Function autoEncryptConfig

internal/app/run.go:164–195

(cfg *config.Config, configPath string)

}

func autoEncryptConfig(cfg *config.Config, configPath string) {
	if configPath == "" || !cfg.HasCleartextSensitiveData() {
		return
	}

	// nolint:gosec // configPath is validated and comes from trusted sources (user input or default paths)
	data, err := os.ReadFile(configPath)
	if err != nil {
		return
	}

	if config.IsSOPSEncrypted(configPath, data) {
		cfg.MarkSensitiveDataEncrypted()
		return
	}

	cfgCopy := *cfg
	cfgCopy.Profiles = make(map[string]config.ProfileConfig)
	for k, v := range cfg.Profiles {
		cfgCopy.Profiles[k] = v
	}

	if err := config.SaveConfigFile(&cfgCopy, configPath); err != nil {
		if config.DebugEnabled {
			fmt.Println(display.IconText("⚠️", fmt.Sprintf("Warning: Failed to encrypt and save config: %v", err), cfg.ShowIcons))
		}
		return
	}

	fmt.Println(display.IconText("🔐", "Encrypted sensitive fields in config file", cfg.ShowIcons))
	cfg.MarkSensitiveDataEncrypted()
}