{"record":{"id":"f94f3c6d1532dadd","repo":"elsa-workflows/elsa-core","slug":"secret-secret-name-has-no-active-version","errorCode":null,"errorMessage":"Secret '{secret.Name}' has no active version.","messagePattern":"Secret '(.+?)' has no active version\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"error","filePath":"src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs","lineNumber":207,"sourceCode":"        var version = new SecretVersion { Version = 1, ExpiresAt = request.ExpiresAt };\n        version.Payload = await store.WriteAsync(secret, version, CreatePayload(request), cancellationToken);\n        secret.Versions.Add(version);\n\n        return secret;\n    }\n\n    private async Task<Secret> GetExistingAsync(string name, CancellationToken cancellationToken)\n    {\n        var secret = await GetAsync(name, cancellationToken);\n        return secret == null ? throw new KeyNotFoundException($\"Secret '{name}' was not found.\") : secret;\n    }\n\n    private static SecretVersion GetLatestActiveVersion(Secret secret)\n    {\n        if (secret.Status != SecretStatus.Active)\n            throw new InvalidOperationException($\"Secret '{secret.Name}' is not active.\");\n\n        return secret.LatestActiveVersion ?? throw new InvalidOperationException($\"Secret '{secret.Name}' has no active version.\");\n    }\n\n    private void ValidateName(string name)\n    {\n        if (!nameValidator.IsValid(name, out var error))\n            throw new InvalidOperationException(error);\n    }\n\n    private static void EnsureCanWrite(ISecretStore store)\n    {\n        if (!store.Descriptor.Capabilities.HasFlag(SecretStoreCapabilities.Write))\n            throw new InvalidOperationException($\"Secret store '{store.Name}' does not support writing secrets.\");\n    }\n\n    private static IEnumerable<Secret> ApplyFilters(IEnumerable<Secret> secrets, ListSecretsRequest request)\n    {\n        var query = secrets.Where(x => x.Status != SecretStatus.Deleted);\n","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/elsa-workflows/elsa-core/blob/fe9217bdfa0e27f0e09e45006eb6898f616e513d/src/modules/Elsa.Secrets/Services/DefaultSecretManager.cs#L189-L225","documentation":"GetLatestActiveVersion throws InvalidOperationException when the secret is Active but has no LatestActiveVersion. The secret entity exists and is active, yet none of its versions is currently active, so there is no payload to resolve. This indicates corrupted or transitional version state.","triggerScenarios":"Resolving a secret whose LatestActiveVersion is null — e.g. all versions expired/revoked, a rotation left no active version, or the secret was created without an initial active version.","commonSituations":"Rotation job revoked the old version before promoting the new one; manual version deletion removed the only active version; clock/timezone issues making all versions expired; import/migration that skipped version records.","solutions":["Create or promote a new active version for the secret (rotate the secret).","Fix the rotation flow so a new active version is promoted before revoking the old one.","Restore the missing version record from backup/migration if data was lost.","Check version expiry windows so at least one version remains active."],"exampleFix":"// before\nawait secretManager.RotateAsync(\"DbPassword\"); // rotation revokes before promoting\n// after\nawait secretManager.RotateAsync(\"DbPassword\", options => options.PromoteNewVersionBeforeRevokingOld = true); // ensure a new active version exists","handlingStrategy":"validation","validationCode":"var secret = await secretManager.GetAsync(name, ct);\nif (secret?.LatestActiveVersion is null)\n    throw new InvalidOperationException($\"Secret '{name}' has no active version; rotate it first.\");","typeGuard":"bool HasActiveVersion(Secret? s) => s?.LatestActiveVersion is not null;","tryCatchPattern":"try { var value = await resolver.ResolveAsync(reference, ct); }\ncatch (InvalidOperationException ex) when (ex.Message.Contains(\"has no active version\")) { logger.LogError(ex, \"Rotating secret {Name}\", reference.Name); await manager.RotateAsync(reference.Name, ct); }","preventionTips":["Ensure rotation flows promote a new version before revoking the old","Monitor secrets with zero active versions","Verify version records survive migrations/imports","Set overlapping expiry windows on versions"],"tags":["secrets","versioning","no-active-version"],"backgroundTag":"internal-invariant-violation","analyzedSha":"fe9217bdfa0e27f0e09e45006eb6898f616e513d","analyzedAt":"2026-09-13T20:32:34.702Z","contentChangedAt":"2026-09-13T20:32:34.702Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}