feat(security): encrypt account OAuth tokens at rest

[waleedlatif1]

Why

The Better Auth account table stored access_token, refresh_token and id_token in plaintext (packages/db/schema.ts:94-96). It is the credential store for every user-connected integration — Google Drive, Slack, GitHub, Salesforce, ~60 connectors — plus OIDC sign-in tokens. A dump of that table was a dump of our customers' third-party data.

Every newer credential path already encrypts (credential.encryptedOauthTokenSet, encryptedServiceAccountKey, MCP OAuth, BYOK, env vars). This was the last plaintext credential store, and the largest.

What

Tokens are stored under a versioned AES-256-GCM envelope, simenc:v1:<iv>:<ciphertext>:<authTag>, built on the existing encryptSecret/decryptSecret primitives.

Reads detect the format per value and never consult the flag, so a mixed-format table reads correctly throughout. Only writes are gated, behind the AppConfig flag oauth-token-encryption, which is off by default. The deploy is therefore inert on arrival; the flag is flipped once every pod carries the tolerant reader, and rolling back is a config change rather than a data problem.

Self-hosted stays on plaintext until an operator opts in. A misconfigured ENCRYPTION_KEY degrades to plaintext rather than failing a user's OAuth connect — losing a connection is worse than staying plaintext.

No migration. No query filters or joins on a token value (the only predicate anywhere is isNotNull, which is unaffected), and the columns are text.

Why not Better Auth's account.encryptOAuthTokens

Deliberately rejected, and the rationale is recorded next to the envelope so the two are never confused. It keys off BETTER_AUTH_SECRET rather than ENCRYPTION_KEY; leaves idToken in plaintext despite its docs; decrypts only inside its own endpoints, not on the ~20 direct database reads this app performs; and detects ciphertext by treating any even-length hex string as encrypted — which is the shape of a real Trello or Airtable token. The two schemes are mutually exclusive: its detector does not recognise our prefix.

Consolidation

The duplication is what made encryption risky, so it went first:

• Three divergent copies of the staleness rule collapse into refresh-policy.ts. getOAuthToken's copy omitted the Microsoft proactive-refresh arm, so credentials reached only that way could pass Microsoft's 90-day inactivity deadline and die. Unifying fixes that (called out below as an intentional behaviour change).
• refreshTokenIfNeeded's credential: any becomes a branded LoadedOAuthCredential, which caught three callers passing raw rows at compile time. Two collapse onto the new resolveAccessTokenForAccount.
• Eleven projection-less account reads become id/userId projections or calls to the already-existing getCredentialOwner.
• The Shopify / Instagram / Trello connect flows — three copies of find/update/insert/re-find — share upsertProviderAccountTokens, so a new provider cannot store a plaintext token by copying an old flow.

Net −21 lines across modified files despite adding encryption.

Guardrail

check:account-token-access (new, in check:audits) flags direct token-column reads, projection-less selects, and direct writes to the table. The write rule matters most: db.insert(account).values({ accessToken }) is exactly how the next connect flow would be written, and no read-side rule catches it.

Bugs fixed along the way

• Salesforce double work. create.before and create.after both called fetchSalesforceInstanceUrl and both prepended the instance-URL marker (withSalesforceInstanceScope prepends unconditionally) — so every Salesforce connect made the same live API call twice and stored a double-prefixed scope.
• Unguarded Better Auth endpoints. POST /api/auth/get-access-token and /refresh-token are reachable through the catch-all and read account through the adapter with no databaseHooks pass. Nothing in this app calls them; they are now blocked alongside the existing organization/SSO blocks.
• A latent null token. refreshTokenIfNeeded could return { accessToken: null } — the parameter was any, so nothing caught it — and callers forwarded the null to a provider. It now fails as the 401 it always was.

