{"record":{"id":"ec67ba405672428d","repo":"Budibase/budibase","slug":"files-are-encrypted-but-no-password-has-been-suppl","errorCode":null,"errorMessage":"Files are encrypted but no password has been supplied.","messagePattern":"Files are encrypted but no password has been supplied\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/sdk/workspace/backups/imports.ts","lineNumber":275,"sourceCode":"    ...opts,\n  }\n  const prodAppId = dbCore.getProdWorkspaceID(appId)\n  const objectStoreWorkspaceId = importOpts.objectStoreAppId ?? appId\n  const objectStoreProdAppId = dbCore.getProdWorkspaceID(objectStoreWorkspaceId)\n  let dbStream: fs.ReadStream\n  const isTar = template.file && template?.file?.type?.endsWith(\"gzip\")\n  const isDirectory =\n    template.file && (await fsp.lstat(template.file.path)).isDirectory()\n  let tmpPath: string | undefined = undefined\n  if (template.file && (isTar || isDirectory)) {\n    tmpPath = isTar ? await untarFile(template.file) : template.file.path\n    if (isTar && template.file.password) {\n      await decryptFiles(tmpPath, template.file.password)\n    }\n    const contents = await fsp.readdir(tmpPath)\n    const stillEncrypted = !!contents.find(name => name.endsWith(\".enc\"))\n    if (stillEncrypted) {\n      throw new Error(\"Files are encrypted but no password has been supplied.\")\n    }\n    const isPlugin = !!contents.find(name => name === \"plugin.min.js\")\n    if (isPlugin) {\n      throw new Error(\"Supplied file is a plugin - cannot import as app.\")\n    }\n    const isInvalid = !contents.find(name => name === DB_EXPORT_FILE)\n    if (isInvalid) {\n      throw new Error(\n        \"App export does not appear to be valid - no DB file found.\"\n      )\n    }\n    // have to handle object import\n    if (importOpts.importObjStoreContents) {\n      const promises = []\n      const excludedFiles = [GLOBAL_DB_EXPORT_FILE, DB_EXPORT_FILE]\n\n      for (let filename of contents) {\n        const path = join(tmpPath, filename)","sourceCodeStart":257,"sourceCodeEnd":293,"githubUrl":"https://github.com/Budibase/budibase/blob/a81a902e9a8fe55b467d106765f6638f12e35c49/packages/server/src/sdk/workspace/backups/imports.ts#L257-L293","documentation":"After optional decryption, importApp lists the extracted directory and checks for residual .enc files. If any remain, decryption was skipped or incomplete (typically because no password was supplied) and the import aborts rather than importing half-encrypted data.","triggerScenarios":"importApp receives a tar export whose contents include *.enc files, isTar is true, but template.file.password is empty/undefined, so decryptFiles is never called and the .enc check trips.","commonSituations":"Importing an app that was exported with encryption enabled while the caller omits the password field; export encryption defaults changed between Budibase versions and older import scripts do not pass passwords; UI flow where the password prompt is skipped.","solutions":["Re-run the import supplying the export password via template.file.password","If the password is unknown, obtain a non-encrypted export from the source environment","Verify the export's encryption setting and re-export without a password if encryption was unintentional","Confirm the archive fully extracted — a partially extracted dir can leave .enc files behind"],"exampleFix":"// before\nawait importApp({ file: { path: p, type: \"text/plain\", password: \"\" } })\n// after\nawait importApp({ file: { path: p, type: \"text/plain\", password: \"correct-horse-battery-staple\" } })","handlingStrategy":"validation","validationCode":"const names = await fsp.readdir(tmpPath)\nif (names.some(n => n.endsWith(\".enc\")) && !password) {\n  throw new Error(\"Encrypted export requires a password\")\n}","typeGuard":null,"tryCatchPattern":"try {\n  await importApp(template)\n} catch (err: any) {\n  if (err.message.includes(\"no password has been supplied\")) {\n    // retry with password supplied\n  } else {\n    throw err\n  }\n}","preventionTips":["Always pass the password for encrypted exports","List archive contents to detect .enc files up front","Keep encryption settings consistent between export and import"],"tags":["import","encryption","missing-password"],"backgroundTag":"missing-password","analyzedSha":"a81a902e9a8fe55b467d106765f6638f12e35c49","analyzedAt":"2026-08-29T01:03:10.972Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}