V0.38.5 git board rewrite (#238)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

server/handlers/connection_resolver.go

@@ -63,13 +63,28 @@ func (r *ConnectionResolverAdapter) decryptInPlace(ctx context.Context, conn *mo
 		if len(enc) == 0 {
 			continue
 		}
-		plaintext, err := r.vault.Decrypt(enc, nonce, conn.Scope, conn.OwnerID)
-		if err == nil {
+		plaintext := r.safeDecrypt(enc, nonce, conn.Scope, conn.OwnerID)
+		if plaintext != "" {
 			conn.Config[k] = plaintext
 		}
 	}
 }
 
+// safeDecrypt wraps vault.Decrypt to recover from GCM panics caused by
+// invalid nonce lengths (e.g. stale vault keys after container restart).
+func (r *ConnectionResolverAdapter) safeDecrypt(enc, nonce []byte, scope, ownerID string) (plaintext string) {
+	defer func() {
+		if rv := recover(); rv != nil {
+			plaintext = ""
+		}
+	}()
+	result, err := r.vault.Decrypt(enc, nonce, scope, ownerID)
+	if err != nil {
+		return ""
+	}
+	return result
+}
+
 // lookupSecretFields reads the package manifest to identify secret fields.
 func (r *ConnectionResolverAdapter) lookupSecretFields(ctx context.Context, packageID, connType string) map[string]bool {
 	result := map[string]bool{}