From 938fb861d039b0c33d2c341f69c33077cd9e28a4 Mon Sep 17 00:00:00 2001
From: Roberto Paolillo <roberto.paolillo@gmail.com>
Date: Wed, 19 May 2021 13:28:22 +0200
Subject: [PATCH] Decrypt after config data refresh

Fixes gh-962
Fixes gh-955
---
 .../refresh/ConfigDataContextRefresher.java   |  5 +++++
 .../encrypt/EncryptionIntegrationTests.java   | 22 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/spring-cloud-context/src/main/java/org/springframework/cloud/context/refresh/ConfigDataContextRefresher.java b/spring-cloud-context/src/main/java/org/springframework/cloud/context/refresh/ConfigDataContextRefresher.java
index c1fd0bfb..74cf11cb 100644
--- a/spring-cloud-context/src/main/java/org/springframework/cloud/context/refresh/ConfigDataContextRefresher.java
+++ b/spring-cloud-context/src/main/java/org/springframework/cloud/context/refresh/ConfigDataContextRefresher.java
@@ -20,6 +20,7 @@ import org.springframework.boot.ConfigurableBootstrapContext;
 import org.springframework.boot.DefaultBootstrapContext;
 import org.springframework.boot.context.config.ConfigDataEnvironmentPostProcessor;
 import org.springframework.cloud.autoconfigure.RefreshAutoConfiguration;
+import org.springframework.cloud.bootstrap.encrypt.DecryptEnvironmentPostProcessor;
 import org.springframework.cloud.context.scope.refresh.RefreshScope;
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.core.env.MutablePropertySources;
@@ -33,6 +34,8 @@ import org.springframework.core.io.DefaultResourceLoader;
  */
 public class ConfigDataContextRefresher extends ContextRefresher {
 
+	private final DecryptEnvironmentPostProcessor decryptEnvironmentPostProcessor = new DecryptEnvironmentPostProcessor();
+
 	@Deprecated
 	public ConfigDataContextRefresher(ConfigurableApplicationContext context, RefreshScope scope) {
 		super(context, scope);
@@ -83,6 +86,8 @@ public class ConfigDataContextRefresher extends ContextRefresher {
 				}
 			}
 		}
+
+		decryptEnvironmentPostProcessor.postProcessEnvironment(getContext().getEnvironment(), null);
 	}
 
 }
diff --git a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
index a53170aa..01d28857 100644
--- a/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
+++ b/spring-cloud-context/src/test/java/org/springframework/cloud/bootstrap/encrypt/EncryptionIntegrationTests.java
@@ -23,8 +23,12 @@ import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.builder.SpringApplicationBuilder;
 import org.springframework.boot.context.properties.ConfigurationProperties;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.boot.test.util.TestPropertyValues;
+import org.springframework.cloud.context.refresh.ContextRefresher;
 import org.springframework.context.ConfigurableApplicationContext;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.env.ConfigurableEnvironment;
+import org.springframework.security.crypto.encrypt.TextEncryptor;
 
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.assertj.core.api.BDDAssertions.then;
@@ -118,6 +122,24 @@ public class EncryptionIntegrationTests {
 		then(context.getBean(PasswordProperties.class).getPassword()).isEqualTo("test");
 	}
 
+	@Test
+	public void decryptAfterRefresh() {
+		ConfigurableApplicationContext context = new SpringApplicationBuilder(TestAutoConfiguration.class)
+				.web(WebApplicationType.NONE)
+				.properties("encrypt.key:pie",
+						"foo.password:{cipher}bf29452295df354e6153c5b31b03ef23c70e55fba24299aa85c63438f1c43c95",
+						"spring.cloud.refresh.enabled:true")
+				.run();
+		TextEncryptor encryptor = context.getBean(TextEncryptor.class);
+		ContextRefresher refresher = context.getBean(ContextRefresher.class);
+		ConfigurableEnvironment env = context.getBean(ConfigurableEnvironment.class);
+		then(env.getProperty("foo.password")).isEqualTo("test");
+		TestPropertyValues.of("foo.password={cipher}" + encryptor.encrypt("newValue")).applyTo(env);
+		refresher.refresh();
+		then(env.getProperty("foo.password")).isEqualTo("newValue");
+		context.close();
+	}
+
 	@Configuration(proxyBeanMethods = false)
 	@EnableConfigurationProperties(PasswordProperties.class)
 	protected static class TestConfiguration {