address review comments

Author: avinassh

internal/cmd/db_create.go

@@ -1,6 +1,7 @@
 package cmd
 
 import (
+	"encoding/base64"
 	"fmt"
 	"strings"
 	"time"
@@ -95,6 +96,10 @@ func CreateDatabase(name string) error {
 		version = "canary"
 	}
 
+	if err = validateEncryptionFlags(); err != nil {
+		return err
+	}
+
 	if err := ensureGroup(client, groupName, groups, location, version); err != nil {
 		return err
 	}
@@ -211,3 +216,29 @@ func shouldAutoCreateGroup(name string, groups []turso.Group) bool {
 	// we only create the default group automatically
 	return name == "default" && len(groups) == 0
 }
+
+func validateEncryptionFlags() error {
+	if remoteEncryptionKeyFlag == "" && remoteEncryptionCipherFlag == "" {
+		return nil
+	}
+	// if key flag is empty, then user passed only the cipher, which is invalid
+	if remoteEncryptionKeyFlag == "" {
+		return fmt.Errorf("remote encryption key must be provided when remote encryption cipher is set")
+	}
+
+	// if key is provided, lets verify its in base64 encoded
+	_, err := base64.StdEncoding.DecodeString(remoteEncryptionKeyFlag)
+	if err != nil {
+		return fmt.Errorf("encryption key (%s) is not valid base64: %w", remoteEncryptionKeyFlag, err)
+	}
+
+	if remoteEncryptionCipherFlag != "" {
+		return nil
+	}
+
+	// if cipher is empty, then it is only valid in case of forks and for everything else we need to have it set
+	if fromDBFlag == "" {
+		return fmt.Errorf("remote encryption cipher must be provided when remote encryption key is set")
+	}
+	return nil
+}

internal/turso/turso.go

@@ -148,6 +148,9 @@ func (t *Client) Get(path string, body io.Reader) (*http.Response, error) {
 }
 
 func (t *Client) GetWithHeaders(path string, body io.Reader, headers map[string]string) (*http.Response, error) {
+	if headers == nil {
+		headers = make(map[string]string)
+	}
 	headers["Content-Type"] = "application/json"
 	return t.do("GET", path, body, headers)
 }
@@ -157,6 +160,9 @@ func (t *Client) Post(path string, body io.Reader) (*http.Response, error) {
 }
 
 func (t *Client) PostBinary(path string, body io.Reader, headers map[string]string) (*http.Response, error) {
+	if headers == nil {
+		headers = make(map[string]string)
+	}
 	headers["Content-Type"] = "application/octet-stream"
 	return t.do("POST", path, body, headers)
 }

internal/turso/tursoServer.go

@@ -82,7 +82,7 @@ func (i *TursoServerClient) UploadFile(filepath, remoteEncryptionCipher, remoteE
 	}
 
 	headers := map[string]string{}
-	if remoteEncryptionCipher != "" {
+	if remoteEncryptionCipher != "" && remoteEncryptionKey != "" {
 		headers[EncryptionCipherHeader] = remoteEncryptionCipher
 		headers[EncryptionKeyHeader] = remoteEncryptionKey
 	}