Review#1: make sure null values are not allowed for the encryption …

…key, document `canEncrypt`.
elastic · Feb 10, 2021 · e6cbf58 · e6cbf58
1 parent 0a12c30
commit e6cbf58
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 0 deletions.
diff --git a/x-pack/plugins/encrypted_saved_objects/server/config.test.ts b/x-pack/plugins/encrypted_saved_objects/server/config.test.ts
@@ -87,6 +87,18 @@ describe('config schema', () => {
     );
   });
 
+  it('should not allow `null` value for the encryption key', () => {
+    expect(() => ConfigSchema.validate({ encryptionKey: null })).toThrowErrorMatchingInlineSnapshot(
+      `"[encryptionKey]: expected value of type [string] but got [null]"`
+    );
+
+    expect(() =>
+      ConfigSchema.validate({ encryptionKey: null }, { dist: true })
+    ).toThrowErrorMatchingInlineSnapshot(
+      `"[encryptionKey]: expected value of type [string] but got [null]"`
+    );
+  });
+
   it('should throw error if any of the xpack.encryptedSavedObjects.keyRotation.decryptionOnlyKeys is less than 32 characters', () => {
     expect(() =>
       ConfigSchema.validate({

diff --git a/x-pack/plugins/encrypted_saved_objects/server/plugin.ts b/x-pack/plugins/encrypted_saved_objects/server/plugin.ts
@@ -25,6 +25,9 @@ export interface PluginsSetup {
 }
 
 export interface EncryptedSavedObjectsPluginSetup {
+  /**
+   * Indicates if Saved Object encryption is possible. Requires an encryption key to be explicitly set via `xpack.encryptedSavedObjects.encryptionKey`.
+   */
   canEncrypt: boolean;
   registerType: (typeRegistration: EncryptedSavedObjectTypeRegistration) => void;
   createMigration: CreateEncryptedSavedObjectsMigrationFn;