fix(storage): do not query the encryption key registry when storage is off

Deployments that never enable storage - the SaaS flavour among them -
query file_encryption_keys during bean creation, because the decrypt-only
probe runs whenever storage.encryption.enabled is false. That table only
exists if ddl-auto managed to create it, and ddl-auto logs and continues
when it cannot, so a schema warning becomes a refusal to start. Reported
against 'task backend:dev:saas', where storage.enabled is false and the
schema is Supabase's stirling_pdf.

- The boot probe now runs only when storage.enabled is true, so a
  deployment that does not use storage never touches the table.
- Registry reads are wrapped: the boot probe degrades to 'no keys'
  instead of propagating, and suppressDirectDownloads() fails SAFE
  (suppresses) rather than handing out a presigned URL it cannot vouch
  for. Losing the direct-download fast path is recoverable; serving
  ciphertext is not.

Safety is unchanged. The decorator is still installed unconditionally, so
any blob carrying the SPDFEAR1 magic is decrypted via lazy materialisation
or fails loudly; the probe only ever bought earlier master-key
verification. A node that can actually serve stored files has
storage.enabled by definition, which is why the drifted-node test now
configures it that way.

Tests: storage-disabled never calls count(); an unreadable registry still
boots and still suppresses direct downloads; the decorator stays installed
with storage off; storage-enabled still probes.

Author: ConnorYoh

app/proprietary/src/main/java/stirling/software/proprietary/storage/config/StorageProviderConfig.java

@@ -70,7 +70,10 @@ public StorageEncryptionState storageEncryptionState(
                                 createKeyService(
                                         configuredFileEncryptionKey, clusterEnabled, requiresNew),
                         fileEncryptionKeyRepository);
-        if (writeEnabled || fileEncryptionKeyRepository.count() > 0) {
+        // The registry table may not exist when storage is unused, so only probe if it is on.
+        boolean probeForExistingKeys =
+                !writeEnabled && applicationProperties.getStorage().isEnabled();
+        if (writeEnabled || (probeForExistingKeys && state.encryptedContentMayExist())) {
             state.initialiseEagerly();
             log.info(
                     "Storage encryption at rest active (writes {})",

app/proprietary/src/main/java/stirling/software/proprietary/storage/crypto/StorageEncryptionState.java

@@ -1,6 +1,7 @@
 package stirling.software.proprietary.storage.crypto;
 
 import java.time.Duration;
+import java.util.Optional;
 import java.util.function.Supplier;
 
 import lombok.extern.slf4j.Slf4j;
@@ -104,9 +105,28 @@ public boolean suppressDirectDownloads() {
                 && now - keysExistCheckedAtNanos < KEYS_EXIST_CACHE_TTL.toNanos()) {
             return keysExistCached;
         }
-        keysExistCached = keyRepository.count() > 0;
+        keysExistCached = countKeys().orElse(true /* unreadable registry: fail safe */);
         keysExistCheckedAtNanos = now;
         keysExistEverChecked = true;
         return keysExistCached;
     }
+
+    /** True when key rows exist; empty when the registry could not be read. */
+    private Optional<Boolean> countKeys() {
+        try {
+            return Optional.of(keyRepository.count() > 0);
+        } catch (RuntimeException e) {
+            log.warn(
+                    "Could not read the storage encryption key registry ({}). Treating direct"
+                            + " downloads as unsafe; encrypted content is still decrypted on"
+                            + " demand.",
+                    e.getMessage());
+            return Optional.empty();
+        }
+    }
+
+    /** Whether key rows exist, for the decrypt-only startup path; false if unreadable. */
+    public boolean encryptedContentMayExist() {
+        return countKeys().orElse(false);
+    }
 }

app/proprietary/src/test/java/stirling/software/proprietary/storage/config/StorageProviderConfigTest.java

