{"record":{"id":"b6e7d55867a988b3","repo":"microsoft/aspire","slug":"aspireradius047","errorCode":"ASPIRERADIUS047","errorMessage":"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.","messagePattern":"Secret store '(.+?)' sets encoding '(.+?)' on key '(.+?)', which is invalid for a '(.+?)' store\\. Diagnostic: ASPIRERADIUS047\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs","lineNumber":179,"sourceCode":"            }\n        }\n\n        // ASPIRERADIUS042 / ASPIRERADIUS047 — inline bindings must be secret and use valid encoding.\n        if (population.HasInlineData)\n        {\n            foreach (var (key, binding) in population.Data)\n            {\n                if (!binding.Parameter.Secret)\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' binds key '{key}' to the non-secret parameter \" +\n                        $\"'{binding.Parameter.Name}'. Bind a parameter created with secret: true. \" +\n                        \"Diagnostic: ASPIRERADIUS042.\");\n                }\n\n                if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding))\n                {\n                    throw new InvalidOperationException(\n                        $\"Secret store '{store.Name}' sets encoding '{binding.Encoding}' on key '{key}', which is \" +\n                        $\"invalid for a '{store.Type.ToRadiusTypeString()}' store. Diagnostic: ASPIRERADIUS047.\");\n                }\n            }\n        }\n\n        // ASPIRERADIUS062 — WithMaterializationTimeout only affects the sealed-secret deploy path,\n        // which awaits the SealedSecret controller. On any other population mode it would silently\n        // no-op, so reject an explicit override rather than mislead the author.\n        if (store.MaterializationTimeoutWasSet && !population.HasSealedSecret)\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{store.Name}' sets WithMaterializationTimeout but is not populated with \" +\n                \"WithSealedSecret. The materialization timeout only applies to sealed secrets; remove the \" +\n                \"call or use WithSealedSecret. Diagnostic: ASPIRERADIUS062.\");\n        }\n\n        // ASPIRERADIUS055 — an application-scoped existing-secret store has no single owning environment,","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreValidation.cs#L161-L197","documentation":"This error is thrown during Radius secret store validation (ASPIRERADIUS047) when a store binding sets an 'encoding' value that the store's type does not permit. Each Radius secret store type (e.g. basicAuthentication vs generic) accepts only a subset of encodings; setting an unsupported one would produce a Bicep/Radius manifest that Radius would reject or silently mishandle, so the validator fails fast at build time. The check runs in ValidateStore over every binding of the store.","triggerScenarios":"Calling the secret store binding API with an encoding value that is not in the valid set for the store's RadiusSecretStoreType — e.g. building a store whose type is BasicAuthentication but setting binding.Encoding to an encoding only valid for generic stores (or any unknown encoding string). Any call to RadiusSecretStoreValidation.Validate that encounters a binding where binding.Encoding is not null and !store.Type.IsValidEncoding(binding.Encoding).","commonSituations":"Copy-pasting a secret store configuration between store types; changing store.Type (e.g. from generic to basicAuthentication) after bindings were configured with encodings; hand-writing encoding strings that are misspelled or made up rather than taken from the allowed enum list.","solutions":["Remove the Encoding setting from the offending binding if it is not needed.","Check which encodings the store's RadiusSecretStoreType permits and set one of those on the binding.","Change the store type (e.g. to a generic store) if the binding genuinely requires the encoding you specified."],"exampleFix":"// before\nvar store = radius.AddSecretStore(\"secrets\", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))\n    .WithBinding(\"password\", encoding: \"base64\");\n\n// after\nvar store = radius.AddSecretStore(\"secrets\", t => t.WithType(RadiusSecretStoreType.BasicAuthentication))\n    .WithBinding(\"password\"); // encoding omitted: not valid for basicAuthentication stores","handlingStrategy":"validation","validationCode":"// Before configuring bindings, check encodings against the store type.\nbool IsValidForStore(RadiusSecretStoreType type, string? encoding) =>\n    encoding is null || type.IsValidEncoding(encoding);","typeGuard":"if (binding.Encoding is not null && !store.Type.IsValidEncoding(binding.Encoding)) throw new InvalidOperationException($\"Encoding '{binding.Encoding}' invalid for {store.Type}.\");","tryCatchPattern":null,"preventionTips":["Only set Encoding on bindings when the store type's documentation lists it as valid.","Centralize store-type/binding creation in one helper so type/encoding pairings are checked once.","Run Radius secret store validation early in tests before deployment."],"tags":["radius","secrets","configuration-validation","bicep"],"backgroundTag":"invalid-config-value","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}