wip

src/backend/core/api/viewsets.py

@@ -2079,26 +2079,13 @@ class DocumentViewSet(
                 'Please resolve all invitations before encrypting.'
             })
 
-        # Validate that all users with access have an encryption public key
+        # Validate that we have encrypted symmetric keys for all users with access.
+        # Keys in encryptedSymmetricKeyPerUser are keyed by the user's OIDC sub (suite_user_id).
+        # The frontend already checked via fetchPublicKeys that all members have encryption enabled.
         document_accesses = models.DocumentAccess.objects.filter(
             document=document, user__isnull=False
         ).select_related('user')
 
-        users_without_public_key = [
-            access.user.email or str(access.user_id)
-            for access in document_accesses
-            if not access.user.encryption_public_key
-        ]
-        if users_without_public_key:
-            raise drf.exceptions.ValidationError({
-                'non_field_errors':
-                'Cannot encrypt a document when some members have not enabled '
-                'encryption: ' + ', '.join(users_without_public_key) + '. '
-                'All members must enable encryption in their account settings first.'
-            })
-
-        # Validate that we have encrypted symmetric keys for all users with access
-        # Keys in encryptedSymmetricKeyPerUser are keyed by the user's OIDC `sub`
         users_with_access = {str(access.user.sub) for access in document_accesses}
 
         # Check that encryptedSymmetricKeyPerUser contains all required users

src/frontend/apps/impress/src/features/docs/doc-collaboration/vault/VaultClientProvider.tsx

@@ -259,7 +259,7 @@ export function VaultClientProvider({
   return (
     <VaultClientContext.Provider
       value={{
-        client: clientRef.current,
+        client: isReady ? clientRef.current : null,
         isReady,
         isLoading,
         error,