fix(worker): decrypt CRM regulatory_fields + related_parties PII

[brunobls]

Pull Request

Description

Backport of #320 onto the maintenance/v1.4.x line.

#320 was merged into main (72d015a, 2026-07-17) and shipped as v3.0.1. It never reached the maintenance line, so no 1.4.8 was ever cut — and production multi-tenant runs 1.4.7, whose tip (16af2d7, 2026-06-26) predates the fix. Production is therefore still affected.

The defect: decryptNestedFields never reached regulatory_fields.participant_document nor related_parties[].document. Both left the worker as AES-GCM ciphertext and arrived in the report unreadable — the CCS-0011 failure.

The fix (cherry-pick of 1aa00fb, unchanged in substance):

• decryptRegulatoryFields — map-shaped, mirrors decryptBankingDetailsFields, handles participant_document.
• decryptRelatedParties — slice-shaped ([]any of map[string]any), decrypts document on each element; name, role, start_date, end_date are plaintext in the live CRM and are never touched.

Both reuse the same *libCrypto.Crypto instance and the existing decryptFieldValue helper — no new cipher scheme. Both are fail-closed on the sensitive value: an undecryptable document returns an error rather than passing ciphertext through, and error messages name the field path and element index but never the raw value. Shape drift in the related_parties container (absent, wrong-typed, or a non-map element) is a no-op rather than an error, since a malformed container is not itself sensitive data.

Conflict resolution vs the 3.x original: extract_crm_data.go applied cleanly (+75, additions only). The test file conflicted in one hunk: 3.x dropped the fields member from the TestDecryptPluginCRMData table and renamed assert to assertFn, while 1.4.x keeps both. The added cases were adapted to the 1.4.x shape; no assertion was weakened or dropped.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Refactoring (no functional changes)
• CI/CD changes
• Dependencies update

Checklist

• I have tested these changes locally
• I have updated the documentation accordingly
• I have added necessary comments to the code, especially in complex areas
• I have ensured that my changes adhere to the project's coding standards
• I have checked for any potential security issues
• I have ensured that all tests pass
• I have confirmed this code is ready for review

Local verification on this branch:

Gate	Result
make test-unit	exit 0 — 52 packages ok, 0 failures
make lint	0 issues, no autofix changes
make sec	exit 0 — 2 pre-existing findings in tests/shared/fixtures/ssl/generate.go, outside this diff

Related Issues

Backport of #320.

Additional Notes

Base is maintenance/v1.4.x, not develop — this is a maintenance backport, and pr-validation.yml on this line only triggers for PRs into maintenance/v1.4.x.

Merging this is not sufficient to fix production. Two follow-ups are required:

1. Cut 1.4.8 from the maintenance line.
2. Bump fetcher-manager and fetcher-worker from 1.4.7 to 1.4.8 in lerian-aws-gitops → environments/production/lerian-eks-production/helmfile/applications/fetcher-mt/values.yaml.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (1)

• develop

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0322505a-8dfb-46d8-8b25-8fea82fd5b61

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[lerian-studio]

🔍 PR Validation Summary

✅ PR Mergeable — no blocking failures

Check	Status	Blocking
Source Branch	✅ success	yes
PR Title	✅ success	yes
PR Description	✅ success	yes
PR Size	✅ success	no
Auto Labels	✅ success	no
PR Metadata	✅ success	no

---

_{🔍 View workflow run}