feat(security): encrypt account OAuth tokens at rest

[waleedlatif1]

Why

The Better Auth account table stored access_token, refresh_token and id_token in plaintext (packages/db/schema.ts:94-96). It is the credential store for every user-connected integration — Google Drive, Slack, GitHub, Salesforce, ~60 connectors — plus OIDC sign-in tokens. A dump of that table was a dump of our customers' third-party data.

Every newer credential path already encrypts (credential.encryptedOauthTokenSet, encryptedServiceAccountKey, MCP OAuth, BYOK, env vars). This was the last plaintext credential store, and the largest.

What

Tokens are stored under a versioned AES-256-GCM envelope, simenc:v1:<iv>:<ciphertext>:<authTag>, built on the existing encryptSecret/decryptSecret primitives.

Reads detect the format per value and never consult the flag, so a mixed-format table reads correctly throughout. Only writes are gated, behind the AppConfig flag oauth-token-encryption, which is off by default. The deploy is therefore inert on arrival; the flag is flipped once every pod carries the tolerant reader, and rolling back is a config change rather than a data problem.

Self-hosted stays on plaintext until an operator opts in. A misconfigured ENCRYPTION_KEY degrades to plaintext rather than failing a user's OAuth connect — losing a connection is worse than staying plaintext.

No migration. No query filters or joins on a token value (the only predicate anywhere is isNotNull, which is unaffected), and the columns are text.

Why not Better Auth's account.encryptOAuthTokens

Deliberately rejected, and the rationale is recorded next to the envelope so the two are never confused. It keys off BETTER_AUTH_SECRET rather than ENCRYPTION_KEY; leaves idToken in plaintext despite its docs; decrypts only inside its own endpoints, not on the ~20 direct database reads this app performs; and detects ciphertext by treating any even-length hex string as encrypted — which is the shape of a real Trello or Airtable token. The two schemes are mutually exclusive: its detector does not recognise our prefix.

Consolidation

The duplication is what made encryption risky, so it went first:

• Three divergent copies of the staleness rule collapse into refresh-policy.ts. getOAuthToken's copy omitted the Microsoft proactive-refresh arm, so credentials reached only that way could pass Microsoft's 90-day inactivity deadline and die. Unifying fixes that (called out below as an intentional behaviour change).
• refreshTokenIfNeeded's credential: any becomes a branded LoadedOAuthCredential, which caught three callers passing raw rows at compile time. Two collapse onto the new resolveAccessTokenForAccount.
• Eleven projection-less account reads become id/userId projections or calls to the already-existing getCredentialOwner.
• The Shopify / Instagram / Trello connect flows — three copies of find/update/insert/re-find — share upsertProviderAccountTokens, so a new provider cannot store a plaintext token by copying an old flow.

Net −21 lines across modified files despite adding encryption.

Guardrail

check:account-token-access (new, in check:audits) flags direct token-column reads, projection-less selects, and direct writes to the table. The write rule matters most: db.insert(account).values({ accessToken }) is exactly how the next connect flow would be written, and no read-side rule catches it.

Bugs fixed along the way

• Salesforce double work. create.before and create.after both called fetchSalesforceInstanceUrl and both prepended the instance-URL marker (withSalesforceInstanceScope prepends unconditionally) — so every Salesforce connect made the same live API call twice and stored a double-prefixed scope.
• Unguarded Better Auth endpoints. POST /api/auth/get-access-token and /refresh-token are reachable through the catch-all and read account through the adapter with no databaseHooks pass. Nothing in this app calls them; they are now blocked alongside the existing organization/SSO blocks.
• A latent null token. refreshTokenIfNeeded could return { accessToken: null } — the parameter was any, so nothing caught it — and callers forwarded the null to a provider. It now fails as the 401 it always was.

Intentional behaviour changes

1. Microsoft proactive refresh now applies in getOAuthToken. A bug fix, but it means those credentials issue refresh writes that bump updated_at; checked against all four updated_at consumers and safe.
2. < → <= on access-token expiry. A token expiring exactly at now refreshes.
3. Trello account ids for new rows are now generateId() rather than trello_${userId}_${Date.now()}. Verified nothing depends on the prefix.

Each is pinned by a test.

Out of scope

managed_oauth and service-account credentials (already encrypted, different format, same key — do not unify). Moving Shopify's shop domain out of the overloaded id_token into a scope marker. The backfill for dormant rows, which is a separate manually-run script. Tightening env.ts's ENCRYPTION_KEY validation from min(32) to 64-hex, which is a breaking change for existing self-hosters and needs its own release note.

Verification

• bun run check:audits — 40/40
• bun run lint:check — 26/26 packages
• tsc --noEmit — clean
• Full suite: 37,100 passing; the only failures are the pre-existing @aws-sdk/client-lambda ones (reproduced with this branch stashed) and one unrelated timeout flake that passes in isolation
• 106 new tests across four files, each mutation-tested — reverting the fix turns them red

[gitguardian]

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

---

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 28, 2026 10:34pm

[greptile-apps]

Greptile Summary

The PR introduces versioned AES-256-GCM encryption for OAuth tokens stored in the account table, with mixed-format reads and feature-gated writes.

• Centralizes account token encryption and decryption behind shared accessors.
• Consolidates OAuth token refresh, resolution, and provider-account upsert paths.
• Adds a backfill utility and an audit guardrail for direct account-token access.
• Blocks Better Auth endpoints that would return stored ciphertext without application-level decryption.

Confidence Score: 5/5

The PR appears safe to merge because no blocking failure remains within the scope of this follow-up review.

No blocking failure remains.

Important Files Changed

Filename	Overview
apps/sim/lib/oauth/account-token-crypto.ts	Defines the versioned OAuth-token envelope, exact format detection, authenticated decryption, and field-selection behavior.
apps/sim/lib/oauth/account-tokens.ts	Implements feature-gated token writes and mixed-format, failure-isolated token reads.
apps/sim/lib/oauth/credential-service.ts	Routes account token persistence and credential resolution through the new encryption boundary.
apps/sim/lib/auth/auth.ts	Encrypts Better Auth account creates and updates while decrypting token values needed by post-write provider operations.
scripts/backfill-account-token-encryption.ts	Adds a resumable batch process for encrypting existing plaintext account-token columns.
scripts/check-account-token-access.ts	Adds static checks intended to prevent unmediated account-token reads and writes.
apps/sim/app/api/auth/[...all]/route.ts	Blocks Better Auth token endpoints that would bypass the application token-decryption path.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[OAuth provider or refresh flow] --> B[Account token write accessor]
  B --> C{Encryption flag enabled and key usable?}
  C -->|Yes| D[Wrap tokens in simenc:v1 AES-GCM envelope]
  C -->|No| E[Preserve legacy plaintext representation]
  D --> F[(Account table)]
  E --> F
  F --> G[Account token read accessor]
  G --> H{Envelope detected?}
  H -->|Yes| I[Decrypt token columns]
  H -->|No| J[Return legacy plaintext columns]
  I --> K[Credential resolution and provider calls]
  J --> K

Loading

_{Reviews (4): Last reviewed commit: "feat(security): add the account token en..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[cubic-dev-ai]

All reported issues were addressed across 30 files

<sub>Tip: cubic can generate docs of your entire codebase and keep them up to date. Try it here.

Fix all with cubic | Re-trigger cubic</sub>

[waleedlatif1]

@greptile

[waleedlatif1]

@greptile