Add TURSO_DB_REMOTE_ENCRYPTION_KEY to specify encryption key via env

Author: avinassh

internal/cmd/db_create.go

@@ -108,7 +108,7 @@ func CreateDatabase(name string) error {
 	spinner := prompt.Spinner(fmt.Sprintf("Creating database %s in group %s...", internal.Emph(name), internal.Emph(groupName)))
 	defer spinner.Stop()
 
-	if _, err = client.Databases.Create(name, location, "", "", groupName, schemaFlag, typeFlag == "schema", seed, sizeLimitFlag, remoteEncryptionCipherFlag, remoteEncryptionKeyFlag, spinner); err != nil {
+	if _, err = client.Databases.Create(name, location, "", "", groupName, schemaFlag, typeFlag == "schema", seed, sizeLimitFlag, remoteEncryptionCipherFlag, remoteEncryptionKeyFlag(), spinner); err != nil {
 		return fmt.Errorf("could not create database %s: %w", name, err)
 	}
 
@@ -218,18 +218,19 @@ func shouldAutoCreateGroup(name string, groups []turso.Group) bool {
 }
 
 func validateEncryptionFlags() error {
-	if remoteEncryptionKeyFlag == "" && remoteEncryptionCipherFlag == "" {
+	remoteEncryptionKey := remoteEncryptionKeyFlag()
+	if remoteEncryptionKey == "" && remoteEncryptionCipherFlag == "" {
 		return nil
 	}
 	// if key flag is empty, then user passed only the cipher, which is invalid
-	if remoteEncryptionKeyFlag == "" {
+	if remoteEncryptionKey == "" {
 		return fmt.Errorf("remote encryption key must be provided when remote encryption cipher is set")
 	}
 
 	// if key is provided, lets verify its in base64 encoded
-	_, err := base64.StdEncoding.DecodeString(remoteEncryptionKeyFlag)
+	_, err := base64.StdEncoding.DecodeString(remoteEncryptionKey)
 	if err != nil {
-		return fmt.Errorf("encryption key (%s) is not valid base64: %w", remoteEncryptionKeyFlag, err)
+		return fmt.Errorf("encryption key (%s) is not valid base64: %w", remoteEncryptionKey, err)
 	}
 
 	if remoteEncryptionCipherFlag != "" {

internal/cmd/db_export.go

@@ -50,7 +50,7 @@ func ExportDatabase(dbName, outputFile string, withMetadata bool, overwrite bool
 		return fmt.Errorf("failed to find database: %w", err)
 	}
 	dbUrl := getDatabaseHttpUrl(&db)
-	err = client.Databases.Export(dbName, dbUrl, outputFile, withMetadata, overwrite, remoteEncryptionKeyFlag)
+	err = client.Databases.Export(dbName, dbUrl, outputFile, withMetadata, overwrite, remoteEncryptionKeyFlag())
 	if err != nil {
 		return err
 	}

internal/cmd/db_shell.go

@@ -231,7 +231,7 @@ var shellCmd = &cobra.Command{
 			DbUri:               dbUrl,
 			Proxy:               proxy,
 			AuthToken:           authToken,
-			RemoteEncryptionKey: remoteEncryptionKeyFlag,
+			RemoteEncryptionKey: remoteEncryptionKeyFlag(),
 			InF:                 cmd.InOrStdin(),
 			OutF:                cmd.OutOrStdout(),
 			ErrF:                cmd.ErrOrStderr(),

internal/cmd/encryption_flag.go

@@ -1,14 +1,26 @@
 package cmd
 
-import "github.com/spf13/cobra"
+import (
+	"os"
 
-var remoteEncryptionKeyFlag string
+	"github.com/spf13/cobra"
+)
+
+// unexported, don't use directly. Consider using remoteEncryptionKeyFlag()
+var remoteEncryptionKeyArg string
 var remoteEncryptionCipherFlag string
 
 func addRemoteEncryptionKeyFlag(cmd *cobra.Command) {
-	cmd.Flags().StringVar(&remoteEncryptionKeyFlag, "remote-encryption-key", "", "Encryption key (in base64) for accessing encrypted databases on Turso cloud")
+	cmd.Flags().StringVar(&remoteEncryptionKeyArg, "remote-encryption-key", "", "Encryption key (in base64) for accessing encrypted databases on Turso cloud")
 }
 
 func addRemoteEncryptionCipherFlag(cmd *cobra.Command) {
 	cmd.Flags().StringVar(&remoteEncryptionCipherFlag, "remote-encryption-cipher", "", "Cipher to use for database encryption")
 }
+
+func remoteEncryptionKeyFlag() string {
+	if remoteEncryptionKeyArg != "" {
+		return remoteEncryptionKeyArg
+	}
+	return os.Getenv("TURSO_DB_REMOTE_ENCRYPTION_KEY")
+}