{"record":{"id":"e73bb2667ac37db8","repo":"microsoft/aspire","slug":"aspireradius065","errorCode":"ASPIRERADIUS065","errorMessage":"Secret store '{store.Name}' already declares a population mode; declare exactly one of WithData, WithExistingSecret, or WithSealedSecret, once. Diagnostic: ASPIRERADIUS065.","messagePattern":"Secret store '(.+?)' already declares a population mode; declare exactly one of WithData, WithExistingSecret, or WithSealedSecret, once\\. Diagnostic: ASPIRERADIUS065\\.","errorType":"validation","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs","lineNumber":374,"sourceCode":"            throw new ArgumentException(\n                $\"Existing-secret reference '{namespaceAndName}' is invalid. The name must be a DNS-1123 subdomain and \" +\n                \"the optional namespace a DNS-1123 label (lowercase alphanumeric, '-', with '.' allowed in the name). \" +\n                \"Diagnostic: ASPIRERADIUS046.\",\n                nameof(namespaceAndName));\n        }\n\n        return namespaceAndName;\n    }\n\n    // A secret store must declare exactly one population mode. Reject a second population call\n    // (repeated same-mode or cross-mode) at the call site so misuse fails immediately with a clear\n    // stack trace, rather than silently appending keys across modes/manifests or reaching the gate.\n    [Experimental(\"ASPIRERADIUS006\", UrlFormat = \"https://aka.ms/aspire/diagnostics/{0}\")]\n    private static void EnsureNotAlreadyPopulated(RadiusSecretStoreResource store)\n    {\n        if (store.Population.IsPopulated)\n        {\n            throw new InvalidOperationException(\n                $\"Secret store '{store.Name}' already declares a population mode; declare exactly one of \" +\n                \"WithData, WithExistingSecret, or WithSealedSecret, once. Diagnostic: ASPIRERADIUS065.\");\n        }\n    }\n\n    // The store name is used verbatim as a Bicep symbol/resource name, a UCP-ID segment,\n    // and a Radius-created Secret name, so it must be a valid single resource-name segment.\n    private static void ValidateStoreName([NotNull] string? name)\n    {\n        ArgumentException.ThrowIfNullOrWhiteSpace(name);\n        if (!RadiusSecretStoreNaming.IsValidName(name))\n        {\n            throw new ArgumentException(\n                $\"Secret-store name '{name}' is invalid. It must be 1-{RadiusSecretStoreNaming.MaxNameLength} characters of \" +\n                \"lowercase ASCII letters, digits, and '-', must start with a letter, may not contain consecutive hyphens, may \" +\n                \"not end with a hyphen, and may not be a reserved device name. Diagnostic: ASPIRERADIUS049.\",\n                nameof(name));\n        }","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Radius/Secrets/RadiusSecretStoreExtensions.cs#L356-L392","documentation":"A Radius secret store must declare exactly one population mode: WithData, WithExistingSecret, or WithSealedSecret. EnsureNotAlreadyPopulated checks store.Population.IsPopulated and throws if a second population call is made, preventing silently appended keys across modes or manifests.","triggerScenarios":"Chaining two population calls on the same store, e.g. WithData(...).WithExistingSecret(...), or calling WithSealedSecret on a store that already declares a mode; conditional code paths that both may populate the store.","commonSituations":"Fluent chains copied from examples combining data keys with an existing secret; refactoring where a new population call was added without removing the old one; helper methods that each call a population API unconditionally.","solutions":["Keep exactly one population call per store — remove the redundant one","Split into two separate secret stores if both data sources are needed","Move the population call into a single shared code path","If mode is chosen at runtime, call only one branch"],"exampleFix":"// before\nvar store = builder.AddRadiusSecretStore(\"creds\")\n    .WithData(\"key1\", v1)\n    .WithExistingSecret(\"team/creds\");\n// after\nvar store = builder.AddRadiusSecretStore(\"creds\")\n    .WithExistingSecret(\"team/creds\");","handlingStrategy":"validation","validationCode":"var populated = store.Population.IsPopulated; if (populated) throw new InvalidOperationException(\"Store already declares a population mode.\");","typeGuard":null,"tryCatchPattern":"try { store.WithSealedSecret(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"ASPIRERADIUS065\")) { logger.LogError(ex, \"Duplicate population mode on store '{Store}'\", store.Name); throw; }","preventionTips":["Call exactly one population API per store in a single code path","Gate runtime-chosen modes with if/else, never fall through","Centralize store construction in one helper to avoid duplicate population calls"],"tags":["radius","secrets","configuration","conflict","diagnostics"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}