{"record":{"id":"5cd1d4ce99ffaee6","repo":"OtterMind/Chat2DB","slug":"api-decryptpassworderror","errorCode":"api.decryptPasswordError","errorMessage":"api.decryptPasswordError","messagePattern":"api\\.decryptPasswordError","errorType":"exception","errorClass":"BusinessException","httpStatus":null,"severity":"error","filePath":"chat2db-community-server/chat2db-community-domain/chat2db-community-domain-core/src/main/java/ai/chat2db/community/domain/core/impl/db/DbWorkspaceDataSourceServiceImpl.java","lineNumber":243,"sourceCode":"        try {\n            byte[] keyBytes = Base64.getDecoder().decode(privateKeyString);\n            PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);\n            KeyFactory keyFactory = KeyFactory.getInstance(\"RSA\");\n            return keyFactory.generatePrivate(keySpec);\n        } catch (Exception e) {\n            throw new BusinessException(\"api.privateKeyNotFound\");\n        }\n    }\n\n    private String decryptToken(String encryptedToken, PrivateKey privateKey) {\n        try {\n            Cipher cipher = Cipher.getInstance(\"RSA/ECB/PKCS1Padding\");\n            cipher.init(Cipher.DECRYPT_MODE, privateKey);\n            byte[] decryptedBytes = cipher.doFinal(Base64.getDecoder().decode(encryptedToken));\n            return new String(decryptedBytes, StandardCharsets.UTF_8);\n        } catch (Exception e) {\n            log.error(\"decrypt token error\", e);\n            throw new BusinessException(\"api.decryptPasswordError\");\n        }\n    }\n\n    private String decryptString(String password) {\n        if (password == null || password.isEmpty()) {\n            return password;\n        }\n        return AesGcmUtil.configured().decrypt(password);\n    }\n\n    private String encryptString(String password) {\n        if (password == null || password.isEmpty()) {\n            return password;\n        }\n        return AesGcmUtil.configured().encrypt(password);\n    }\n}\n","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/OtterMind/Chat2DB/blob/5ee1e990e73fbcae1969dc554be254fedb3ab888/chat2db-community-server/chat2db-community-domain/chat2db-community-domain-core/src/main/java/ai/chat2db/community/domain/core/impl/db/DbWorkspaceDataSourceServiceImpl.java#L225-L261","documentation":"BusinessException 'api.decryptPasswordError' from decryptToken when RSA/ECB/PKCS1Padding decryption of an encrypted field (password/host/url/user) fails. This is distinct from 143: here the key decoded fine, but the ciphertext does not decrypt against this key.","triggerScenarios":"Cipher.doFinal raises (BadPadding/IllegalBlockSize) because the token was encrypted with a different key pair, is not valid Base64, was double-encrypted, or the field is plain text being treated as ciphertext.","commonSituations":"Datasource was saved under one org key but is being read under another (key rotation mismatch); field was manually edited; migration imported ciphertext without migrating keys; Base64 padding corrupted.","solutions":["Re-save the datasource credentials so they are re-encrypted with the current organization key.","Ensure the same key pair used at encrypt time is available at decrypt time (check key rotation / environment promotion).","Confirm the stored value is actually the RSA ciphertext, not plain text or AES-encrypted local value."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":"// ensure field was encrypted with the current key before attempting decrypt\n// (no public predicate exists; rely on re-save after key rotation)","typeGuard":null,"tryCatchPattern":"try { return decryptToken(token, privateKey); }\ncatch (BusinessException e) { // api.decryptPasswordError\n    // prompt user to re-enter credentials so they are re-encrypted\n    throw new CredentialReentryRequiredException();\n}","preventionTips":["After any key rotation, re-save datasource credentials.","Do not mix local-AES and cloud-RSA encrypted values across environments.","Never manually edit encrypted fields."],"tags":["encryption","rsa","datasource","key-mismatch"],"backgroundTag":null,"analyzedSha":"5ee1e990e73fbcae1969dc554be254fedb3ab888","analyzedAt":"2026-08-14T07:05:03.077Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}