fix(config): encrypted field validation

lib/config/presets/internal/index.spec.ts

@@ -1,5 +1,6 @@
 import { resolveConfigPresets } from '../';
 import { CONFIG_VALIDATION } from '../../../constants/error-messages';
+import { GlobalConfig } from '../../global';
 import { massageConfig } from '../../massage';
 import { validateConfig } from '../../validation';
 import * as npm from '../npm';
@@ -27,6 +28,11 @@ describe('config/presets/internal/index', () => {
       if (presetName !== 'description' && !ignoredPresets.includes(preset)) {
         it(`${preset} validates`, async () => {
           try {
+            if (preset === 'default:githubComToken') {
+              GlobalConfig.set({
+                privateKey: 'some-private-key',
+              });
+            }
             const config = await resolveConfigPresets(
               massageConfig(presetConfig),
             );

lib/config/validation.spec.ts

@@ -943,6 +943,47 @@ describe('config/validation', () => {
       expect(errors).toHaveLength(0);
     });
 
+    it('errors if encrypted object found without privateKey', async () => {
+      const config = {
+        encrypted: {
+          npmToken:
+            'xxT19RIdhAh09lkhdrK39HzKNBn3etoLZAwHdeJ25cX+5y52a9kAC7flXmdw5JrkciN08aQuRNqDaKxp53IVptB5AYOnQPrt8MCT+x0zHgp4A1zv1QOV84I6uugdWpFSjPUkmLGMgULudEZJMlY/dAn/IVwf/IImqwazY8eHyJAA4vyUqKkL9SXzHjvS+OBonQ/9/AHYYKmDJwT8vLSRCKrXxJCdUfH7ZnikZbFqjnURJ9nGUHP44rlYJ7PFl05RZ+X5WuZG/A27S5LuBvguyQGcw8A2AZilHSDta9S/4eG6kb22jX87jXTrT6orUkxh2WHI/xvNUEout0gxwWMDkA==',
+        },
+      };
+      const { warnings, errors } = await configValidation.validateConfig(
+        'repo',
+        config,
+      );
+      expect(warnings).toHaveLength(0);
+      expect(errors).toMatchObject([
+        {
+          topic: 'Configuration Error',
+          message: `No privateKey found in hosted config. \`encrypted\` object cannot be used without a privateKey.`,
+        },
+      ]);
+    });
+
+    it('errors if invalid encrypted object', async () => {
+      GlobalConfig.set({ privateKey: 'some-private-key' });
+      const config = {
+        encrypted: {
+          npmToken: 1,
+        },
+      };
+      const { warnings, errors } = await configValidation.validateConfig(
+        'repo',
+        config,
+      );
+      expect(warnings).toHaveLength(0);
+      expect(errors).toMatchObject([
+        {
+          topic: 'Configuration Error',
+          message:
+            'Invalid `encrypted.encrypted.npmToken` configuration: value is not a string',
+        },
+      ]);
+    });
+
     it('errors if registryAliases depth is more than 1', async () => {
       const config = {
         registryAliases: {
@@ -1426,6 +1467,26 @@ describe('config/validation', () => {
       ]);
     });
 
+    it('errors if encrypted object found without privateKey', async () => {
+      const config = {
+        encrypted: {
+          npmToken:
+            'xxT19RIdhAh09lkhdrK39HzKNBn3etoLZAwHdeJ25cX+5y52a9kAC7flXmdw5JrkciN08aQuRNqDaKxp53IVptB5AYOnQPrt8MCT+x0zHgp4A1zv1QOV84I6uugdWpFSjPUkmLGMgULudEZJMlY/dAn/IVwf/IImqwazY8eHyJAA4vyUqKkL9SXzHjvS+OBonQ/9/AHYYKmDJwT8vLSRCKrXxJCdUfH7ZnikZbFqjnURJ9nGUHP44rlYJ7PFl05RZ+X5WuZG/A27S5LuBvguyQGcw8A2AZilHSDta9S/4eG6kb22jX87jXTrT6orUkxh2WHI/xvNUEout0gxwWMDkA==',
+        },
+      };
+      const { warnings, errors } = await configValidation.validateConfig(
+        'global',
+        config,
+      );
+      expect(warnings).toHaveLength(0);
+      expect(errors).toMatchObject([
+        {
+          topic: 'Configuration Error',
+          message: `No privateKey found in hosted config. \`encrypted\` object cannot be used without a privateKey.`,
+        },
+      ]);
+    });
+
     it('validates hostRules.headers', async () => {
       const config = {
         hostRules: [

lib/config/validation.ts

@@ -634,6 +634,25 @@ export async function validateConfig(
                   message: `Invalid \`${currentPath}.${key}.${res}\` configuration: value is not a string`,
                 });
               }
+            } else if (key === 'encrypted') {
+              const res = validatePlainObject(val);
+              if (res !== true) {
+                errors.push({
+                  topic: 'Configuration Error',
+                  message: `Invalid \`${currentPath}.${key}.${res}\` configuration: value is not a string`,
+                });
+              }
+
+              const privateKey =
+                configType === 'global'
+                  ? config.privateKey
+                  : GlobalConfig.get('privateKey');
+              if (!is.nonEmptyString(privateKey)) {
+                errors.push({
+                  topic: 'Configuration Error',
+                  message: `No privateKey found in hosted config. \`encrypted\` object cannot be used without a privateKey.`,
+                });
+              }
             } else if (key === 'env') {
               const allowedEnvVars =
                 configType === 'global'