Repository: rails/rails
File: railties/lib/rails/commands/credentials/credentials_command.rb (Ruby)

Code before:

      desc "diff", "Enroll/disenroll in decrypted diffs of credentials using git"
      option :enroll, type: :boolean, default: false,
        desc: "Enroll project in credentials file diffing with `git diff`"
      option :disenroll, type: :boolean, default: false,
        desc: "Disenroll project from credentials file diffing"
      def diff(content_path = nil)
        if @content_path = content_path
          self.environment = extract_environment_from_path(content_path)
          load_environment_config!

          say credentials.read.presence || credentials.content_path.read
        else
          disenroll_project_from_credentials_diffing if options[:disenroll]
          enroll_project_in_credentials_diffing if options[:enroll]
        end
      rescue ActiveSupport::MessageEncryptor::InvalidMessage
        say credentials.content_path.read
      end

      desc "fetch PATH", "Fetch a value in the decrypted credentials"
      def fetch(path)
        load_environment_config!

        if (yaml = credentials.read)
          YAML.load(yaml).dig(*path.split("/")).tap do |value|
            say value.to_s
          end
        else
          say missing_credentials_message
        end
      end

      private
        def config
          Rails.application.config.credentials
        end

        def content_path
          @content_path ||= relative_path(config.content_path)
        end

        def key_path
          @key_path ||= relative_path(config.key_path)
        end

        def credentials
          @credentials ||= Rails.application.encrypted(content_path, key_path: key_path)
        end

        def ensure_encryption_key_has_been_added

Review comment (suggestion):
We should return an error if the key is missing. Also I think `.` is much more logical to nagigate than `/`.

Code after:

      desc "diff", "Enroll/disenroll in decrypted diffs of credentials using git"
      option :enroll, type: :boolean, default: false,
        desc: "Enroll project in credentials file diffing with `git diff`"
      option :disenroll, type: :boolean, default: false,
        desc: "Disenroll project from credentials file diffing"
      def diff(content_path = nil)
        if @content_path = content_path
          self.environment = extract_environment_from_path(content_path)
          load_environment_config!

          say credentials.read.presence || credentials.content_path.read
        else
          disenroll_project_from_credentials_diffing if options[:disenroll]
          enroll_project_in_credentials_diffing if options[:enroll]
        end
      rescue ActiveSupport::MessageEncryptor::InvalidMessage
        say credentials.content_path.read
      end

      desc "fetch PATH", "Fetch a value in the decrypted credentials"
      def fetch(path)
        load_environment_config!

        if (yaml = credentials.read)
          begin
            value = YAML.load(yaml)
            value = path.split(".").inject(value) do |doc, key|
              doc.fetch(key)
            end
            say value.to_s
          rescue KeyError, NoMethodError
            say_error "Invalid or missing credential path: #{path}"
            exit 1
          end
        else
          missing_credentials!
        end
      end

      private
        def config
          Rails.application.config.credentials
        end

        def content_path
          @content_path ||= relative_path(config.content_path)
        end

        def key_path
          @key_path ||= relative_path(config.key_path)