Function EncryptConfigSensitiveFields

internal/config/encryption.go:245–287

EncryptConfigSensitiveFields encrypts sensitive fields in the entire Config. This includes both profile-based and legacy fields.

(cfg *Config)

// EncryptConfigSensitiveFields encrypts sensitive fields in the entire Config.
// This includes both profile-based and legacy fields.
func EncryptConfigSensitiveFields(cfg *Config) error {
	// Encrypt profile fields
	for name, profile := range cfg.Profiles {
		if err := EncryptSensitiveFields(&profile); err != nil {
			return fmt.Errorf("encrypt profile %s: %w", name, err)
		}
		cfg.Profiles[name] = profile
	}

	// Encrypt legacy fields
	if cfg.Password != "" && !isEncrypted(cfg.Password) {
		var err error
		cfg.Password, err = EncryptField(cfg.Password)
		if err != nil {
			return fmt.Errorf("encrypt legacy password: %w", err)
		}
	}

	if cfg.TokenSecret != "" && !isEncrypted(cfg.TokenSecret) {
		var err error
		cfg.TokenSecret, err = EncryptField(cfg.TokenSecret)
		if err != nil {
			return fmt.Errorf("encrypt legacy token_secret: %w", err)
		}
	}

	if cfg.Plugins.Ansible.DefaultPassword != "" && !isEncrypted(cfg.Plugins.Ansible.DefaultPassword) {
		var err error
		cfg.Plugins.Ansible.DefaultPassword, err = EncryptField(cfg.Plugins.Ansible.DefaultPassword)
		if err != nil {
			return fmt.Errorf("encrypt ansible default_password: %w", err)
		}
	}
	if cfg.Plugins.Ansible.Bootstrap.Password != "" && !isEncrypted(cfg.Plugins.Ansible.Bootstrap.Password) {
		var err error
		cfg.Plugins.Ansible.Bootstrap.Password, err = EncryptField(cfg.Plugins.Ansible.Bootstrap.Password)
		if err != nil {
			return fmt.Errorf("encrypt ansible bootstrap password: %w", err)
		}
	}

	return nil
}

// DecryptConfigSensitiveFields decrypts sensitive fields in the entire Config.
// This includes both profile-based and legacy fields.