From 722d82942c50a2092847acff294541a3e554bc8e Mon Sep 17 00:00:00 2001
From: Jan Leon <Jan.gaschler@gmail.com>
Date: Mon, 29 Jun 2026 17:18:26 +0200
Subject: [PATCH] chore: remove unused encryption config validator (#5364)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Integrated into release/v3.8.41 — dead-code removal (typecheck:core EXIT 0, 70 affected tests green, fabricated-docs clean). Thanks @JxnLexn.
---
 src/lib/db/encryption.ts         | 34 --------------------------------
 tests/unit/db-encryption.test.ts |  1 +
 2 files changed, 1 insertion(+), 34 deletions(-)

diff --git a/src/lib/db/encryption.ts b/src/lib/db/encryption.ts
index 960ac32870..1559c14bb5 100644
--- a/src/lib/db/encryption.ts
+++ b/src/lib/db/encryption.ts
@@ -241,40 +241,6 @@ export function decryptConnectionFields<T extends ConnectionFields | null | unde
   };
 }
 
-/**
- * Validate encryption configuration at startup.
- * Returns { valid: true } or { valid: false, error: string } with actionable guidance.
- */
-export function validateEncryptionConfig(): { valid: boolean; error?: string } {
-  const secret = process.env.STORAGE_ENCRYPTION_KEY;
-
-  // No key set — passthrough mode is fine
-  if (!secret) return { valid: true };
-
-  if (typeof secret !== "string" || secret.trim().length === 0) {
-    return {
-      valid: false,
-      error:
-        "STORAGE_ENCRYPTION_KEY is set but empty. " +
-        "Either remove it (passthrough mode) or set a valid key: openssl rand -base64 32",
-    };
-  }
-
-  // Try deriving a key to verify it works
-  try {
-    scryptSync(secret, STATIC_SALT, KEY_LENGTH);
-    return { valid: true };
-  } catch (err: unknown) {
-    const message = err instanceof Error ? err.message : String(err);
-    return {
-      valid: false,
-      error:
-        `STORAGE_ENCRYPTION_KEY is invalid (${message}). ` +
-        `Generate a valid key with: openssl rand -base64 32`,
-    };
-  }
-}
-
 /**
  * Specifically tests a ciphertext against the legacy key. If it succeeds, it
  * re-encrypts the decrypted value with the canonical static key.
diff --git a/tests/unit/db-encryption.test.ts b/tests/unit/db-encryption.test.ts
index d228d46772..296fc736c3 100644
--- a/tests/unit/db-encryption.test.ts
+++ b/tests/unit/db-encryption.test.ts
@@ -39,6 +39,7 @@ test("encryption stays in passthrough mode when no storage key is configured", a
   assert.equal(encryption.encrypt(""), "");
   assert.equal(encryption.decrypt(null), null);
   assert.equal(encryption.decrypt(undefined), undefined);
+  assert.equal("validateEncryptionConfig" in encryption, false);
 });
 
 test("encrypt/decrypt round-trip uses the expected serialized format", async () => {