#L163-L199","documentation":"MultiPrincipalSecret.with(secret, scope) re-encrypts the secret for a given DataStoreAccessScope, but only scopes for which supportsScopeEncryption(scope) is true are supported. Passing any other scope throws this IllegalArgumentException. It prevents silently producing a secret that cannot be used for that scope.","triggerScenarios":"Calling with(secret, scope) (directly or via withUpdatedPrincipals) with a scope value not covered by supportsScopeEncryption — e.g. a scope enum/constant outside the supported set for this secret type.","commonSituations":"Passing the wrong DataStoreAccessScope constant after a refactor; constructing secrets for a store type whose scope is not encryptable; migrating code between scope enums.","solutions":["Check supportsScopeEncryption(scope) before calling with() and handle unsupported scopes separately","Use the scope instance obtained from the same store/secret API rather than a hand-built one","Update code to a supported scope mapping after API changes"],"exampleFix":"// before\nreturn secret.with(newSecret, scope);\n// after\nif (!secret.supportsScopeEncryption(scope)) {\n    return secret; // or handle unsupported scope\n}\nreturn secret.with(newSecret, scope);","handlingStrategy":"validation","validationCode":"if (!secret.supportsScopeEncryption(scope)) {\n    throw new IllegalArgumentException(\"Scope \" + scope + \" not supported\");\n}","typeGuard":null,"tryCatchPattern":"try { return secret.with(newSecret, scope); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"is not supported\")) { /* handle unsupported scope */ } else throw e; }","preventionTips":["Only pass scopes sourced from the same store API","Consult supportsScopeEncryption() before updates","Map legacy scopes explicitly after refactors"],"tags":["secrets","encryption","unsupported-scope"],"backgroundTag":"invalid-enum-value","analyzedSha":"d85ca821baa46092a320ebb13546d7240adb74f8","analyzedAt":"2026-09-06T14:30:08.251Z","contentChangedAt":"2026-09-06T14:30:08.251Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}