Repository: rails/rails
File: railties/lib/rails/commands/credentials/credentials_command.rb (Ruby)

Code before:
      option :disenroll, type: :boolean, default: false,
        desc: "Disenroll project from credentials file diffing"
      def diff(content_path = nil)
        if @content_path = content_path
          self.environment = extract_environment_from_path(content_path)
          load_environment_config!

          say credentials.read.presence || credentials.content_path.read
        else
          disenroll_project_from_credentials_diffing if options[:disenroll]
          enroll_project_in_credentials_diffing if options[:enroll]
        end
      rescue ActiveSupport::MessageEncryptor::InvalidMessage
        say credentials.content_path.read
      end

      desc "fetch PATH", "Fetch a value in the decrypted credentials"
      def fetch(path)
        load_environment_config!

        if (yaml = credentials.read)
          YAML.load(yaml).dig(*path.split("/")).tap do |value|
            say value.to_s
          end
        else
          say missing_credentials_message
        end
      end

      private
        def config
          Rails.application.config.credentials
        end

        def content_path
          @content_path ||= relative_path(config.content_path)
        end

        def key_path
          @key_path ||= relative_path(config.key_path)
        end

        def credentials
          @credentials ||= Rails.application.encrypted(content_path, key_path: key_path)
        end

        def ensure_encryption_key_has_been_added
          return if credentials.key?

          require "rails/generators/rails/encryption_key_file/encryption_key_file_generator"


Review comment (security):
```suggestion
          say_error missing_credentials_message
```

Error message should go on `stderr`, not `stdout`, it also should exit with non zero status code, otherwise this is very hard to use in a script.

Code after:
      option :disenroll, type: :boolean, default: false,
        desc: "Disenroll project from credentials file diffing"
      def diff(content_path = nil)
        if @content_path = content_path
          self.environment = extract_environment_from_path(content_path)
          load_environment_config!

          say credentials.read.presence || credentials.content_path.read
        else
          disenroll_project_from_credentials_diffing if options[:disenroll]
          enroll_project_in_credentials_diffing if options[:enroll]
        end
      rescue ActiveSupport::MessageEncryptor::InvalidMessage
        say credentials.content_path.read
      end

      desc "fetch PATH", "Fetch a value in the decrypted credentials"
      def fetch(path)
        load_environment_config!

        if (yaml = credentials.read)
          begin
            value = YAML.load(yaml)
            value = path.split(".").inject(value) do |doc, key|
              doc.fetch(key)
            end
            say value.to_s
          rescue KeyError, NoMethodError
            say_error "Invalid or missing credential path: #{path}"
            exit 1
          end
        else
          missing_credentials!
        end
      end

      private
        def config
          Rails.application.config.credentials
        end

        def content_path
          @content_path ||= relative_path(config.content_path)
        end

        def key_path
          @key_path ||= relative_path(config.key_path)
        end

        def credentials
          @credentials ||= Rails.application.encrypted(content_path, key_path: key_path)