From aa55274bcf56550714557163a7d4b83afc0c08f2 Mon Sep 17 00:00:00 2001
From: Sipke Schoorstra <sipkeschoorstra@outlook.com>
Date: Mon, 1 Jun 2026 22:42:16 +0200
Subject: [PATCH] Auto stash before checking out "origin/main"

---
 .../SecretExpressionDescriptorProvider.cs     | 31 +++++++++++++++-
 .../SecretExpressionTests.cs                  | 36 +++++++++++++++++++
 2 files changed, 66 insertions(+), 1 deletion(-)

diff --git a/src/modules/Elsa.Secrets/Providers/SecretExpressionDescriptorProvider.cs b/src/modules/Elsa.Secrets/Providers/SecretExpressionDescriptorProvider.cs
index d630f8b4e..cad44d01e 100644
--- a/src/modules/Elsa.Secrets/Providers/SecretExpressionDescriptorProvider.cs
+++ b/src/modules/Elsa.Secrets/Providers/SecretExpressionDescriptorProvider.cs
@@ -38,7 +38,36 @@ public class SecretExpressionDescriptorProvider : IExpressionDescriptorProvider
         if (valueElement.ValueKind is JsonValueKind.Undefined or JsonValueKind.Null)
             return new Expression(SecretExpression.TypeName, null);
 
-        var reference = valueElement.Deserialize<SecretReference>(context.Options);
+        var reference = DeserializeReference(valueElement, context.Options);
         return new Expression(SecretExpression.TypeName, reference);
     }
+
+    private static SecretReference? DeserializeReference(JsonElement valueElement, JsonSerializerOptions options)
+    {
+        try
+        {
+            return valueElement.ValueKind switch
+            {
+                JsonValueKind.Object => valueElement.Deserialize<SecretReference>(options),
+                JsonValueKind.String => DeserializeStringReference(valueElement.GetString(), options),
+                _ => null
+            };
+        }
+        catch (JsonException)
+        {
+            return null;
+        }
+    }
+
+    private static SecretReference? DeserializeStringReference(string? value, JsonSerializerOptions options)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+            return null;
+
+        var trimmedValue = value.Trim();
+        if (trimmedValue.StartsWith('{'))
+            return JsonSerializer.Deserialize<SecretReference>(trimmedValue, options);
+
+        return new SecretReference(trimmedValue);
+    }
 }
diff --git a/test/unit/Elsa.Secrets.UnitTests/SecretExpressionTests.cs b/test/unit/Elsa.Secrets.UnitTests/SecretExpressionTests.cs
index afafeb3d8..6ccb86277 100644
--- a/test/unit/Elsa.Secrets.UnitTests/SecretExpressionTests.cs
+++ b/test/unit/Elsa.Secrets.UnitTests/SecretExpressionTests.cs
@@ -96,6 +96,42 @@ public class SecretExpressionTests
         Assert.Equal(new SecretReference("api:key", SecretTypeNames.Text, "production"), deserializedReference);
     }
 
+    [Fact]
+    public void SecretExpression_DeserializesEmptyStringAsNullReference()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":""}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        Assert.Equal(SecretExpression.TypeName, expression.Type);
+        Assert.Null(expression.Value);
+    }
+
+    [Fact]
+    public void SecretExpression_DeserializesStringAsSecretName()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":"api:key"}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        var reference = Assert.IsType<SecretReference>(expression.Value);
+        Assert.Equal(new SecretReference("api:key"), reference);
+    }
+
+    [Fact]
+    public void SecretExpression_DeserializesStringifiedSecretReference()
+    {
+        var options = CreateSerializerOptions();
+        const string json = """{"type":"Secret","value":"{\"name\":\"api:key\",\"typeName\":\"text\",\"scope\":\"production\"}"}""";
+
+        var expression = JsonSerializer.Deserialize<Expression>(json, options)!;
+
+        var reference = Assert.IsType<SecretReference>(expression.Value);
+        Assert.Equal(new SecretReference("api:key", SecretTypeNames.Text, "production"), reference);
+    }
+
     [Fact]
     public void WorkflowInputJson_StoresSecretReferenceNotSecretValue()
     {