Function encryptConfigForSave

pkg/config/loader.go:118–151

encryptConfigForSave creates a copy with encrypted passwords for saving to disk. Uses the cached master key only — does not prompt interactively.

(conf *MainConfig)

// encryptConfigForSave creates a copy with encrypted passwords for saving to disk.
// Uses the cached master key only — does not prompt interactively.
func encryptConfigForSave(conf *MainConfig) (*MainConfig, error) {
	key, err := utils.GetCachedMasterKey()
	if err != nil || key == nil {
		// No master key — save as plaintext
		return conf, nil
	}

	cp := *conf
	cp.Main.Passwords = make([]string, len(conf.Main.Passwords))
		for i, pwd := range conf.Main.Passwords {
		if utils.IsEncrypted(pwd) {
			cp.Main.Passwords[i] = pwd
		} else {
			enc, err := utils.Encrypt(pwd, key)
			if err != nil {
				return nil, fmt.Errorf("failed to encrypt password[%d]: %w", i, err)
			}
			cp.Main.Passwords[i] = enc
		}
	}

	cp.ServerLists = make([]ServerListConfig, len(conf.ServerLists))
	for i, s := range conf.ServerLists {
		cp.ServerLists[i] = s
		if !utils.IsEncrypted(s.Password) {
			enc, err := utils.Encrypt(s.Password, key)
			if err != nil {
				return nil, fmt.Errorf("failed to encrypt server cache password[%d]: %w", i, err)
			}
			cp.ServerLists[i].Password = enc
		}
	}
	return &cp, nil
}