@@ -4,15 +4,19 @@
 import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import java.util.Base64;
 import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
+import org.springframework.dao.InvalidDataAccessResourceUsageException;
 import org.springframework.transaction.PlatformTransactionManager;
 
 import stirling.software.common.model.ApplicationProperties;
@@ -24,6 +28,7 @@
 import stirling.software.proprietary.storage.crypto.InMemoryKeyRepo;
 import stirling.software.proprietary.storage.crypto.StorageEncryptionState;
 import stirling.software.proprietary.storage.provider.StorageProvider;
+import stirling.software.proprietary.storage.repository.FileEncryptionKeyRepository;
 import stirling.software.proprietary.storage.repository.StoredFileBlobRepository;
 
 /**
@@ -66,16 +71,16 @@ void decorator_writeEnabled_requiresLicenceAndSuppressesDirectDownloads() {
 
     @Test
     void decorator_flagOffButKeysExist_decryptOnlyModeStillMaterialises() throws Exception {
-        // Simulate the drifted-node case: another node already created keys.
-        StorageProviderConfig seedCfg = newConfig("local", License.SERVER, true);
+        // Drifted node: keys created elsewhere; storage on, as it must be to serve files.
+        StorageProviderConfig seedCfg = newConfig("local", License.SERVER, true, true);
         StorageEncryptionState seedState = seedCfg.storageEncryptionState(MASTER, false, txManager);
         Team team = new Team();
         team.setId(1L);
         User owner = new User();
         owner.setTeam(team);
         seedState.keyService().activeKekForOwner(owner);
 
-        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false, true);
         StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
 
         assertThat(cfg.storageProvider(state, Optional.empty()))
@@ -104,6 +109,44 @@ void encryption_enabled_wrongLengthKey_failsStartup() {
                 .hasMessageContaining("32 bytes");
     }
 
+    // ---- deployments that do not use storage (the SaaS shape) ---------------------------
+
+    @Test
+    void storageDisabled_neverQueriesTheKeyRegistry() {
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
+
+        assertThat(state.isWriteEnabled()).isFalse();
+        verify(keyRepo.mock, never()).count();
+    }
+
+    @Test
+    void storageDisabled_decoratorStillInstalledSoCiphertextIsNeverServedRaw() {
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
+
+        assertThat(cfg.storageProvider(state, Optional.empty()))
+                .isInstanceOf(EncryptingStorageProvider.class);
+    }
+
+    @Test
+    void unreadableKeyRegistry_stillStartsAndFailsSafeOnDirectDownloads() {
+        FileEncryptionKeyRepository broken = mock(FileEncryptionKeyRepository.class);
+        when(broken.count())
+                .thenThrow(new InvalidDataAccessResourceUsageException("no such table"));
+        StorageEncryptionState state = new StorageEncryptionState(false, () -> null, broken);
+
+        assertThat(state.encryptedContentMayExist()).isFalse();
+        assertThat(state.suppressDirectDownloads()).isTrue();
+    }
+
+    @Test
+    void storageEnabledWithoutEncryption_probesRegistry() {
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false, true);
+        cfg.storageEncryptionState(MASTER, false, txManager);
+        verify(keyRepo.mock, atLeastOnce()).count();
+    }
+
     // ---- backend licence gates (unchanged behaviour) ------------------------------------
 
     @Test
@@ -161,9 +204,14 @@ void provider_unknown_throwsUnsupportedProvider_notLicense() {
 
     private StorageProviderConfig newConfig(
             String provider, License license, boolean encryptionEnabled) {
+        return newConfig(provider, license, encryptionEnabled, false);
+    }
+
+    private StorageProviderConfig newConfig(
+            String provider, License license, boolean encryptionEnabled, boolean storageEnabled) {
         ApplicationProperties props = new ApplicationProperties();
         props.getStorage().setProvider(provider);
-        props.getStorage().setEnabled(false); // local-fallback path skips dir creation
+        props.getStorage().setEnabled(storageEnabled);
         props.getStorage().getEncryption().setEnabled(encryptionEnabled);
         StoredFileBlobRepository repo = mock(StoredFileBlobRepository.class);
         LicenseKeyChecker checker = mock(LicenseKeyChecker.class);