From 00e5e2017504d1c645988ae44057dc7a95720102 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 07:14:29 +0000
Subject: [PATCH] Fix encryption key format and config migration safety in
 spotify_to_plex

- Generate ENCRYPTION_KEY as 64 hex chars instead of base64: upstream reads
  it via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc, so a base64
  value silently broke Spotify token encryption for anyone leaving the
  option blank (the default path).
- Store the key without a trailing newline and chmod 600 it.
- Only delete /app/config after a successful copy into /config, so a
  failed migration (permissions, disk full) can't silently wipe the
  upstream default config.

Addresses review feedback from PR #2816.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NZTfSk3GQRU7oD85TnjsmW
---
 .../rootfs/etc/cont-init.d/99-run.sh          | 33 ++++++++++++-------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/spotify_to_plex/rootfs/etc/cont-init.d/99-run.sh b/spotify_to_plex/rootfs/etc/cont-init.d/99-run.sh
index c4436ce16b..f329bc9254 100644
--- a/spotify_to_plex/rootfs/etc/cont-init.d/99-run.sh
+++ b/spotify_to_plex/rootfs/etc/cont-init.d/99-run.sh
@@ -6,19 +6,30 @@ bashio::log.info "Starting Spotify to Plex"
 # Persist the app's /app/config into the HA add-on config dir (/config)
 CONFIG_TARGET="/config"
 mkdir -p "$CONFIG_TARGET"
-if [ -d /app/config ] && [ ! -L /app/config ]; then
-    cp -rn /app/config/. "$CONFIG_TARGET/" 2> /dev/null || true
-    rm -rf /app/config
-fi
-ln -sfn "$CONFIG_TARGET" /app/config
 
-# Auto-generate a persistent ENCRYPTION_KEY when the user leaves it blank
-if [ -z "${ENCRYPTION_KEY:-}" ]; then
-    if [ -f "$CONFIG_TARGET/.encryption_key" ]; then
-        ENCRYPTION_KEY="$(cat "$CONFIG_TARGET/.encryption_key")"
+if [ -d /app/config ] && [ ! -L /app/config ]; then
+    if cp -rn /app/config/. "$CONFIG_TARGET/"; then
+        rm -rf /app/config
     else
-        ENCRYPTION_KEY="$(head -c 32 /dev/urandom | base64)"
-        echo "$ENCRYPTION_KEY" > "$CONFIG_TARGET/.encryption_key"
+        bashio::log.error "Failed to migrate /app/config to $CONFIG_TARGET; leaving original config in place"
+    fi
+fi
+
+if [ ! -e /app/config ] || [ -L /app/config ]; then
+    ln -sfn "$CONFIG_TARGET" /app/config
+fi
+
+# Auto-generate a persistent ENCRYPTION_KEY when the user leaves it blank.
+# Upstream reads this via Buffer.from(ENCRYPTION_KEY, 'hex') for aes-256-cbc,
+# so it must be exactly 64 hex characters (not base64).
+if [ -z "${ENCRYPTION_KEY:-}" ]; then
+    KEY_FILE="$CONFIG_TARGET/.encryption_key"
+    if [ -f "$KEY_FILE" ]; then
+        ENCRYPTION_KEY="$(cat "$KEY_FILE")"
+    else
+        ENCRYPTION_KEY="$(head -c 32 /dev/urandom | od -An -tx1 | tr -d ' \n')"
+        printf '%s' "$ENCRYPTION_KEY" > "$KEY_FILE"
+        chmod 600 "$KEY_FILE"
         bashio::log.info "Generated a new ENCRYPTION_KEY (stored in the add-on config dir)"
     fi
     export ENCRYPTION_KEY