Add conditional mode to ReferenceExpression with polyglot codegen support

src/Aspire.Hosting.Redis/RedisBuilderExtensions.cs

@@ -91,7 +91,7 @@ public static IResourceBuilder<RedisResource> AddRedis(
         builder.Services.AddHealthChecks().AddRedis(sp => connectionString ?? throw new InvalidOperationException("Connection string is unavailable"), name: healthCheckKey);
 
         var redisBuilder = builder.AddResource(redis)
-            .WithEndpoint(port: port, targetPort: 6379, name: RedisResource.PrimaryEndpointName)
+            .WithEndpoint(port: port, targetPort: 6379, name: RedisResource.PrimaryEndpointName, scheme: "redis")
             .WithImage(RedisContainerImageTags.Image, RedisContainerImageTags.Tag)
             .WithImageRegistry(RedisContainerImageTags.Registry)
             .WithHealthCheck(healthCheckKey)
@@ -181,21 +181,21 @@ public static IResourceBuilder<RedisResource> AddRedis(
                 // configure the environment variables to use it.
                 redisBuilder
                     .WithEndpoint(targetPort: 6380, name: RedisResource.SecondaryEndpointName)
+                    .WithEndpoint(RedisResource.PrimaryEndpointName, e =>
+                    {
+                        e.UriScheme = "rediss";
+                        e.TlsEnabled = true;
+                    })
                     .WithArgs(argsCtx =>
                     {
                         argsCtx.Args.Add("--tls-port");
                         argsCtx.Args.Add(redis.GetEndpoint(RedisResource.PrimaryEndpointName).Property(EndpointProperty.Port));
                         argsCtx.Args.Add("--port");
                         argsCtx.Args.Add(redis.GetEndpoint(RedisResource.SecondaryEndpointName).Property(EndpointProperty.Port));
                     });
-
-                redis.TlsEnabled = true;
             });
         }
 
-        // Disable HTTPS developer certificate by default to avoid connection string timing issues
-        redisBuilder.WithoutHttpsCertificate();
-
         return redisBuilder;
     }
 

src/Aspire.Hosting.Redis/RedisResource.cs

@@ -53,9 +53,17 @@ public RedisResource(string name, ParameterResource password) : this(name)
     public ParameterResource? PasswordParameter { get; private set; }
 
     /// <summary>
-    /// Determines whether Tls is enabled for the resource
+    /// Gets or sets a value indicating whether TLS is enabled for the Redis server.
     /// </summary>
-    public bool TlsEnabled { get; internal set; }
+    /// <remarks>
+    /// This property proxies through to <see cref="EndpointAnnotation.TlsEnabled"/> on the
+    /// <see cref="PrimaryEndpoint"/>. When set to <see langword="true"/>, the connection string
+    /// expression dynamically includes <c>,ssl=true</c> and the URI expression uses the
+    /// <c>rediss://</c> scheme. This value is resolved lazily at expression evaluation time,
+    /// avoiding timing issues when TLS is enabled later in the application lifecycle
+    /// (e.g., during the <c>BeforeStartEvent</c>).
+    /// </remarks>
+    public bool TlsEnabled => PrimaryEndpoint.TlsEnabled;
 
     /// <summary>
     /// Arguments for the Dockerfile
@@ -72,10 +80,7 @@ private ReferenceExpression BuildConnectionString()
             builder.Append($",password={PasswordParameter}");
         }
 
-        if (TlsEnabled)
-        {
-            builder.Append($",ssl=true");
-        }
+        builder.Append($"{PrimaryEndpoint.GetTlsValue(enabledValue: ",ssl=true", disabledValue: null)}");
 
         return builder.Build();
     }
@@ -127,14 +132,8 @@ public ReferenceExpression UriExpression
         get
         {
             var builder = new ReferenceExpressionBuilder();
-            if (TlsEnabled)
-            {
-                builder.AppendLiteral("rediss://");
-            }
-            else
-            {
-                builder.AppendLiteral("redis://");
-            }
+            builder.Append($"{PrimaryEndpoint.Property(EndpointProperty.Scheme)}");
+            builder.AppendLiteral("://");
 
             if (PasswordParameter is not null)
             {

src/Aspire.Hosting/ApplicationModel/DeferredValueProvider.cs

@@ -0,0 +1,74 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+
+namespace Aspire.Hosting.ApplicationModel;
+
+/// <summary>
+/// A general-purpose value provider that resolves its value and manifest expression lazily via callbacks.
+/// This enables dynamic values to be embedded in <see cref="ReferenceExpression"/> instances, where the
+/// actual value is determined at resolution time rather than at expression build time.
+/// </summary>
+/// <remarks>
+/// <para>
+/// Use this type when a portion of a connection string or expression depends on state that isn't known
+/// until later in the application lifecycle (e.g., whether TLS has been enabled on an endpoint).
+/// </para>
+/// <para>
+/// Callbacks receive a <see cref="ValueProviderContext"/> that provides access to the execution context,
+/// the calling resource, and network information. When no separate manifest expression callback is provided,
+/// the value callback is used for both <see cref="GetValueAsync(ValueProviderContext, CancellationToken)"/> and <see cref="ValueExpression"/>. A
+/// <see langword="null"/> return from the value callback is treated as an empty string for the manifest expression.
+/// </para>
+/// </remarks>
+public class DeferredValueProvider : IValueProvider, IManifestExpressionProvider
+{
+    private readonly Func<ValueProviderContext, string?> _valueCallback;
+    private readonly Func<string>? _manifestExpressionCallback;
+
+    /// <summary>
+    /// Initializes a new instance of <see cref="DeferredValueProvider"/> with a context-free callback.
+    /// </summary>
+    /// <param name="valueCallback">A callback that returns the value. A <see langword="null"/> return is treated
+    /// as an empty string for the manifest expression. Called each time the value is resolved.</param>
+    /// <param name="manifestExpressionCallback">An optional callback that returns the manifest expression string.
+    /// When <see langword="null"/>, the <paramref name="valueCallback"/> is used for both runtime and manifest values.</param>
+    public DeferredValueProvider(Func<string?> valueCallback, Func<string>? manifestExpressionCallback = null)
+    {
+        ArgumentNullException.ThrowIfNull(valueCallback);
+        _valueCallback = _ => valueCallback();
+        _manifestExpressionCallback = manifestExpressionCallback;
+    }
+
+    /// <summary>
+    /// Initializes a new instance of <see cref="DeferredValueProvider"/> with a context-aware callback.
+    /// </summary>
+    /// <param name="valueCallback">A callback that receives a <see cref="ValueProviderContext"/> and returns
+    /// the value. A <see langword="null"/> return is treated as an empty string for the manifest expression.
+    /// Called each time the value is resolved.</param>
+    /// <param name="manifestExpressionCallback">An optional callback that returns the manifest expression string.
+    /// When <see langword="null"/>, the <paramref name="valueCallback"/> is invoked with an empty
+    /// <see cref="ValueProviderContext"/> for the manifest expression.</param>
+    public DeferredValueProvider(Func<ValueProviderContext, string?> valueCallback, Func<string>? manifestExpressionCallback = null)
+    {
+        ArgumentNullException.ThrowIfNull(valueCallback);
+        _valueCallback = valueCallback;
+        _manifestExpressionCallback = manifestExpressionCallback;
+    }
+
+    /// <inheritdoc />
+    public string ValueExpression => _manifestExpressionCallback is not null
+        ? _manifestExpressionCallback()
+        : _valueCallback(new ValueProviderContext()) ?? "";
+
+    /// <inheritdoc />
+    public ValueTask<string?> GetValueAsync(CancellationToken cancellationToken = default)
+    {
+        return GetValueAsync(new ValueProviderContext(), cancellationToken);
+    }
+
+    /// <inheritdoc />
+    public ValueTask<string?> GetValueAsync(ValueProviderContext context, CancellationToken cancellationToken = default)
+    {
+        return new(_valueCallback(context));
+    }
+}

src/Aspire.Hosting/ApplicationModel/EndpointAnnotation.cs

@@ -22,6 +22,7 @@ public sealed class EndpointAnnotation : IResourceAnnotation
     private bool _portSetToNull;
     private int? _targetPort;
     private bool _targetPortSetToNull;
+    private bool? _tlsEnabled;
     private readonly NetworkIdentifier _networkID;
 
     /// <summary>
@@ -184,6 +185,22 @@ public string Transport
     /// <remarks>Defaults to <c>true</c>.</remarks>
     public bool IsProxied { get; set; } = true;
 
+    /// <summary>
+    /// Gets or sets a value indicating whether TLS is enabled for this endpoint.
+    /// </summary>
+    /// <remarks>
+    /// This property is used to track TLS state on the endpoint so that connection string expressions
+    /// can dynamically include TLS-related parameters (e.g., <c>ssl=true</c> for Redis) at resolution time
+    /// rather than at expression build time. For HTTP-based endpoints, the <see cref="UriScheme"/> property
+    /// being set to <c>https</c> already implies TLS. This property is primarily useful for non-HTTP protocols
+    /// (e.g., Redis, databases) that need explicit TLS configuration in their connection strings.
+    /// </remarks>
+    public bool TlsEnabled
+    {
+        get => _tlsEnabled ?? (UriScheme == "https");
+        set => _tlsEnabled = value;
+    }
+
     /// <summary>
     /// Gets or sets a value indicating whether the endpoint is from a launch profile.
     /// </summary>

src/Aspire.Hosting/ApplicationModel/EndpointReference.cs

@@ -62,6 +62,15 @@ public sealed class EndpointReference : IManifestExpressionProvider, IValueProvi
     /// </summary>
     public bool IsHttps => StringComparers.EndpointAnnotationUriScheme.Equals(Scheme, "https");
 
+    /// <summary>
+    /// Gets a value indicating whether TLS is enabled for this endpoint.
+    /// </summary>
+    /// <remarks>
+    /// Returns <see langword="false"/> if the endpoint annotation has not been added to the resource yet.
+    /// Once the annotation exists, this property delegates to <see cref="EndpointAnnotation.TlsEnabled"/>.
+    /// </remarks>
+    public bool TlsEnabled => Exists && EndpointAnnotation.TlsEnabled;
+
     string IManifestExpressionProvider.ValueExpression => GetExpression();
 
     /// <summary>
@@ -116,6 +125,25 @@ public EndpointReferenceExpression Property(EndpointProperty property)
         return new(this, property);
     }
 
+    /// <summary>
+    /// Creates a <see cref="DeferredValueProvider"/> that resolves to <paramref name="enabledValue"/> when
+    /// <see cref="EndpointAnnotation.TlsEnabled"/> is <see langword="true"/> on this endpoint, or to
+    /// <paramref name="disabledValue"/> otherwise.
+    /// </summary>
+    /// <remarks>
+    /// The returned provider evaluates the TLS state lazily each time its value is resolved, making it
+    /// safe to embed in a <see cref="ReferenceExpression"/> that is built before TLS is configured
+    /// (e.g., before <c>BeforeStartEvent</c> fires).
+    /// </remarks>
+    /// <param name="enabledValue">The value to return when TLS is enabled (e.g., <c>",ssl=true"</c>).</param>
+    /// <param name="disabledValue">The value to return when TLS is not enabled. Defaults to an empty string.</param>
+    /// <returns>A <see cref="DeferredValueProvider"/> whose value tracks the TLS state of this endpoint.</returns>
+    public DeferredValueProvider GetTlsValue(string enabledValue, string? disabledValue)
+    {
+        return new DeferredValueProvider(
+            () => TlsEnabled ? enabledValue : disabledValue);
+    }
+
     /// <summary>
     /// Gets the port for this endpoint.
     /// </summary>

tests/Aspire.Hosting.Redis.Tests/AddRedisTests.cs

@@ -44,7 +44,7 @@ public void AddRedisContainerWithDefaultsAddsAnnotationMetadata()
         Assert.Null(endpoint.Port);
         Assert.Equal(ProtocolType.Tcp, endpoint.Protocol);
         Assert.Equal("tcp", endpoint.Transport);
-        Assert.Equal("tcp", endpoint.UriScheme);
+        Assert.Equal("redis", endpoint.UriScheme);
 
         var containerAnnotation = Assert.Single(containerResource.Annotations.OfType<ContainerImageAnnotation>());
         Assert.Equal(RedisContainerImageTags.Tag, containerAnnotation.Tag);
@@ -72,7 +72,7 @@ public void AddRedisContainerAddsAnnotationMetadata()
         Assert.Equal(9813, endpoint.Port);
         Assert.Equal(ProtocolType.Tcp, endpoint.Protocol);
         Assert.Equal("tcp", endpoint.Transport);
-        Assert.Equal("tcp", endpoint.UriScheme);
+        Assert.Equal("redis", endpoint.UriScheme);
 
         var containerAnnotation = Assert.Single(containerResource.Annotations.OfType<ContainerImageAnnotation>());
         Assert.Equal(RedisContainerImageTags.Tag, containerAnnotation.Tag);
@@ -154,7 +154,7 @@ public async Task VerifyDefaultManifest()
               },
               "bindings": {
                 "tcp": {
-                  "scheme": "tcp",
+                  "scheme": "redis",
                   "protocol": "tcp",
                   "transport": "tcp",
                   "targetPort": 6379
@@ -185,7 +185,7 @@ public async Task VerifyWithoutPasswordManifest()
               ],
               "bindings": {
                 "tcp": {
-                  "scheme": "tcp",
+                  "scheme": "redis",
                   "protocol": "tcp",
                   "transport": "tcp",
                   "targetPort": 6379
@@ -223,7 +223,7 @@ public async Task VerifyWithPasswordManifest()
               },
               "bindings": {
                 "tcp": {
-                  "scheme": "tcp",
+                  "scheme": "redis",
                   "protocol": "tcp",
                   "transport": "tcp",
                   "targetPort": 6379
@@ -258,7 +258,7 @@ public async Task VerifyWithPasswordValueNotProvidedManifest()
               },
               "bindings": {
                 "tcp": {
-                  "scheme": "tcp",
+                  "scheme": "redis",
                   "protocol": "tcp",
                   "transport": "tcp",
                   "targetPort": 6379
@@ -835,6 +835,63 @@ public async Task RedisWithCertificateHasCorrectConnectionString()
         await builder.Eventing.PublishAsync(beforeStartEvent);
 
