data.field_encryption_key_required

A field is kept sealed, but the application names no key to seal it with.

Area 15, Personal data; not declinable; the next step is usually the human's.

Why Jadpo refuses it

An encrypted field, a key-type field, a TotpSecret and a SecretText are all sealed with the application's one key, which application { field_encryption_key: } names. Without one there is nothing to seal them with. Jadpo won't make up a secret for you: each environment has to be given this key, and losing it loses every value sealed with it for good. The error is reported once, at the first field that needs the key.

What it looks like

An app that names no key:

type ClinicalNote = Text {    max_length: 2000}/// A consultation, whose notes only the application can read.entity Consultation {    id: Uuid    notes: ClinicalNote {        encrypted: true    }}

  |8 |     notes: ClinicalNote {  |     ^^^^^ kept sealed

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides a new secret each environment must be given and kept safe.

How to fix it

If this field should be sealed, name a key in app.jadpo and declare it in config.jadpo:

    field_encryption_key: config.field_encryption_key

Then run jadpo config set field_encryption_key --generate, keep an offline copy of what it writes, apart from your backups, and give each environment a key of its own.

If it needn't be, remove encrypted: true:

    notes: ClinicalNote

Anyone with a copy of the database can then read it.

Related

• Encrypted fields
• What can't be undone