shreemaan-abhishek opened a new pull request, #13729: URL: https://github.com/apache/apisix/pull/13729
### Description `resource.check_conf` calls the per-resource `encrypt_conf` hook **before** checking whether `self.checker(...)` succeeded. For invalid input, the encryption hooks therefore run against unvalidated structures: for example, a non-object `plugins` value reaches `pairs(plugins_conf)` in `admin/plugins.lua` and raises a Lua error, turning a clean **400** schema-validation error into a **500**. This moves the `encrypt_conf` call below the `if not ok then return` so encryption runs only on validated config (invalid configs are never persisted anyway). Also drops the `plugin_object.check_schema` gate in `plugin_metadata.encrypt_conf`: `plugin.encrypt_conf` derives fields from `metadata_schema.encrypt_fields` and does not need a custom validator, so a plugin that validates via `core.schema.check` would otherwise skip encryption and persist its metadata secret in plaintext. Both were introduced in #12603. ### Tests New `t/admin/encrypt-after-validation.t`: - a non-object `plugins` value now returns **400** (previously a 500 from `bad argument #1 to 'pairs' (table expected, got string)`); - a valid consumer with a `key-auth` secret is still stored as ciphertext at rest when `data_encryption` is enabled, confirming encryption still runs on the success path. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [x] I have updated the documentation to reflect this change (N/A - no user-facing behavior/doc change) - [x] I have verified that the code passes the existing lint (`luacheck`) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
