Name SESSION_KEY in the error when its value is not a Fernet key

A malformed value used to fail inside EncryptedCookieStorage with a
message that did not say which variable was wrong. Also tightens the
readme wording and drops an import the tests no longer need.

Author: Mariatta

blurb_it/__main__.py

@@ -319,6 +319,14 @@ def get_session_key() -> str:
     """
     session_key = os.environ.get("SESSION_KEY")
     if session_key:
+        try:
+            fernet.Fernet(session_key)
+        except ValueError as exc:
+            raise ValueError(
+                "SESSION_KEY is not a valid Fernet key. Generate one with "
+                "`python -c \"from cryptography.fernet import Fernet; "
+                "print(Fernet.generate_key().decode())\"`."
+            ) from exc
         return session_key
     logging.warning(
         "SESSION_KEY is not set; using a random session key, "

readme.rst

@@ -65,7 +65,7 @@ Configuration variables, set in the cabotage UI:
   it once with ``python -c "from cryptography.fernet import Fernet;
   print(Fernet.generate_key().decode())"`` and keep it the same across
   deploys; changing it signs everyone out. Without it the app generates a
-  random key at startup, so every restart signs everyone out.
+  random key at startup, with the same effect on every restart.
 - ``SENTRY_DSN``: where errors are reported.
 
 

tests/test_main.py

@@ -3,7 +3,6 @@
 import asyncio
 import base64
 import logging
-import os
 import pathlib
 
 import aiohttp
@@ -618,11 +617,12 @@ async def get_installation(gh, jwt, username):
 
 
 def test_get_session_key_from_env(monkeypatch, caplog) -> None:
-    monkeypatch.setenv("SESSION_KEY", fernet.Fernet.generate_key().decode())
+    expected = fernet.Fernet.generate_key().decode()
+    monkeypatch.setenv("SESSION_KEY", expected)
 
     session_key = __main__.get_session_key()
 
-    assert session_key == os.environ["SESSION_KEY"]
+    assert session_key == expected
     assert "SESSION_KEY is not set" not in caplog.text
     # The key must be usable as-is by the cookie storage.
     EncryptedCookieStorage(session_key)
@@ -637,3 +637,10 @@ def test_get_session_key_random_when_unset(monkeypatch, caplog) -> None:
     assert session_key != __main__.get_session_key()
     assert "SESSION_KEY is not set" in caplog.text
     EncryptedCookieStorage(session_key)
+
+
+def test_get_session_key_rejects_invalid_value(monkeypatch) -> None:
+    monkeypatch.setenv("SESSION_KEY", "not-a-fernet-key")
+
+    with pytest.raises(ValueError, match="SESSION_KEY is not a valid Fernet key"):
+        __main__.get_session_key()