From 0f3ad830045959ad856ce0d91bc9d09c38cc5e07 Mon Sep 17 00:00:00 2001
From: rustmailer <pollybase@zohomail.com>
Date: Fri, 26 Dec 2025 14:44:49 +0800
Subject: [PATCH] feat: use password file as primary source if provided

---
 src/modules/settings/cli.rs  |  1 +
 src/modules/utils/encrypt.rs | 24 ++++++++++++++----------
 2 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/src/modules/settings/cli.rs b/src/modules/settings/cli.rs
index 0fb2e8a..fbc58f7 100644
--- a/src/modules/settings/cli.rs
+++ b/src/modules/settings/cli.rs
@@ -133,6 +133,7 @@ pub struct Settings {
     #[clap(
         long,
         env,
+        default_value = "change-this-default-password-now",
         help = "Set the encryption password for bichon. Alternatively, you can use --bichon-encrypt-password-file. If both are set, this parameter takes precedence over the file."
     )]
     pub bichon_encrypt_password: Option<String>,
diff --git a/src/modules/utils/encrypt.rs b/src/modules/utils/encrypt.rs
index 45d99be..e39faab 100644
--- a/src/modules/utils/encrypt.rs
+++ b/src/modules/utils/encrypt.rs
@@ -29,16 +29,20 @@ use crate::modules::error::BichonResult;
 use crate::modules::settings::cli::SETTINGS;
 use crate::raise_error;
 
-static ENCRYPT_PASSWORD: LazyLock<String> =
-    LazyLock::new(|| match &SETTINGS.bichon_encrypt_password {
-        Some(p) => p.clone(),
-        None => {
-            // unwrap() is safe here, because SETTINGS validates that at least one of the encrypt_password
-            // fields is set.
-            fs::read_to_string(SETTINGS.bichon_encrypt_password_file.as_ref().unwrap())
-                .expect("failed to read the file with the encrypt password")
-        }
-    });
+static ENCRYPT_PASSWORD: LazyLock<String> = LazyLock::new(|| {
+    if let Some(file_path) = &SETTINGS.bichon_encrypt_password_file {
+        return fs::read_to_string(file_path)
+            .expect("failed to read the file with the encrypt password")
+            .trim()
+            .to_string();
+    }
+
+    if let Some(p) = &SETTINGS.bichon_encrypt_password {
+        return p.clone();
+    }
+
+    panic!("Neither encrypt_password nor encrypt_password_file is set. This should have been validated by SETTINGS.");
+});
 
 struct SingleNonceSequence([u8; 12]);