From 5861f6a94abceddb6746f4b459919c548db95f47 Mon Sep 17 00:00:00 2001
From: Scott Motte <mot@mot.la>
Date: Fri, 16 Jun 2023 09:55:05 -0700
Subject: [PATCH] Add failing test demonstrating need for DOTENV_KEY option

---
 README.md                  | 10 ++++++++++
 tests/test-config-vault.js | 14 ++++++++++++++
 2 files changed, 24 insertions(+)

diff --git a/README.md b/README.md
index 885275c7..2d092938 100644
--- a/README.md
+++ b/README.md
@@ -339,6 +339,16 @@ console.log(myObject) // values from .env or .env.vault live here now.
 console.log(process.env) // this was not changed or written to
 ```
 
+##### DOTENV_KEY
+
+Default: `process.env.DOTENV_KEY`
+
+Pass the `DOTENV_KEY` directly to config options. Defaults to looking for `process.env.DOTENV_KEY` environment variable. Note this only applies to decrypting `.env.vault` files. If passed as null or undefined, or not passed at all, dotenv falls back to its traditional job of parsing a `.env` file.
+
+```js
+require('dotenv').config({ DOTENV_KEY: 'dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production' })
+```
+
 ### Parse
 
 The engine which parses the contents of your file containing environment
diff --git a/tests/test-config-vault.js b/tests/test-config-vault.js
index d8cd313c..8500f517 100644
--- a/tests/test-config-vault.js
+++ b/tests/test-config-vault.js
@@ -170,6 +170,20 @@ t.test('when DOTENV_KEY is empty string falls back to .env file', ct => {
   ct.end()
 })
 
+t.test('when DOTENV_KEY is passed as an option it successfully decrypts and injects', ct => {
+  envStub.restore()
+  envStub = sinon.stub(process.env, 'DOTENV_KEY').value('')
+
+  ct.plan(1)
+
+  const result = dotenv.config({ path: testPath, DOTENV_KEY: dotenvKey })
+
+  ct.equal(result.parsed.ALPHA, 'zeta')
+  ct.equal(process.env.ALPHA, 'bar')
+
+  ct.end()
+})
+
 t.test('does not write over keys already in process.env by default', ct => {
   ct.plan(2)