Intentional behaviour changes

1. Microsoft proactive refresh now applies in getOAuthToken. A bug fix, but it means those credentials issue refresh writes that bump updated_at; checked against all four updated_at consumers and safe.
2. < → <= on access-token expiry. A token expiring exactly at now refreshes.
3. Trello account ids for new rows are now generateId() rather than trello_${userId}_${Date.now()}. Verified nothing depends on the prefix.
4. Salesforce's instance-URL marker is written once, in create.after. Previously both hooks fetched it — two identical live API calls per connect, and the marker was prepended twice into scope. The trade: a transient failure of the single fetch now leaves the marker unwritten for that row, where before a second fetch might have caught it. The 9 Salesforce tools' idToken fallback covers exactly that case (rows without markers already exist in production and work through it).
5. A credential with no access token and no refresh token now yields 401 from resolveCredentialToken instead of a 200 carrying accessToken: null — which callers forwarded to providers as a null bearer token — and the failed attempt no longer records a "credential used" audit row.

Each is pinned by a test; 4 and 5 were surfaced by a post-merge behavioral-equivalence audit against staging, site by site.

Out of scope

managed_oauth and service-account credentials (already encrypted, different format, same key — do not unify). Moving Shopify's shop domain out of the overloaded id_token into a scope marker. The backfill for dormant rows, which is a separate manually-run script. Tightening env.ts's ENCRYPTION_KEY validation from min(32) to 64-hex, which is a breaking change for existing self-hosters and needs its own release note.

Verification

• bun run check:audits — 40/40
• bun run lint:check — 26/26 packages
• tsc --noEmit — clean
• Full suite: 37,100 passing; the only failures are the pre-existing @aws-sdk/client-lambda ones (reproduced with this branch stashed) and one unrelated timeout flake that passes in isolation
• 106 new tests across four files, each mutation-tested — reverting the fix turns them red

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 1, 2026 1:06am UTC

[greptile-apps]

Greptile Summary

The PR introduces feature-gated AES-256-GCM encryption for OAuth tokens stored in account records, with mixed plaintext/ciphertext reads and a manual backfill path.

• Centralizes account-token encryption, decryption, persistence, refresh, and staleness policy.
• Consolidates Shopify, Instagram, and Trello token persistence behind a shared account helper.
• Blocks Better Auth account-token endpoints that would expose stored ciphertext without application-level decryption.
• Adds static account-token-access auditing and extensive crypto, persistence, refresh-policy, and audit tests.
• Adds transcript find-and-highlight behavior for the workspace chat surface.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the supplied follow-up-review scope.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/account-token-crypto.ts	Defines the versioned AES-256-GCM account-token envelope and strict prefix-based encryption/decryption behavior.
apps/sim/lib/oauth/account-tokens.ts	Adds feature-gated token encryption on writes and tolerant per-column decryption on reads.
apps/sim/lib/oauth/credential-service.ts	Centralizes account-token loading, persistence, refresh, ownership projection, and provider-account upserts.
apps/sim/lib/auth/auth.ts	Integrates account-token encryption and decryption into Better Auth database hooks and consolidates Salesforce token handling.
scripts/backfill-account-token-encryption.ts	Adds an idempotent, batched, compare-and-swap manual backfill for legacy plaintext account tokens.
scripts/check-account-token-access.ts	Adds static auditing for direct account-token reads, writes, and projection-less account queries.
apps/sim/lib/oauth/token-resolution.ts	Centralizes resolved credential-token validation so missing access and refresh tokens fail before provider calls.
apps/sim/app/workspace/[workspaceId]/home/components/mothership-chat/use-chat-find.ts	Adds virtualized transcript search, navigation, and CSS Custom Highlight API integration.

Sequence Diagram

sequenceDiagram
  participant P as OAuth Provider
  participant A as Application
  participant F as Feature Configuration
  participant K as Encryption Key
  participant D as Account Table
  participant C as Credential Consumer
  P->>A: Return OAuth token set
  A->>F: Check write-encryption flag
  A->>K: Validate encryption key
  alt Encryption enabled and key usable
    A->>A: Encrypt each token as simenc:v1 envelope
  else Encryption unavailable
    A->>A: Preserve plaintext token values
  end
  A->>D: Persist account token columns
  C->>D: Read account token columns
  D-->>C: Mixed plaintext or encrypted values
  C->>C: Detect envelope per value
  C->>K: Decrypt encrypted values
  C->>P: Call provider with resolved access token

Loading

_{Reviews (6): Last reviewed commit: "test(security): pin the shrunken audit a..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[cubic-dev-ai]

All reported issues were addressed across 30 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile