Handle missing encryption key for the EncryptedMetadataManager (#159)

* Handle missing encryption key for the EncryptedMetadataManager

* Fancy up the documentation

* Throw an error instead of process exit

docs/settings-manager.md

@@ -66,3 +66,19 @@ const settings = new MetadataManager({
   mutateMetadata: (md) => mutateMetadata(client, md),
 });
 ```
+
+# EncryptedMetadataManager
+
+This manager encrypts add the layer of encryption for all the stored data.
+To operate correctly, the encryption key needs to be passed to the constructor:
+
+```ts
+new EncryptedMetadataManager({
+  encryptionKey: process.env.SECRET_KEY, // secrets should be saved in the environment variables, never in the source code
+  fetchMetadata: () => fetchAllMetadata(client),
+  mutateMetadata: (metadata) => mutateMetadata(client, metadata),
+});
+```
+
+> **Warning**
+> If encryption key won't be passed, the application will exit.

src/settings-manager/encrypted-metadata-manager.test.ts

@@ -1,4 +1,4 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
   DecryptCallback,
@@ -19,7 +19,49 @@ const entryForDomainY = { key: "a__y.com", value: "domain y value" };
 const metadata = [initialEntry, entryForDomainX, entryForDomainY, encryptedEntry];
 
 describe("settings-manager", () => {
-  describe("metadata-manager", () => {
+  describe("encrypted-metadata-manager", () => {
+    describe("Constructor", () => {
+      const initialEnv = { ...process.env };
+
+      afterEach(() => {
+        process.env = { ...initialEnv };
+        vi.resetModules();
+      });
+
+      it("Process exit should be called when no encryption key is set if the environment type is production", async () => {
+        // @ts-expect-error
+        process.env.NODE_ENV = "production";
+        const fetchMock = vi.fn(async () => metadata);
+        const mutateMock = vi.fn(async (md: MetadataEntry[]) => [...metadata, ...md]);
+        expect(
+          () =>
+            new EncryptedMetadataManager({
+              fetchMetadata: fetchMock,
+              mutateMetadata: mutateMock,
+              // @ts-expect-error
+              encryptionKey: undefined,
+            })
+        ).toThrowError(
+          "Encryption key for the EncryptedMetadataManager has not been set. Setting it for the production environments is necessary. You can find more in the documentation: https://github.com/saleor/saleor-app-sdk/blob/main/docs/settings-manager.md"
+        );
+      });
+
+      it("If env type is different than production (development/test) use placeholder value", async () => {
+        const fetchMock = vi.fn(async () => metadata);
+        const mutateMock = vi.fn(async (md: MetadataEntry[]) => [...metadata, ...md]);
+        const manager = new EncryptedMetadataManager({
+          fetchMetadata: fetchMock,
+          mutateMetadata: mutateMock,
+          // @ts-expect-error
+          encryptionKey: undefined,
+        });
+
+        // @ts-expect-error
+        expect(manager.encryptionKey).toBe("CHANGE_ME");
+      });
+    });
+
+    describe("Manager operations", () => {
       const fetchMock = vi.fn(async () => metadata);
       const mutateMock = vi.fn(async (md: MetadataEntry[]) => [...metadata, ...md]);
       const manager = new EncryptedMetadataManager({
@@ -81,4 +123,5 @@ describe("settings-manager", () => {
         expect(fetchMock).toBeCalledTimes(0);
       });
     });
+  });
 });

src/settings-manager/encrypted-metadata-manager.ts

@@ -71,7 +71,22 @@ export class EncryptedMetadataManager implements SettingsManager {
       fetchMetadata,
       mutateMetadata,
     });
+    if (encryptionKey) {
       this.encryptionKey = encryptionKey;
+    } else {
+      console.warn("Encrypted Metadata Manager secret key has not been set.");
+      if (process.env.NODE_ENV === "production") {
+        console.error("Can't start the application without the secret key.");
+        throw new Error(
+          "Encryption key for the EncryptedMetadataManager has not been set. Setting it for the production environments is necessary. You can find more in the documentation: https://github.com/saleor/saleor-app-sdk/blob/main/docs/settings-manager.md"
+        );
+      }
+      console.warn(
+        "WARNING: Encrypted Metadata Manager encryption key has not been set. For production deployments, it need's to be set"
+      );
+      console.warn("Using placeholder value for the development.");
+      this.encryptionKey = "CHANGE_ME";
+    }
     this.encryptionMethod = encryptionMethod || encrypt;
     this.decryptionMethod = decryptionMethod || decrypt;
   }