{"record":{"id":"b02c3bc43e2ba47e","repo":"elsa-workflows/elsa-core","slug":"secret-expression-reference-must-specify-a-secret-name","errorCode":null,"errorMessage":"Secret expression reference must specify a secret name.","messagePattern":"Secret expression reference must specify a secret name\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Expressions/SecretExpressionHandler.cs","lineNumber":19,"sourceCode":"using Elsa.Expressions.Contracts;\nusing Elsa.Expressions.Helpers;\nusing Elsa.Expressions.Models;\n\nnamespace Elsa.Secrets.Expressions;\n\n/// <summary>\n/// Resolves Secret expressions through the configured secret resolver.\n/// </summary>\npublic class SecretExpressionHandler(ISecretResolver secretResolver, IWellKnownTypeRegistry wellKnownTypeRegistry) : IExpressionHandler\n{\n    /// <inheritdoc />\n    public async ValueTask<object?> EvaluateAsync(Expression expression, Type returnType, ExpressionExecutionContext context, ExpressionEvaluatorOptions options)\n    {\n        if (expression.Value is not SecretReference reference)\n            throw new InvalidOperationException(\"Secret expression value must be a SecretReference.\");\n\n        if (string.IsNullOrWhiteSpace(reference.Name))\n            throw new InvalidOperationException(\"Secret expression reference must specify a secret name.\");\n\n        var value = await secretResolver.ResolveAsync(reference, context.CancellationToken);\n        return value.ConvertTo(returnType, new ObjectConverterOptions(WellKnownTypeRegistry: wellKnownTypeRegistry));\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":25,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Expressions/SecretExpressionHandler.cs#L1-L25","documentation":"After confirming the expression value is a SecretReference, the handler validates that the reference names a secret. A SecretReference with an empty, null, or whitespace Name cannot be resolved and triggers this InvalidOperationException. It prevents a silent null/empty resolution of a misconfigured secret reference.","triggerScenarios":"Creating a SecretReference without setting Name (new SecretReference() or default), or building one from a variable/config value that is empty or whitespace at design time.","commonSituations":"A designer/property binding left the secret name blank; the secret name came from an empty app setting or environment variable used at workflow authoring time; copy-pasted activity configuration dropped the Name field.","solutions":["Set the Name on the SecretReference: new SecretReference { Name = \"my-secret\" }.","Check the workflow definition JSON/activity config for an empty secret-name field and fill it in.","If the name is sourced from configuration, verify the config value is non-empty before deploying.","Add a validation step when building activities programmatically to reject SecretReferences without a Name."],"exampleFix":"// before\nvar reference = new SecretReference(); // Name not set\nvar expr = new Expression(\"Secret\", reference);\n\n// after\nvar reference = new SecretReference { Name = configuration[\"Secrets:ApiKey\"]! };\nif (string.IsNullOrWhiteSpace(reference.Name)) throw new ArgumentException(\"Secret name must be configured.\");\nvar expr = new Expression(\"Secret\", reference);","handlingStrategy":"validation","validationCode":"if (expression.Value is SecretReference r && string.IsNullOrWhiteSpace(r.Name)) throw new InvalidOperationException(\"SecretReference.Name must be a non-empty string before evaluation.\");","typeGuard":null,"tryCatchPattern":"try { return await handler.EvaluateAsync(expression, returnType, context, options); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"secret name\")) { /* report misconfigured secret reference */ }","preventionTips":["Validate secret references at workflow-publish time, not just runtime.","Make secret-name fields required in custom designers.","Never construct SecretReference without a Name; add an invariant check in helpers."],"tags":["expressions","secrets","validation"],"backgroundTag":"empty-required-field","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}