Backlog/v11 modules config comunication

agent/version.json

@@ -1,4 +1,4 @@
 {
-    "version": "11.1.5",
+    "version": "11.1.4",
     "updater_version": "1.0.4"
 }

backend/src/main/java/com/park/utmstack/domain/application_modules/validators/UtmModuleConfigValidator.java

@@ -41,8 +41,9 @@ public boolean validate(UtmModule module, List<UtmModuleGroupConfiguration> keys
                     UtmModuleGroupConfiguration override = findInKeys(keys, dbConf.getConfKey());
                     String value;
                     if (override != null && !Constants.MASKED_VALUE.equals(override.getConfValue())) {
-                        // User provided a new value — use it as plaintext
-                        value = override.getConfValue();
+                        // User provided a new value — encrypt if sensitive so the plugin sees
+                        // the same payload shape as the update flow (DB ciphertext).
+                        value = encryptIfSensitive(override.getConfDataType(), override.getConfValue());
                     } else {
                         // No override or masked
                         value = dbConf.getConfValue();
@@ -58,14 +59,23 @@ public boolean validate(UtmModule module, List<UtmModuleGroupConfiguration> keys
         keys.stream()
                 .filter(k -> !dbKeys.contains(k.getConfKey()))
                 .filter(k -> !Constants.MASKED_VALUE.equals(k.getConfValue()))
-                .map(k -> new UtmModuleGroupConfDTO(k.getConfDataType(), k.getConfKey(), k.getConfValue()))
+                .map(k -> new UtmModuleGroupConfDTO(k.getConfDataType(), k.getConfKey(),
+                        encryptIfSensitive(k.getConfDataType(), k.getConfValue())))
                 .forEach(configDTOs::add);
 
         UtmModuleGroupConfWrapperDTO body = new UtmModuleGroupConfWrapperDTO(configDTOs);
 
         return utmStackConnectionService.validateModuleConfiguration(module.getModuleName().name(), body);
     }
 
+    private String encryptIfSensitive(String dataType, String value) {
+        if (value == null || value.isEmpty()) return value;
+        if (!Constants.CONF_TYPE_PASSWORD.equals(dataType) && !Constants.CONF_TYPE_FILE.equals(dataType)) {
+            return value;
+        }
+        return CipherUtil.encrypt(value, System.getenv(Constants.ENV_ENCRYPTION_KEY));
+    }
+
     private UtmModuleGroupConfiguration findInKeys(List<UtmModuleGroupConfiguration> keys, String confKey) {
         return keys.stream()
                 .filter(k -> k.getConfKey().equals(confKey))

plugins/modules-config/crypto/crypto.go

@@ -21,7 +21,9 @@ func DecryptConfigurationSection(section *config.ConfigurationSection, key strin
 	}
 
 	for _, group := range section.ModuleGroups {
-		decryptGroupConfigurations(section.ModuleName, group, key)
+		if err := decryptGroupConfigurations(section.ModuleName, group, key); err != nil {
+			return err
+		}
 	}
 
 	return nil
@@ -32,13 +34,12 @@ func DecryptModuleGroup(moduleName string, group *config.ModuleGroup, key string
 		return nil
 	}
 
-	decryptGroupConfigurations(moduleName, group, key)
-	return nil
+	return decryptGroupConfigurations(moduleName, group, key)
 }
 
-func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, key string) {
+func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, key string) error {
 	if group == nil {
-		return
+		return nil
 	}
 
 	for _, cnf := range group.ModuleGroupConfigurations {
@@ -48,18 +49,20 @@ func decryptGroupConfigurations(moduleName string, group *config.ModuleGroup, ke
 
 		plain, err := safeAESDecrypt(cnf.ConfValue, key)
 		if err != nil {
-			_ = catcher.Error("failed to decrypt configuration value", err, map[string]any{
+			return catcher.Error("failed to decrypt configuration value", err, map[string]any{
 				"process":      "plugin_com.utmstack.modules-config",
 				"module":       moduleName,
 				"groupId":      group.Id,
 				"confKey":      cnf.ConfKey,
 				"confDataType": cnf.ConfDataType,
+				"cipherLen":    len(cnf.ConfValue),
 			})
-			continue
 		}
 
 		cnf.ConfValue = plain
 	}
+
+	return nil
 }
 
 func safeAESDecrypt(cipherText, key string) (plain string, err error) {