Function DecryptConfigSensitiveFields

internal/config/encryption.go:291–333

DecryptConfigSensitiveFields decrypts sensitive fields in the entire Config. This includes both profile-based and legacy fields.

(cfg *Config)

// DecryptConfigSensitiveFields decrypts sensitive fields in the entire Config.
// This includes both profile-based and legacy fields.
func DecryptConfigSensitiveFields(cfg *Config) error {
	// Decrypt profile fields
	for name, profile := range cfg.Profiles {
		if err := DecryptSensitiveFields(&profile); err != nil {
			return fmt.Errorf("decrypt profile %s: %w", name, err)
		}
		cfg.Profiles[name] = profile
	}

	// Decrypt legacy fields
	if cfg.Password != "" {
		var err error
		cfg.Password, err = DecryptField(cfg.Password)
		if err != nil {
			return fmt.Errorf("decrypt legacy password: %w", err)
		}
	}

	if cfg.TokenSecret != "" {
		var err error
		cfg.TokenSecret, err = DecryptField(cfg.TokenSecret)
		if err != nil {
			return fmt.Errorf("decrypt legacy token_secret: %w", err)
		}
	}

	if cfg.Plugins.Ansible.DefaultPassword != "" {
		var err error
		cfg.Plugins.Ansible.DefaultPassword, err = DecryptField(cfg.Plugins.Ansible.DefaultPassword)
		if err != nil {
			return fmt.Errorf("decrypt ansible default_password: %w", err)
		}
	}
	if cfg.Plugins.Ansible.Bootstrap.Password != "" {
		var err error
		cfg.Plugins.Ansible.Bootstrap.Password, err = DecryptField(cfg.Plugins.Ansible.Bootstrap.Password)
		if err != nil {
			return fmt.Errorf("decrypt ansible bootstrap password: %w", err)
		}
	}

	return nil
}