artisan key:generate overwrites key, but unclear when

[fideloper]

Issue

The command for key:generate has some confusing behavior on when it may over-writes the APP_KEY in a .env file.

The main function that does the work has a conditional:

    protected function setKeyInEnvironmentFile($key)
    {
        $currentKey = $this->laravel['config']['app.key'];

        if (strlen($currentKey) !== 0 && (! $this->confirmToProceed())) {
            return false;
        }

        $this->writeNewEnvironmentFileWith($key);

        return true;
    }

The way this reads is:

If current key has a value and user decides not to proceed in production, then do not write to .env

This means that:

1. If there is no value, the APP_KEY is written to (there's no prompt about the environment).
2. The use of --force is only related to the production environment

Here's the output of an app in production with no APP_KEY set. When it's set, I get the prompt:

Proposed Change

For Laravel 8, I'd like to float the following change:

1. Change the behavior to not be environment-aware
2. Change this behavior so APP_KEY won't be over-written by default
3. Change the --force flag - it's use will over-write APP_ENV even if there is a value.

We can still use the ConfirmableTrait for this, so the code change is pretty minimal.

I'd consider it a breaking change since it's definitely a bit different that what it was before. However I think it would be more clear this way, and potentially less error prone (This behavior came to my attention when some automation over-wrote an APP_KEY value at work).

[driesvints]

This behavior came to my attention when some automation over-wrote an APP_KEY value at work

I guess for an environment other than production?

Change this behavior so APP_KEY won't be over-written by default

I think an explicit confirmation to overwrite the app key on any environment is a sensible thing to do so I think this makes sense.

[fideloper]

I have to double check, pretty sure it's in production, but it's also in a case where there's no TTY (so I can't choose yes/no) during the automation, so I'm not sure if this just doesn't prompt in that case. (I suspect it would, so I need to check on what happened on my end a bit more).