pouriade.com · A secret the server can no longer decrypt, as after a lost SECRET_KEY, reads as unset and is flagged, rather than failing the page that reads it or, for an admin plugin's options, the server's startup. The settings page's web search, the admin plugin forms, and every other schema form say on each secret field that its saved value can't be read and to enter it again, and an admin can tick Clear to discard it. A BYO key that can't be read says so on the API keys page in place of its last four characters, found from its key ID without decrypting it, and a turn that uses it ends with an error asking for the key again. The unreadable value is kept until a new secret is entered, cleared, or reset, so restoring the old key in SECRET_KEYS_OLD brings it back. SecretBox gains tryDecrypt and hasKeyFor, and a value that fails authentication now throws SecretDecryptError too. · 2w ago