Add fail fast flag for config client if local decryption fails

On the server we choose not to fail if a property cannot be decrypted (clients
might be relying on the other values to be able to deal with the failure).

Fixes gh-31

spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EncryptionBootstrapConfiguration.java

@@ -47,6 +47,9 @@ public class EncryptionBootstrapConfiguration {
 	@Autowired(required = false)
 	private TextEncryptor encryptor;
 
+	@Autowired
+	private KeyProperties key;
+
 	@Configuration
 	@Conditional(KeyCondition.class)
 	@ConditionalOnClass(RsaSecretEncryptor.class)
@@ -91,7 +94,9 @@ public class EncryptionBootstrapConfiguration {
 		if (encryptor == null) {
 			encryptor = new FailsafeTextEncryptor();
 		}
-		return new EnvironmentDecryptApplicationListener(encryptor);
+		EnvironmentDecryptApplicationListener listener = new EnvironmentDecryptApplicationListener(encryptor);
+		listener.setFailOnError(key.isFailOnError());
+		return listener;
 	}
 
 	public static class KeyCondition extends SpringBootCondition {

spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListener.java

@@ -50,6 +50,8 @@ public class EnvironmentDecryptApplicationListener implements
 
 	private Field propertySourcesField;
 
+	private boolean failOnError = true;
+
 	{
 		initField();
 	}
@@ -64,6 +66,15 @@ public class EnvironmentDecryptApplicationListener implements
 		this.encryptor = encryptor;
 	}
 
+	/**
+	 * Strategy to determine how to handle exceptions during decryption.
+	 * 
+	 * @param failOnError the flag value (default true)
+	 */
+	public void setFailOnError(boolean failOnError) {
+		this.failOnError = failOnError;
+	}
+
 	@Override
 	public int getOrder() {
 		return order;
@@ -71,7 +82,7 @@ public class EnvironmentDecryptApplicationListener implements
 
 	@Override
 	public void initialize(ConfigurableApplicationContext applicationContext) {
-		
+
 		ConfigurableEnvironment environment = applicationContext.getEnvironment();
 		Map<String, Object> overrides = new LinkedHashMap<String, Object>();
 		for (PropertySource<?> source : environment.getPropertySources()) {
@@ -99,12 +110,18 @@ public class EnvironmentDecryptApplicationListener implements
 						}
 					}
 					catch (Exception e) {
-						if (logger.isDebugEnabled()) {
-							logger.warn("Cannot decrypt: key=" + key, e);
-						} else {
-							logger.warn("Cannot decrypt: key=" + key);
+						String message = "Cannot decrypt: key=" + key;
+						if (failOnError) {
+							throw new IllegalStateException(message, e);
 						}
-						// Set value to empty to avoid making a password out of the cipher text
+						if (logger.isDebugEnabled()) {
+							logger.warn(message, e);
+						}
+						else {
+							logger.warn(message);
+						}
+						// Set value to empty to avoid making a password out of the
+						// cipher text
 						value = "";
 					}
 					overrides.put(key, value);

spring-cloud-config-client/src/main/java/org/springframework/cloud/bootstrap/encrypt/KeyProperties.java

@@ -22,9 +22,19 @@ import org.springframework.core.io.Resource;
 public class KeyProperties {
 
 	private String key;
+	
+	private boolean failOnError = true;
 
 	private KeyProperties.KeyStore keyStore = new KeyStore();
 
+	public boolean isFailOnError() {
+		return failOnError;
+	}
+
+	public void setFailOnError(boolean failOnError) {
+		this.failOnError = failOnError;
+	}
+
 	public String getKey() {
 		return key;
 	}

spring-cloud-config-client/src/test/java/org/springframework/cloud/bootstrap/encrypt/EnvironmentDecryptApplicationListenerTests.java

@@ -0,0 +1,62 @@
+/*
+ * Copyright 2013-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.cloud.bootstrap.encrypt;
+
+import static org.junit.Assert.assertEquals;
+
+import org.junit.Test;
+import org.springframework.boot.test.EnvironmentTestUtils;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.security.crypto.encrypt.Encryptors;
+
+/**
+ * @author Dave Syer
+ *
+ */
+public class EnvironmentDecryptApplicationListenerTests {
+	
+	private EnvironmentDecryptApplicationListener listener = new EnvironmentDecryptApplicationListener(Encryptors.noOpText());
+
+	@Test
+	public void decryptCipherKey() {
+		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
+		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
+		listener.initialize(context);
+		assertEquals("bar", context.getEnvironment().getProperty("foo"));
+	}
+
+	@Test(expected=IllegalStateException.class)
+	public void errorOnDecrypt() {
+		listener = new EnvironmentDecryptApplicationListener(Encryptors.text("deadbeef", "AFFE37"));
+		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
+		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
+		listener.initialize(context);
+		assertEquals("bar", context.getEnvironment().getProperty("foo"));
+	}
+
+	@Test
+	public void errorOnDecryptWithEmpty() {
+		listener = new EnvironmentDecryptApplicationListener(Encryptors.text("deadbeef", "AFFE37"));
+		listener.setFailOnError(false);
+		ConfigurableApplicationContext context = new AnnotationConfigApplicationContext();
+		EnvironmentTestUtils.addEnvironment(context, "foo: {cipher}bar");
+		listener.initialize(context);
+		// Empty is safest fallback for undecryptable cipher
+		assertEquals("", context.getEnvironment().getProperty("foo"));
+	}
+
+}

spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/SpringApplicationEnvironmentRepository.java

@@ -42,6 +42,17 @@ public class SpringApplicationEnvironmentRepository implements EnvironmentReposi
 
 	private String[] locations;
 
+	private boolean failOnError = false;
+
+	/**
+	 * Strategy to determine how to handle exceptions during decryption.
+	 * 
+	 * @param failOnError the flag value (default false)
+	 */
+	public void setFailOnError(boolean failOnError) {
+		this.failOnError = failOnError;
+	}
+
 	@Override
 	public Environment findOne(String config, String profile, String label) {
 		SpringApplicationBuilder builder = new SpringApplicationBuilder(
@@ -78,6 +89,7 @@ public class SpringApplicationEnvironmentRepository implements EnvironmentReposi
 		}
 		list.add("--spring.config.name=" + config);
 		list.add("--spring.cloud.bootstrap.enabled=false");
+		list.add("--encrypt.failOnError=" + failOnError);
 		if (locations != null) {
 			list.add("--spring.config.location="
 					+ StringUtils.arrayToCommaDelimitedString(locations));