{"record":{"id":"df012df58af26702","repo":"Budibase/budibase","slug":"files-are-encrypted-but-no-password-has-been-suppl-df012d","errorCode":null,"errorMessage":"Files are encrypted but no password has been supplied.","messagePattern":"Files are encrypted but no password has been supplied\\.","errorType":"validation","errorClass":"HTTPError","httpStatus":400,"severity":"error","filePath":"packages/server/src/sdk/workspace/projects/backups/imports.ts","lineNumber":938,"sourceCode":"  if (encryptPassword && encryptPassword.length > MAX_ENCRYPT_PASSWORD_LENGTH) {\n    throw new HTTPError(\"Project package password is too long.\", 400)\n  }\n\n  await validateProjectPackageBeforeExtraction(file)\n  const tmpPath = await untarFile(file)\n  try {\n    if (encryptPassword) {\n      try {\n        await decryptFiles(tmpPath, encryptPassword)\n      } catch {\n        throw new HTTPError(\"Project package could not be decrypted.\", 400)\n      }\n    }\n\n    const packageFiles = await readDirectoryRecursively(tmpPath)\n    const rootEntries = await fsp.readdir(tmpPath)\n    if (rootEntries.some(entry => entry.endsWith(\".enc\")) && !encryptPassword) {\n      throw new HTTPError(\n        \"Files are encrypted but no password has been supplied.\",\n        400\n      )\n    }\n    if (rootEntries.includes(\"db.txt\")) {\n      throw new HTTPError(\n        \"Workspace exports cannot be imported as Project packages.\",\n        400\n      )\n    }\n    if (\n      rootEntries.some(\n        entry =>\n          ![\n            PROJECT_MANIFEST_FILE,\n            PROJECT_FILE,\n            PROJECT_DEPENDENCY_INDEX_FILE,\n            PROJECT_DOCS_DIRECTORY,","sourceCodeStart":920,"sourceCodeEnd":956,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/sdk/workspace/projects/backups/imports.ts#L920-L956","documentation":"After extracting the package, extractProjectPackage() lists the root entries and, if any file ends with .enc while no encryptPassword was provided, it throws this HTTP 400 at imports.ts:938. Encrypted packages cannot be processed without the password, so the import is rejected before any docs are touched.","triggerScenarios":"Importing an encrypted project package (files exported with encryption, leaving .enc files in the archive root) without passing the encryptPassword parameter to the import endpoint.","commonSituations":"Forgetting the password flag in curl/CI scripts after exporting with encryption; sharing an encrypted export without telling the importer it needs a password; UI/API clients that strip empty password params.","solutions":["Re-run the import passing the encryptPassword parameter used at export time","Check the package contents (list the tarball) to confirm it contains .enc files and ask the exporter for the password","If you don't need encryption, re-export the package without a password and import that"],"exampleFix":"null","handlingStrategy":"validation","validationCode":"import { createReadStream } from 'fs'\nimport { parse } from 'tar'\nconst hasEncFiles = await new Promise<boolean>((resolve, reject) => {\n  const ws = parse({ onReadEntry: (e: any) => { if (e.path.endsWith('.enc')) { resolve(true); ws.abort?.() } }, onEnd: () => resolve(false) })\n  createReadStream(packagePath).pipe(ws as any)\n  ws.on('error', reject)\n})\nif (hasEncFiles && !password) throw new Error('package is encrypted; encryptPassword is required')","typeGuard":"function isEncryptedImportReady(p: { hasEncFiles: boolean; password?: string }): p is { hasEncFiles: true; password: string } {\n  return p.hasEncFiles ? typeof p.password === 'string' && p.password.length > 0 : true\n}","tryCatchPattern":"try {\n  await importProjectPackage(file, password)\n} catch (err) {\n  if (err instanceof HTTPError && err.status === 400 && err.message.includes('no password has been supplied')) {\n    // re-run with the encryptPassword used at export time\n  } else {\n    throw err\n  }\n}","preventionTips":["Whenever exporting with a password, record that import requires the same parameter","Communicate encryption status when sharing packages between teams","Default import scripts to read the password from a secret manager, not a possibly-empty env var","List archive contents before import to detect .enc files"],"tags":["encryption","missing-parameter","http-400","import"],"backgroundTag":"missing-parameter","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}