Method preCheck

internal/commands/migrate.go:184–261

preCheck verifies if current data can be processed correctly

()

// preCheck verifies if current data can be processed correctly
func (cmd *MigrateKeysCommand) preCheck() error {
	logrus.Info("Executing pre-check...")

	// Critical check: if enabling encryption (fromKey is empty), ensure data is not already encrypted
	if cmd.fromKey == "" && cmd.toKey != "" {
		if err := cmd.detectIfAlreadyEncrypted(); err != nil {
			return err
		}
	}

	// Get current encryption service based on parameters only
	var currentService encryption.Service
	var err error

	if cmd.fromKey != "" {
		// Use fromKey to create encryption service for verification
		currentService, err = encryption.NewService(cmd.fromKey)
	} else {
		// Enable encryption scenario: data should be unencrypted
		// Use noop service to verify data is not encrypted
		currentService, err = encryption.NewService("")
	}

	if err != nil {
		return fmt.Errorf("failed to create current encryption service: %w", err)
	}

	// Check number of keys in database
	var totalCount int64
	if err := cmd.db.Model(&models.APIKey{}).Count(&totalCount).Error; err != nil {
		return fmt.Errorf("failed to get total key count: %w", err)
	}

	if totalCount == 0 {
		logrus.Info("No key data in database, skipping pre-check")
		return nil
	}

	logrus.Infof("Starting validation of %d keys...", totalCount)

	// Batch verify all keys can be decrypted correctly
	offset := 0
	failedCount := 0

	for {
		var keys []models.APIKey
		if err := cmd.db.Order("id").Offset(offset).Limit(migrationBatchSize).Find(&keys).Error; err != nil {
			return fmt.Errorf("failed to get key data: %w", err)
		}

		if len(keys) == 0 {
			break
		}

		for _, key := range keys {
			_, err := currentService.Decrypt(key.KeyValue)
			if err != nil {
				logrus.Errorf("Key ID %d decryption failed: %v", key.ID, err)