From c9d09152fadad43bf0c0629bdd179d48fb0d1090 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20Rame=CC=81?= <thomas@rame.fr>
Date: Wed, 25 Mar 2026 19:27:57 +0100
Subject: [PATCH] wip

---
 src/backend/core/api/viewsets.py              | 19 +++----------------
 .../vault/VaultClientProvider.tsx             |  2 +-
 2 files changed, 4 insertions(+), 17 deletions(-)

diff --git a/src/backend/core/api/viewsets.py b/src/backend/core/api/viewsets.py
index ada33a1f9..e52c9af0d 100644
--- a/src/backend/core/api/viewsets.py
+++ b/src/backend/core/api/viewsets.py
@@ -2079,26 +2079,13 @@ class DocumentViewSet(
                 'Please resolve all invitations before encrypting.'
             })
 
-        # Validate that all users with access have an encryption public key
+        # Validate that we have encrypted symmetric keys for all users with access.
+        # Keys in encryptedSymmetricKeyPerUser are keyed by the user's OIDC sub (suite_user_id).
+        # The frontend already checked via fetchPublicKeys that all members have encryption enabled.
         document_accesses = models.DocumentAccess.objects.filter(
             document=document, user__isnull=False
         ).select_related('user')
 
-        users_without_public_key = [
-            access.user.email or str(access.user_id)
-            for access in document_accesses
-            if not access.user.encryption_public_key
-        ]
-        if users_without_public_key:
-            raise drf.exceptions.ValidationError({
-                'non_field_errors':
-                'Cannot encrypt a document when some members have not enabled '
-                'encryption: ' + ', '.join(users_without_public_key) + '. '
-                'All members must enable encryption in their account settings first.'
-            })
-
-        # Validate that we have encrypted symmetric keys for all users with access
-        # Keys in encryptedSymmetricKeyPerUser are keyed by the user's OIDC `sub`
         users_with_access = {str(access.user.sub) for access in document_accesses}
 
         # Check that encryptedSymmetricKeyPerUser contains all required users
diff --git a/src/frontend/apps/impress/src/features/docs/doc-collaboration/vault/VaultClientProvider.tsx b/src/frontend/apps/impress/src/features/docs/doc-collaboration/vault/VaultClientProvider.tsx
index 43099c769..b16fc101b 100644
--- a/src/frontend/apps/impress/src/features/docs/doc-collaboration/vault/VaultClientProvider.tsx
+++ b/src/frontend/apps/impress/src/features/docs/doc-collaboration/vault/VaultClientProvider.tsx
@@ -259,7 +259,7 @@ export function VaultClientProvider({
   return (
     <VaultClientContext.Provider
       value={{
-        client: clientRef.current,
+        client: isReady ? clientRef.current : null,
         isReady,
         isLoading,
         error,