fix(storage): do not query the encryption key registry when storage is off

Deployments that never enable storage - the SaaS flavour among them -
query file_encryption_keys during bean creation, because the decrypt-only
probe runs whenever storage.encryption.enabled is false. That table only
exists if ddl-auto managed to create it, and ddl-auto logs and continues
when it cannot, so a schema warning becomes a refusal to start. Reported
against 'task backend:dev:saas', where storage.enabled is false and the
schema is Supabase's stirling_pdf.

- The boot probe now runs only when storage.enabled is true, so a
  deployment that does not use storage never touches the table.
- Registry reads are wrapped: the boot probe degrades to 'no keys'
  instead of propagating, and suppressDirectDownloads() fails SAFE
  (suppresses) rather than handing out a presigned URL it cannot vouch
  for. Losing the direct-download fast path is recoverable; serving
  ciphertext is not.

Safety is unchanged. The decorator is still installed unconditionally, so
any blob carrying the SPDFEAR1 magic is decrypted via lazy materialisation
or fails loudly; the probe only ever bought earlier master-key
verification. A node that can actually serve stored files has
storage.enabled by definition, which is why the drifted-node test now
configures it that way.

Tests: storage-disabled never calls count(); an unreadable registry still
boots and still suppresses direct downloads; the decorator stays installed
with storage off; storage-enabled still probes.

Author: ConnorYoh

app/proprietary/src/main/java/stirling/software/proprietary/storage/config/StorageProviderConfig.java

@@ -70,7 +70,12 @@ public StorageEncryptionState storageEncryptionState(
                                 createKeyService(
                                         configuredFileEncryptionKey, clusterEnabled, requiresNew),
                         fileEncryptionKeyRepository);
-        if (writeEnabled || fileEncryptionKeyRepository.count() > 0) {
+        // Only probe the key registry when storage is actually in use. Deployments that never
+        // enable storage (the SaaS flavour among them) may not have the table at all, and a
+        // startup query for a feature they do not use must not be able to stop them booting.
+        boolean probeForExistingKeys =
+                !writeEnabled && applicationProperties.getStorage().isEnabled();
+        if (writeEnabled || (probeForExistingKeys && state.encryptedContentMayExist())) {
             state.initialiseEagerly();
             log.info(
                     "Storage encryption at rest active (writes {})",

app/proprietary/src/main/java/stirling/software/proprietary/storage/crypto/StorageEncryptionState.java

@@ -1,6 +1,7 @@
 package stirling.software.proprietary.storage.crypto;
 
 import java.time.Duration;
+import java.util.Optional;
 import java.util.function.Supplier;
 
 import lombok.extern.slf4j.Slf4j;
@@ -91,6 +92,9 @@ public void initialiseEagerly() {
      * The registry check is cached briefly, so installs that never enable encryption keep the S3
      * fast path. Per-file precision (redirecting plaintext blobs via {@code
      * StoredFile.encryptionKeyId}) is a deliberate follow-up.
+     *
+     * <p>If the registry cannot be read at all, this suppresses rather than delegating: losing the
+     * direct-download fast path is recoverable, handing out ciphertext is not.
      */
     public boolean suppressDirectDownloads() {
         if (writeEnabled || keyService != null) {
@@ -104,9 +108,40 @@ public boolean suppressDirectDownloads() {
                 && now - keysExistCheckedAtNanos < KEYS_EXIST_CACHE_TTL.toNanos()) {
             return keysExistCached;
         }
-        keysExistCached = keyRepository.count() > 0;
+        keysExistCached = countKeys().orElse(true /* unreadable registry: fail safe */);
         keysExistCheckedAtNanos = now;
         keysExistEverChecked = true;
         return keysExistCached;
     }
+
+    /**
+     * True when key rows exist, empty when the registry could not be read.
+     *
+     * <p>The registry lives in whatever schema the deployment uses, and deployments that never
+     * enable storage (the SaaS flavour, for one) may not have the table at all — {@code
+     * ddl-auto=update} logs and continues when it cannot create it. So a failure here must never
+     * propagate: it would turn a schema warning into a refusal to serve, or to start.
+     */
+    private Optional<Boolean> countKeys() {
+        try {
+            return Optional.of(keyRepository.count() > 0);
+        } catch (RuntimeException e) {
+            log.warn(
+                    "Could not read the storage encryption key registry ({}). Treating direct"
+                            + " downloads as unsafe; encrypted content is still decrypted on"
+                            + " demand.",
+                    e.getMessage());
+            return Optional.empty();
+        }
+    }
+
+    /**
+     * Startup probe for decrypt-only mode: are there key rows even though writes are plaintext?
+     * Returns false — rather than throwing — when the registry is unreadable, so a deployment that
+     * never uses storage still starts. Safety is preserved because the decorator sniffs every
+     * blob's header and materialises the key machinery lazily if it meets ciphertext.
+     */
+    public boolean encryptedContentMayExist() {
+        return countKeys().orElse(false);
+    }
 }

app/proprietary/src/test/java/stirling/software/proprietary/storage/config/StorageProviderConfigTest.java

