Authenticated encryption for enterprise secrets (#1078)

app/MindWork AI Studio/wwwroot/changelog/v26.10.1.md

@@ -19,6 +19,8 @@
 - Added organization-wide management for importing configurations which somebody exported from AI Studio. IT departments can allow or prevent such imports, either altogether or for each kind, such as providers or chat templates. A locked Import button stays visible.
 - Added an optional notice for AI-generated content. When you switch it on in the app settings, the AI answers you copy or export end with a note that AI generated them, in the language of the app, for example, when rules on transparency such as the EU AI Act ask for one. Thanks, Sabrina (`Sabrina-devops`), for this contribution.
 - Added organization-wide management for the notice on AI-generated content. IT departments can switch it on for everybody, either fixed or as a default which users may change.
+- Added a choice of how AI Studio encrypts API keys, tokens, and passwords when you export providers, data sources, or tool settings for your organization. The new protected format needs AI Studio v26.10.1 or newer on every computer that reads it, and your encryption secret stays the same. If you used AI Studio before, your exports keep the previous format until you switch, so your organization can update all computers first. You find the choice in the app settings, under Enterprise Administration.
+- Added organization-wide management for the format in which exports encrypt API keys, tokens, and passwords. IT departments can set it for all their administrators, either fixed or as a default which users may change.
 - Improved the Read Web Page tool. When you have not allowed the AI to choose web addresses freely, the tool now refuses every address that does not appear in your chat or in what the tools returned, instead of only asking the AI not to read it.
 - Improved the installation on macOS: AI Studio is now signed and checked by Apple, so it opens like any other app. You no longer need the Terminal.
 - Improved the installation on Windows: AI Studio is now signed, so Windows shows who published it. For a while, Windows may still ask you to confirm the installation until it knows the app better.
@@ -79,6 +81,7 @@
 - Fixed building AI Studio from source on Windows, where the checks that run before every build failed because two of them expected the line breaks and file paths of macOS and Linux. Thanks, Paul Koudelka (`PaulKoudelka`), for this contribution.
 - Fixed a problem on Windows where AI Studio could fail to read the configuration of your organization when the name of an environment variable on your computer contained umlauts or other special characters.
 - Fixed the localization assistant writing the translation instead of the English text into the comment above an entry of a language plugin. This happened when the English language plugin did not contain that text yet.
+- Fixed AI Studio occasionally accepting an API key, token, or password which was encrypted with the secret of another organization, instead of refusing it. AI Studio then used a wrong key, so the provider, data source, or tool failed later with a misleading error. Such a value is now always refused in the new protected format, and almost always in the previous one.
 - Updated the code contributions on the supporters page, which now thank everyone who has contributed code to AI Studio so far.
 - Upgraded several libraries to improve security.
 - Upgraded to Rust v1.99.0