Skip to content

fix: Removed the multiple prompt for marketplace encryption key#17

Open
cs-raj wants to merge 1 commit intov2-dev-bugfixfrom
fix/DX-4907
Open

fix: Removed the multiple prompt for marketplace encryption key#17
cs-raj wants to merge 1 commit intov2-dev-bugfixfrom
fix/DX-4907

Conversation

@cs-raj
Copy link
Contributor

@cs-raj cs-raj commented Mar 7, 2026

version bump: done

Fix: Duplicate Marketplace App Configurations Encryption Key Prompt on Export

Problem

When running cm:stacks:export without the -y flag (i.e. when not forcing marketplace prompts), the "Enter Marketplace app configurations encryption key" prompt was shown twice before the marketplace apps progress bar, causing a confusing UX.

Root Cause

In the export flow, the encryption key was requested in two places for the same run:

  1. In ExportMarketplaceApps.start() – A "validate before progress" block explicitly called askEncryptionKey(this.exportConfig). The return value was not used.
  2. Inside createNodeCryptoInstance() (marketplace-app-helper) – When forceStopMarketplaceAppsPrompt is false, this function also calls askEncryptionKey(config) to get the key before creating the NodeCrypto instance.

So the user was prompted once in start() and again when createNodeCryptoInstance() ran immediately after.

Solution

  • Removed the redundant await askEncryptionKey(this.exportConfig) call from start() in cli-plugins/packages/contentstack-export/src/export/modules/marketplace-apps.ts.
  • Removed the unused askEncryptionKey import from that file.
  • Kept the "prompt before progress" behaviour: the block still runs before the progress bar and still calls createNodeCryptoInstance(this.exportConfig), which performs the single prompt internally.

No changes were made to marketplace-app-helper.ts or to the import plugin source; import already prompted once via getAndValidateEncryptionKey().

Tests Added

Export (contentstack-export)

  • File: test/unit/export/modules/marketplace-apps.test.ts
  • Test: should call createNodeCryptoInstance exactly once when prompting for encryption key before progress
  • Asserts that when start() runs with forceStopMarketplaceAppsPrompt: false and apps are present, createNodeCryptoInstance is invoked exactly once, preventing regression of the double-prompt.

Import (contentstack-import)

  • File: test/unit/import/modules/marketplace-apps.test.ts
  • Test: should call getAndValidateEncryptionKey exactly once when prompt is not forced and start runs
  • Asserts that when start() runs with prompt not forced, getAndValidateEncryptionKey is called exactly once, documenting and guarding the existing single-prompt behaviour.

Verification

  • Export unit tests (including the new marketplace-apps and helper tests) pass.
  • Import unit test for the new case passes.
  • Manual check: run cm:stacks:export with a stack that has marketplace apps, without -y, and confirm the encryption key prompt appears once before the progress bar.

@cs-raj cs-raj requested a review from a team as a code owner March 7, 2026 08:23
@github-actions
Copy link

github-actions bot commented Mar 7, 2026

🔒 Security Scan Results

ℹ️ Note: Only vulnerabilities with available fixes (upgrades or patches) are counted toward thresholds.

Check Type Count (with fixes) Without fixes Threshold Result
🔴 Critical Severity 0 0 10 ✅ Passed
🟠 High Severity 2 1 25 ✅ Passed
🟡 Medium Severity 0 0 500 ✅ Passed
🔵 Low Severity 0 0 1000 ✅ Passed

⏱️ SLA Breach Summary

✅ No SLA breaches detected. All vulnerabilities are within acceptable time thresholds.

Severity Breaches (with fixes) Breaches (no fixes) SLA Threshold (with/no fixes) Status
🔴 Critical 0 0 15 / 30 days ✅ Passed
🟠 High 0 0 30 / 120 days ✅ Passed
🟡 Medium 0 0 90 / 365 days ✅ Passed
🔵 Low 0 0 180 / 365 days ✅ Passed

ℹ️ Vulnerabilities Without Available Fixes (Informational Only)

The following vulnerabilities were detected but do not have fixes available (no upgrade or patch). These are excluded from failure thresholds:

  • Critical without fixes: 0
  • High without fixes: 1
  • Medium without fixes: 0
  • Low without fixes: 0

✅ BUILD PASSED - All security checks passed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant