MySQL Backups: editing a post-run-encrypted task silently disables encryption

[marcuscruz-percona]

What happened

Open an existing MySQL Backups task that has Encrypt backup off but Encrypt after backup completes (post-run encryption) on. That combination produced an encrypted backup in older versions — post-run encryption encrypts on its own, the master switch is not required for it.

In the schema-driven edit form, the post-run option and the encryption recipient are not shown, because the form hides every dependent encryption option whenever the "Encrypt backup" master switch is off. Saving the task — even without touching the Encryption section — drops the post-run setting entirely. The next run of that task produces an unencrypted backup. No error, warning, or confirmation is shown.

What I expected

Editing a task that currently encrypts its backups must not silently disable encryption. Either the form preserves the existing post-run encryption, or it surfaces a clear warning/validation error that the saved configuration will stop encrypting.

Steps to reproduce

1. Have a MySQL Backups task with the encryption master switch off, post-run encryption on, and a recipient set (created before the current encryption gates, or via a direct API body).
2. Confirm a run produces an encrypted (.gpg) backup.
3. Open the task in the edit form. The Encryption section shows only the "Encrypt backup" switch (off); the post-run option and recipient are absent.
4. Change something outside Encryption (or nothing) and save.
5. Inspect the saved task / run it again → the backup is now unencrypted.

Additional context

• The form hides dependent encryption options while the master switch is off and drops their values from the submit, so a hidden "on" value is silently discarded rather than rejected — the backend then defaults the missing field to off.
• The batch migration that stamps older tasks skips these legacy combinations (logs and leaves them as-is), so they survive untouched until a user edits them.
• The same hide-and-drop path can also silently change the encryption mode (e.g. losing in-place/tmpdir encryption, changing how/where encryption happens) when the master switch is toggled, again with no error.
• The recent asymmetric-gate change handled the both-modes-set case (it keeps post-run) but not this off + post-run case.
• Security-relevant: the downgrade is from encrypted to plaintext backups.