Add explicit check for recovery password in AccountsManger#create

service/src/main/java/org/whispersystems/textsecuregcm/storage/AccountsManager.java

@@ -311,6 +311,10 @@ public class AccountsManager extends RedisPubSubAdapter<String, String> implemen
       final DeviceSpec primaryDeviceSpec,
       @Nullable final String userAgent) throws ReceiptAlreadyRedeemedException {
 
+    accountAttributes.recoveryPassword().filter(b -> b.length > 0)
+        .orElseThrow(
+            () -> new IllegalArgumentException("recovery password is required for accounts without phone numbers"));
+
     // This salt is required for generating PNI-based auth credentials (e.g. group credentials) for accounts without a number
     final byte[] authCredentialSalt = new byte[AUTH_CREDENTIAL_SALT_SIZE];
     SECURE_RANDOM.nextBytes(authCredentialSalt);

service/src/test/java/org/whispersystems/textsecuregcm/storage/AccountsManagerTest.java

@@ -1658,6 +1658,17 @@ class AccountsManagerTest {
     verify(phoneNumberIdentifiers).getPhoneNumberIdentifier(targetNumber);
   }
 
+  @Test
+  void createAccountWithoutNumberOrRecoveryPassword() {
+    assertThrows(IllegalArgumentException.class,
+        () -> accountsManager.create(new AccountAttributes(),
+            Collections.emptyList(),
+            new IdentityKey(ECKeyPair.generate().getPublicKey()),
+            ReceiptCredentialTestUtil.receiptPresentation(),
+            mock(DeviceSpec.class),
+            null));
+  }
+
   static Collection<Arguments> updateCurrentProfileVersion() {
 
     final byte[] empty = new byte[0];