         Assert.True(redis.Resource.TlsEnabled);
+
+        // Verify the connection string expression includes ssl=true after TLS is enabled
+        var connectionStringExpression = redis.Resource.ConnectionStringExpression;
+        Assert.Contains(",ssl=true", connectionStringExpression.ValueExpression);
+
+        // Verify the endpoint annotation also has TlsEnabled
+        var endpoint = Assert.Single(redis.Resource.Annotations.OfType<EndpointAnnotation>(), e => e.Name == "tcp");
+        Assert.True(endpoint.TlsEnabled);
+        Assert.Equal("rediss", endpoint.UriScheme);
+
+        // Verify the URI expression uses the endpoint scheme
+        var uriExpression = redis.Resource.UriExpression;
+        Assert.Contains("{myredis.bindings.tcp.scheme}", uriExpression.ValueExpression);
+    }
+
+    [Fact]
+    public async Task RedisConnectionStringResolvesWithTlsDynamically()
+    {
+        using var builder = TestDistributedApplicationBuilder.CreateWithTestContainerRegistry(testOutputHelper);
+        using var cert = CreateTestCertificate();
+
+        var redis = builder.AddRedis("myredis")
+            .WithHttpsCertificate(cert)
+            .WithEndpoint("tcp", e => e.AllocatedEndpoint = new AllocatedEndpoint(e, "localhost", 6379));
+
+        // Before BeforeStartEvent, TLS is not yet enabled
+        Assert.False(redis.Resource.TlsEnabled);
+
+        // The manifest expression does not include ssl=true before TLS is enabled
+        var expressionBeforeTls = redis.Resource.ConnectionStringExpression;
+        Assert.DoesNotContain(",ssl=true", expressionBeforeTls.ValueExpression);
+
+        // But the expression has a DeferredValueProvider that will resolve dynamically
+        // Resolve the runtime value — should NOT have ssl=true yet
+        var resolvedBeforeTls = await expressionBeforeTls.GetValueAsync(default(CancellationToken));
+        Assert.NotNull(resolvedBeforeTls);
+        Assert.DoesNotContain(",ssl=true", resolvedBeforeTls);
+
+        using var app = builder.Build();
+        var appModel = app.Services.GetRequiredService<DistributedApplicationModel>();
+
+        // Simulate the BeforeStartEvent to enable TLS
+        var beforeStartEvent = new BeforeStartEvent(app.Services, appModel);
+        await builder.Eventing.PublishAsync(beforeStartEvent);
+
+        // Now TLS is enabled
+        Assert.True(redis.Resource.TlsEnabled);
+
+        // The deferred value provider resolves dynamically — the SAME captured expression
+        // now resolves with ssl=true because the callback reads current TlsEnabled state
+        var resolvedAfterTls = await expressionBeforeTls.GetValueAsync(default(CancellationToken));
+        Assert.NotNull(resolvedAfterTls);
+        Assert.Contains(",ssl=true", resolvedAfterTls);
+
+        // The new expression from the getter also reflects TLS in its manifest expression
+        var expressionAfterTls = redis.Resource.ConnectionStringExpression;
+        Assert.Contains(",ssl=true", expressionAfterTls.ValueExpression);
     }
 
     [Fact]
@@ -850,6 +907,10 @@ public void RedisWithoutCertificateHasCorrectConnectionString()
         // Simulate the BeforeStartEvent
         var beforeStartEvent = new BeforeStartEvent(app.Services, appModel);
         Assert.False(redis.Resource.TlsEnabled);
+
+        // Verify the connection string expression does NOT include ssl=true
+        var connectionStringExpression = redis.Resource.ConnectionStringExpression;
+        Assert.DoesNotContain(",ssl=true", connectionStringExpression.ValueExpression);
     }
 
     private static X509Certificate2 CreateTestCertificate()

tests/Aspire.Hosting.Redis.Tests/ConnectionPropertiesTests.cs

@@ -34,7 +34,7 @@ public void RedisResourceGetConnectionPropertiesReturnsExpectedValues()
             property =>
             {
                 Assert.Equal("Uri", property.Key);
-                Assert.Equal("redis://:{password.value}@{redis.bindings.tcp.host}:{redis.bindings.tcp.port}", property.Value.ValueExpression);
+                Assert.Equal("{redis.bindings.tcp.scheme}://:{password.value}@{redis.bindings.tcp.host}:{redis.bindings.tcp.port}", property.Value.ValueExpression);
             });
     }
 }