Authenticated encryption for enterprise secrets (#1078)

app/MindWork AI Studio/Components/DataSourceManagement.razor.cs

@@ -366,7 +366,7 @@ public partial class DataSourceManagement : MSGComponentBase
         }
 
         var decryptedSecret = await secretResponse.Secret.Decrypt(Program.ENCRYPTION);
-        if (!encryption.TryEncrypt(decryptedSecret, out var encryptedSecret))
+        if (!encryption.TryEncrypt(decryptedSecret, this.SettingsManager.ConfigurationData.App.EnterpriseEncryptionExportFormat, out var encryptedSecret))
         {
             await this.DialogService.ShowMessageBox(
                 T("Export ERI Data Source"),

app/MindWork AI Studio/Components/Settings/SettingsPanelApp.razor

@@ -71,10 +71,13 @@
         <MudButton StartIcon="@Icons.Material.Filled.Key"
                    Variant="Variant.Filled"
                    Color="Color.Primary"
+                   Class="mb-6"
                    OnClick="@this.GenerateEncryptionSecret">
             @T("Generate an encryption secret and copy it to the clipboard")
         </MudButton>
 
+        <ConfigurationSelect OptionDescription="@T("Format for encrypted secrets in exports")" SelectedValue="@(() => this.SettingsManager.ConfigurationData.App.EnterpriseEncryptionExportFormat)" Data="@ConfigurationSelectDataFactory.GetEnterpriseEncryptionFormatData()" SelectionUpdate="@(selectedValue => this.SettingsManager.ConfigurationData.App.EnterpriseEncryptionExportFormat = selectedValue)" OptionHelp="@T("Applies when you export providers, data sources, or tool settings with their API keys, tokens, or passwords. The protected format makes AI Studio refuse every value which was encrypted with another secret, but versions before v26.10.1 cannot read it. Keep the compatible format until every computer in your organization runs v26.10.1 or newer. Both formats use the same encryption secret.")" IsLocked="() => ManagedConfiguration.TryGet(x => x.App, x => x.EnterpriseEncryptionExportFormat, out var meta) && meta.IsLocked"/>
+
         <MudText Typo="Typo.h6" Class="mt-6 mb-3">
             @T("External HTTPS certificates")
         </MudText>

app/MindWork AI Studio/Components/Settings/SettingsPanelProviderBase.cs

@@ -41,7 +41,7 @@ public abstract class SettingsPanelProviderBase : SettingsPanelBase
                 if (encryption?.IsAvailable == true)
                 {
                     var decryptedApiKey = await apiKeyResponse.Secret.Decrypt(Program.ENCRYPTION);
-                    if (encryption.TryEncrypt(decryptedApiKey, out var encrypted))
+                    if (encryption.TryEncrypt(decryptedApiKey, this.SettingsManager.ConfigurationData.App.EnterpriseEncryptionExportFormat, out var encrypted))
                         encryptedApiKey = encrypted;
                 }
                 else