Function DecryptField

internal/config/encryption.go:163–197

DecryptField decrypts an encrypted field value. Returns the decrypted value, or the original value if not encrypted.

(value string)

// DecryptField decrypts an encrypted field value.
// Returns the decrypted value, or the original value if not encrypted.
func DecryptField(value string) (string, error) {
	if value == "" {
		return "", nil
	}

	if !isEncrypted(value) {
		// Not encrypted, return as-is
		return value, nil
	}

	// Remove prefix and decode base64
	encryptedData := strings.TrimPrefix(value, encryptionPrefix)
	decoded, err := base64.StdEncoding.DecodeString(encryptedData)
	if err != nil {
		return "", fmt.Errorf("decode base64: %w", err)
	}

	identity, _, err := getOrCreateAgeIdentity()
	if err != nil {
		return "", fmt.Errorf("get age identity: %w", err)
	}

	// Decrypt the value
	decryptReader, err := age.Decrypt(bytes.NewReader(decoded), identity)
	if err != nil {
		return "", fmt.Errorf("create decrypt reader: %w", err)
	}

	var decrypted bytes.Buffer
	if _, err := io.Copy(&decrypted, decryptReader); err != nil {
		return "", fmt.Errorf("read decrypted data: %w", err)
	}

	return decrypted.String(), nil
}

// EncryptSensitiveFields encrypts all sensitive fields in a ProfileConfig.
// Fields that are already encrypted are left unchanged.