@@ -4,15 +4,19 @@
 import static org.assertj.core.api.Assertions.assertThatCode;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.atLeastOnce;
 import static org.mockito.Mockito.doAnswer;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 import java.util.Base64;
 import java.util.Optional;
 
 import org.junit.jupiter.api.Test;
+import org.springframework.dao.InvalidDataAccessResourceUsageException;
 import org.springframework.transaction.PlatformTransactionManager;
 
 import stirling.software.common.model.ApplicationProperties;
@@ -24,6 +28,7 @@
 import stirling.software.proprietary.storage.crypto.InMemoryKeyRepo;
 import stirling.software.proprietary.storage.crypto.StorageEncryptionState;
 import stirling.software.proprietary.storage.provider.StorageProvider;
+import stirling.software.proprietary.storage.repository.FileEncryptionKeyRepository;
 import stirling.software.proprietary.storage.repository.StoredFileBlobRepository;
 
 /**
@@ -66,16 +71,18 @@ void decorator_writeEnabled_requiresLicenceAndSuppressesDirectDownloads() {
 
     @Test
     void decorator_flagOffButKeysExist_decryptOnlyModeStillMaterialises() throws Exception {
-        // Simulate the drifted-node case: another node already created keys.
-        StorageProviderConfig seedCfg = newConfig("local", License.SERVER, true);
+        // The drifted-node case: another node already created keys. Storage is enabled here
+        // because a node that can actually serve stored files necessarily has it on - that is
+        // precisely the node that must not hand out ciphertext.
+        StorageProviderConfig seedCfg = newConfig("local", License.SERVER, true, true);
         StorageEncryptionState seedState = seedCfg.storageEncryptionState(MASTER, false, txManager);
         Team team = new Team();
         team.setId(1L);
         User owner = new User();
         owner.setTeam(team);
         seedState.keyService().activeKekForOwner(owner);
 
-        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false, true);
         StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
 
         assertThat(cfg.storageProvider(state, Optional.empty()))
@@ -104,6 +111,52 @@ void encryption_enabled_wrongLengthKey_failsStartup() {
                 .hasMessageContaining("32 bytes");
     }
 
+    // ---- deployments that do not use storage (the SaaS shape) ---------------------------
+
+    @Test
+    void storageDisabled_neverQueriesTheKeyRegistry() {
+        // The SaaS flavour ships storage.enabled=false and may not have the table at all. A
+        // startup query for a feature it does not use must not happen, let alone fail the boot.
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
+
+        assertThat(state.isWriteEnabled()).isFalse();
+        verify(keyRepo.mock, never()).count();
+    }
+
+    @Test
+    void storageDisabled_decoratorStillInstalledSoCiphertextIsNeverServedRaw() {
+        // Skipping the boot probe does not weaken safety: the decorator is still wrapped, so any
+        // blob carrying the magic is decrypted (or fails loudly) via lazy materialisation.
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false);
+        StorageEncryptionState state = cfg.storageEncryptionState(MASTER, false, txManager);
+
+        assertThat(cfg.storageProvider(state, Optional.empty()))
+                .isInstanceOf(EncryptingStorageProvider.class);
+    }
+
+    @Test
+    void unreadableKeyRegistry_stillStartsAndFailsSafeOnDirectDownloads() {
+        // Simulates the table being absent: ddl-auto=update logs and continues when it cannot
+        // create it, so a query against it throws at runtime.
+        FileEncryptionKeyRepository broken = mock(FileEncryptionKeyRepository.class);
+        when(broken.count())
+                .thenThrow(new InvalidDataAccessResourceUsageException("no such table"));
+        StorageEncryptionState state = new StorageEncryptionState(false, () -> null, broken);
+
+        // Boot-time probe degrades to "no keys" rather than propagating...
+        assertThat(state.encryptedContentMayExist()).isFalse();
+        // ...but the request path fails safe: never hand out a presigned URL we cannot vouch for.
+        assertThat(state.suppressDirectDownloads()).isTrue();
+    }
+
+    @Test
+    void storageEnabledWithoutEncryption_probesRegistry() {
+        StorageProviderConfig cfg = newConfig("local", License.NORMAL, false, true);
+        cfg.storageEncryptionState(MASTER, false, txManager);
+        verify(keyRepo.mock, atLeastOnce()).count();
+    }
+
     // ---- backend licence gates (unchanged behaviour) ------------------------------------
 
     @Test
@@ -161,9 +214,14 @@ void provider_unknown_throwsUnsupportedProvider_notLicense() {
 
     private StorageProviderConfig newConfig(
             String provider, License license, boolean encryptionEnabled) {
+        return newConfig(provider, license, encryptionEnabled, false);
+    }
+
+    private StorageProviderConfig newConfig(
+            String provider, License license, boolean encryptionEnabled, boolean storageEnabled) {
         ApplicationProperties props = new ApplicationProperties();
         props.getStorage().setProvider(provider);
-        props.getStorage().setEnabled(false); // local-fallback path skips dir creation
+        props.getStorage().setEnabled(storageEnabled);
         props.getStorage().getEncryption().setEnabled(encryptionEnabled);
         StoredFileBlobRepository repo = mock(StoredFileBlobRepository.class);
         LicenseKeyChecker checker = mock(LicenseKeyChecker.class);