[det101]

Purpose

Implements #18587 (subtask of #17937 / DSIP-105). Depends on #18586 / #18585.

Reuse PasswordUtils for definition-time at-rest protection of sensitive=true values when datasource.encryption.enable=true. Do not change datasource CRUD. Runtime instance params stay plaintext materialization; API/UI still return masked copies only.

Changes

• Definition create/update: merge keep-original (******) then encode new sensitive plaintext; skip re-encode when value equals existing sensitive DB value
• Instance update: merge only (no encode)
• Start path: decrypt definition globals before restoreStartParams
• Master: decrypt definition globals before instance materialization; decrypt localParams in TaskExecutionContext / prepare-params so Worker receives plaintext
• Same-cluster Copy unchanged (JSON copied as-is)

Tests

• Unit tests for encode on create, keep-original no double-encrypt, false→true keep-original then encode, encryption flag on/off, start-path decrypt, Master localParams decrypt

Related issues

• Parent: [DSIP-105][Feature][Parent] Sensitive Variable Support — Masking in API/UI & Encrypted Storage #17937
• This subtask: [DSIP-105][Feature][API] Encrypt sensitive definition params with PasswordUtils #18587
• Previous: [DSIP-105][Feature][API] Add Property.sensitive and mask values in API/UI #18586 / [DSIP-105][API][UI] Add Property.sensitive with API/UI masking #18585

[SbloodyS]

Encrypt definition snapshots created by instance edits

updateWorkflowInstance() is not an instance-only persistence path. It calls saveTaskDefine() and saveWorkflowDefine(), which write definition history even when syncDefine=false and also update current definitions when syncDefine=true.

Passing false to mergeLocalParams() therefore persists newly entered sensitive local values as plaintext in definition tables. The merged runtime globalParams are also passed directly into workflowDefinition.set(), so even keeping an existing sensitive global unchanged can copy its plaintext instance value back into the definition.

Please preserve plaintext instance globals while encrypting the copies persisted as task/workflow definitions. Add service-level coverage for instance edits with encryption enabled and both syncDefine values; the new utility tests do not cover this persistence path.

[det101]

@SbloodyS Thanks for the review. Addressed in 5454ea3.

updateWorkflowInstance() writes definition history through saveTaskDefine() / saveWorkflowDefine() even when syncDefine=false, and updates the current definitions when syncDefine=true. The instance and those definition snapshots are now handled separately:

• Task localParams go through mergeLocalParams() before saveTaskDefine(). That method always encodes. The encode=false overload is removed, so a newly entered sensitive local value is not stored as plaintext in the definition log.
• Instance global_params still use merge() against the instance plaintext and stay plaintext.
• The copy passed to workflowDefinition.set() uses mergeAndEncode() against the workflow definition's stored ciphertext. An unchanged ****** keeps that ciphertext instead of copying the instance plaintext back into the definition.

Service coverage is in WorkflowInstanceServiceTest#testUpdateWorkflowInstanceEncryptsDefinitionSnapshotsForBothSyncDefine, with encryption enabled and both syncDefine=true and syncDefine=false. It checks that new sensitive values are encoded on the definition snapshot, keep-original values stay the existing ciphertext, and instance globals remain plaintext.

[SbloodyS]

Encrypt the instance-resolved globals when saving definition snapshots

WorkflowInstanceServiceImpl.java:470–474

updateWorkflowInstance() resolves ****** against the instance globals, but then resolves the same submitted placeholder again against the latest workflow definition when building the encrypted snapshot.

For example, if the definition contains secret A and the instance was started with override B, an unchanged ****** preserves B in the instance but saves A in the definition snapshot. With syncDefine=true, the synchronized definition therefore differs from the edited instance. If the parameter was removed from the latest definition, the second merge can instead reject an otherwise valid instance edit.

Build the encrypted snapshot from the already-resolved instance values, preserving plaintext instance storage and avoiding double encoding. Add service-level coverage where the instance value differs from the definition value, for both syncDefine settings; the current test uses matching values and misses this case.

[det101]

@SbloodyS Thanks for the follow-up review. Addressed in 4ce442a.

Instance-resolved definition snapshot

updateWorkflowInstance() no longer merges ****** a second time against the latest workflow definition. The definition snapshot is built from the already-resolved instance globals (instanceGlobalParams), then encoded only at the persist boundary before saveWorkflowDefine(). Instance global_params stay plaintext.

This covers the case where the definition has secret A and the instance was started with override B: an unchanged ****** keeps B on the instance and encodes B (not A) into the definition snapshot for both syncDefine=true and syncDefine=false.

Coverage is in WorkflowInstanceServiceTest#assertInstanceEditUsesInstanceOverrideForDefinitionSnapshot.

Crypto closer to load/persist boundaries

We also tightened the encode/decode placement so sensitive definition values are handled as close as possible to DB I/O:

• Persist: encode task localParams / workflow globalParams immediately before saveTaskDefine / saveWorkflowDefine (definition create/update and instance-edit definition snapshots). Business logic (merge, permission, DAG checks) stays on plaintext.
• Load: decode right after reading definition rows for start/backfill (decodeAfterLoad), and once when Master assembles the workflow definition; task localParams stay ciphertext in the graph / task_instance and are decrypted only when building the worker TaskExecutionContext.

Happy to adjust further if anything still looks off.

[SbloodyS]

LGTM

[SbloodyS]

Please fix the failed CI.