From b1fde3a74bfd21e5862be1f5a922523efd6160c6 Mon Sep 17 00:00:00 2001
From: Danny Groenewegen <danny@ecommons.space>
Date: Mon, 31 Aug 2026 17:29:51 +0200
Subject: [PATCH] fix: don't regenerate enc_keys if they already exist, require
 --local

---
 abra.sh | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/abra.sh b/abra.sh
index 5b8e12a..f707237 100644
--- a/abra.sh
+++ b/abra.sh
@@ -23,6 +23,20 @@ generate_bootstrap_admin_password() {
 }
 
 generate_enc_keys() {
+  if [ "$TARGET" != "local" ]; then
+    echo "generate_enc_keys must run with --local" >&2
+    echo "Run: abra app cmd $APP_NAME --local generate_enc_keys" >&2
+    exit 1
+  fi
+
+  local EXISTING
+  EXISTING=$(abra app secret list -m "$APP_NAME" 2>/dev/null | jq -r '.[] | select(.["created on server"] == "true") | .name')
+
+  if echo "$EXISTING" | grep -qx -e "enc_keys_a" -e "enc_keys_b"; then
+    echo "enc_keys_a/enc_keys_b already exist on the server"
+    exit
+  fi
+
   KEY_A="$(openssl rand -base64 32)"
   KEY_B="$(openssl rand -base64 32)"
   abra app secret insert "$APP_NAME" enc_keys_a a1 "$KEY_A" --chaos
-- 
2.54.0