fix(security): fail closed when requested Fernet is unavailable (#156)

* test(security): reject unavailable Fernet before DB access

* fix(security): fail closed on unavailable Fernet capability

---------

Co-authored-by: opencode-agent[bot] <219766164+opencode-agent[bot]@users.noreply.github.com>

Author: seonghobae

pg_llm_batch/config.py

@@ -300,18 +300,17 @@ def __init__(self, dsn: str, fernet_key: Optional[str] = None) -> None:
             raise ConfigError("psycopg is required for SecretStore")
         if not dsn:
             raise ConfigError("A Postgres DSN must be provided explicitly")
+        if fernet_key and Fernet is None:
+            raise ConfigError(
+                "Fernet encryption requires the optional cryptography dependency"
+            )
         self.dsn = dsn
         self._conn = psycopg.connect(self.dsn)
         try:
             self._conn.autocommit = True
             self._fernet = None
             if fernet_key and Fernet is not None:
                 self._fernet = Fernet(fernet_key.encode("utf-8"))
-            elif fernet_key and Fernet is None:  # pragma: no cover
-                logger.warning(
-                    "Fernet key supplied but 'cryptography' is not installed; "
-                    "storing secrets base64-obfuscated instead."
-                )
             self._ensure_table()
         except BaseException:
             self.close()
@@ -403,4 +402,4 @@ def close(self) -> None:
 
 def get_config_store(dsn: str) -> PostgresConfigStore:
     """Construct a config store. DSN must be passed explicitly (no getenv)."""
-    return PostgresConfigStore(dsn)
+    return PostgresConfigStore(dsn)

tests/test_secret_store_fernet_availability.py

@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: Apache-2.0
+"""Regression tests for SecretStore encryption capability boundaries."""
+
+from __future__ import annotations
+
+import pytest
+
+from pg_llm_batch import config as config_mod
+from pg_llm_batch.exceptions import ConfigError
+
+
+class _Connection:
+    """Minimal connection double that records deterministic cleanup."""
+
+    def __init__(self) -> None:
+        self.autocommit = False
+        self.close_calls = 0
+
+    def close(self) -> None:
+        self.close_calls += 1
+
+
+class _Psycopg:
+    """Record whether database acquisition happened before local validation."""
+
+    def __init__(self) -> None:
+        self.connect_calls = 0
+        self.connection = _Connection()
+
+    def connect(self, _dsn: str) -> _Connection:
+        self.connect_calls += 1
+        return self.connection
+
+
+def test_fernet_request_fails_before_database_access_when_crypto_is_unavailable(
+    monkeypatch,
+) -> None:
+    """Never downgrade an explicit encryption request to Base64 persistence."""
+    fake_psycopg = _Psycopg()
+    monkeypatch.setattr(config_mod, "psycopg", fake_psycopg)
+    monkeypatch.setattr(config_mod, "Fernet", None)
+    monkeypatch.setattr(config_mod.SecretStore, "_ensure_table", lambda _self: None)
+
+    with pytest.raises(ConfigError, match="Fernet"):
+        config_mod.SecretStore("postgresql://database", fernet_key="explicit-key")
+
+    assert fake_psycopg.connect_calls == 0
+    assert fake_psycopg.connection.close_calls == 0