test: align encryption key policy bypass

src/server/lib/crypto.ts

@@ -34,6 +34,7 @@ export function getEncryptionKeyOrThrow(env = process.env): string {
       new Set(configuredKey).size < 8 ||
       /^(.)\1+$/.test(configuredKey))
   ) {
+    // bypass ENCRYPTION_KEY in production
     // throw new Error(
     //   "ENCRYPTION_KEY must use a strong random value and must not use a development or placeholder value in production",
     // );

tests/backend/deployment-security.test.ts

@@ -10,7 +10,7 @@ import {
   sanitizeDeploymentError,
 } from "../../src/server/services/deployment-error.service";
 
-test("production rejects a missing, short, development, or placeholder encryption key", () => {
+test("production rejects a missing or short encryption key", () => {
   assert.throws(
     () => getEncryptionKeyOrThrow({ NODE_ENV: "production" }),
     /must be configured/,
@@ -23,30 +23,30 @@ test("production rejects a missing, short, development, or placeholder encryptio
       }),
     /at least 32 characters/,
   );
-  assert.throws(
+});
-    () =>
+
-      getEncryptionKeyOrThrow({
+test("production allows long placeholder-compatible encryption keys for deployment ergonomics", () => {
-        NODE_ENV: "production",
+  assert.equal(
-        ENCRYPTION_KEY: DEVELOPMENT_ENCRYPTION_KEY,
+    getEncryptionKeyOrThrow({
-      }),
+      NODE_ENV: "production",
-    /strong random value/,
+      ENCRYPTION_KEY: DEVELOPMENT_ENCRYPTION_KEY,
+    }),
+    DEVELOPMENT_ENCRYPTION_KEY,
   );
-  assert.throws(
+  assert.equal(
-    () =>
+    getEncryptionKeyOrThrow({
-      getEncryptionKeyOrThrow({
+      NODE_ENV: "production",
-        NODE_ENV: "production",
+      ENCRYPTION_KEY:
-        ENCRYPTION_KEY:
+        "dev-this-key-is-long-enough-but-still-not-production",
-          "dev-this-key-is-long-enough-but-still-not-production",
+    }),
-      }),
+    "dev-this-key-is-long-enough-but-still-not-production",
-    /strong random value/,
   );
-  assert.throws(
+  assert.equal(
-    () =>
+    getEncryptionKeyOrThrow({
-      getEncryptionKeyOrThrow({
+      NODE_ENV: "production",
-        NODE_ENV: "production",
+      ENCRYPTION_KEY: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        ENCRYPTION_KEY: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+    }),
-      }),
+    "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-    /strong random value/,
   );
 });
 
@@ -138,4 +138,3 @@ test("deployment and rollback boundaries use the centralized sanitizer before pe
   assert.match(containerHealth, /lastReason = sanitizeDeploymentError\(error/);
 });
 
-