Stricter validation of init/unlock arguments

replicat/repository.py

@@ -677,6 +677,12 @@ async def init(self, *, password=None, settings=None, key_output_path=None):
                     json.dumps(key, indent=4, default=self.default_serialization_hook)
                 )
         else:
+            if password is not None or key_output_path is not None:
+                raise exceptions.ReplicatError(
+                    'Password and key output path can only be provided to initialise '
+                    'encrypted repositories'
+                )
+
             key = None
 
         self.display_status('Uploading config')
@@ -708,6 +714,10 @@ async def unlock(self, *, password=None, key=None):
                 props,
                 **self._instantiate_key(key, password=password, cipher=props.cipher),
             )
+        elif password is not None or key is not None:
+            raise exceptions.ReplicatError(
+                'Cannot provide password or key to unlock unencrypted repositories'
+            )
 
         self.props = props
 

replicat/tests/test_repository.py

@@ -274,7 +274,6 @@ async def test_encrypted_ok(self, local_backend, local_repo, tmp_path):
     @pytest.mark.asyncio
     async def test_unencrypted_ok(self, local_backend, local_repo):
         result = await local_repo.init(
-            password=b'<password>',
             settings={'encryption': None, 'chunking': {'max_length': 128_129}},
         )
 
@@ -736,7 +735,7 @@ def upldstream(name, contents, length):
     async def test_not_locked(self, monkeypatch, local_backend, tmp_path, encryption):
         local_repo = Repository(local_backend, concurrent=5)
         await local_repo.init(
-            password=b'<password>',
+            password=encryption and b'<password>',
             settings={'encryption': encryption},
         )
 
@@ -780,7 +779,7 @@ async def _wait_for_lock(*a, **ka):
     async def test_locked(self, monkeypatch, local_backend, tmp_path, encryption):
         local_repo = Repository(local_backend, concurrent=5)
         await local_repo.init(
-            password=b'<password>',
+            password=encryption and b'<password>',
             settings={'encryption': encryption},
         )
 
@@ -1154,7 +1153,7 @@ async def test_unencrypted_unreferenced(self, local_backend, local_repo, tmp_pat
     async def test_not_locked(self, monkeypatch, local_backend, encryption):
         local_repo = Repository(local_backend, concurrent=5)
         await local_repo.init(
-            password=b'<password>',
+            password=encryption and b'<password>',
             settings={'encryption': encryption},
         )
 
@@ -1187,7 +1186,7 @@ async def test_not_locked(self, monkeypatch, local_backend, encryption):
     async def test_locked(self, monkeypatch, local_backend, encryption):
         local_repo = Repository(local_backend, concurrent=5)
         await local_repo.init(
-            password=b'<password>',
+            password=encryption and b'<password>',
             settings={'encryption': encryption},
         )