Title: feat(auth): Implement encrypted storage for OAuth account tokens by harrison-xrb · Pull Request #853 · sourcebot-dev/sourcebot · GitHub
Open Graph Title: feat(auth): Implement encrypted storage for OAuth account tokens by harrison-xrb · Pull Request #853 · sourcebot-dev/sourcebot
X Title: feat(auth): Implement encrypted storage for OAuth account tokens by harrison-xrb · Pull Request #853 · sourcebot-dev/sourcebot
Description: Add AES-256-GCM encryption for OAuth access and refresh tokens Create EncryptedPrismaAdapter wrapping Auth.js PrismaAdapter Implement automatic encryption on token storage and decryption on usage Support graceful handling of existing plaintext tokens with automatic migration Update accountPermissionSyncer to decrypt tokens before API calls Update tokenRefresh to encrypt refreshed tokens before storage This improves security by ensuring OAuth tokens are encrypted at rest in the database. Additionally, this PR changes the refresh token path to source the provider tokens from the database rather than storing them in the JWT token. Summary by CodeRabbit Security OAuth tokens (access, refresh, id tokens) are now encrypted at rest and transparently decrypted when needed. Sign-in and token persistence automatically store encrypted token data. New Tools Added a CLI utility to decode/decrypt JWE session tokens for troubleshooting. Behavior No visible change to user workflows; authentication, token refresh, and permission syncing continue to operate seamlessly.
Open Graph Description: Add AES-256-GCM encryption for OAuth access and refresh tokens Create EncryptedPrismaAdapter wrapping Auth.js PrismaAdapter Implement automatic encryption on token storage and decryption on usage S...
X Description: Add AES-256-GCM encryption for OAuth access and refresh tokens Create EncryptedPrismaAdapter wrapping Auth.js PrismaAdapter Implement automatic encryption on token storage and decryption on usage S...
Opengraph URL: https://github.com/sourcebot-dev/sourcebot/pull/853
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files/:range(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:1a49737c-4e00-1c9b-47e2-1dd7f0452d5f |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 8316:294157:366BEF8:487DD5A:6A6557C0 |
| html-safe-nonce | ca862ddbe5867fc7a5212b92827ae4fbae47c803be9eeb3513ea4b1542206af7 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI4MzE2OjI5NDE1NzozNjZCRUY4OjQ4N0RENUE6NkE2NTU3QzAiLCJ2aXNpdG9yX2lkIjoiNzI4NDQyMjYwNzc3NzM4ODQ4MCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | e55b5310c8cc2721a9bb249b6abcfc7bd63fb2bd191f5bc1df01d300dc73a75d |
| hovercard-subject-tag | pull_request:3247947180 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/sourcebot-dev/sourcebot/pull/853/files/7c432e584e3a8eacd69ff415ff15ebf11f387894 |
| twitter:image | https://avatars.githubusercontent.com/u/255055878?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/255055878?s=400&v=4 |
| og:image:alt | Add AES-256-GCM encryption for OAuth access and refresh tokens Create EncryptedPrismaAdapter wrapping Auth.js PrismaAdapter Implement automatic encryption on token storage and decryption on usage S... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 52c76df668885aaff23b50bdca1fa1ea44ac9c1553e888ebc70ff1e4daa4625b |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/sourcebot-dev/sourcebot git https://github.com/sourcebot-dev/sourcebot.git |
| octolytics-dimension-user_id | 135396723 |
| octolytics-dimension-user_login | sourcebot-dev |
| octolytics-dimension-repository_id | 846729675 |
| octolytics-dimension-repository_nwo | sourcebot-dev/sourcebot |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 846729675 |
| octolytics-dimension-repository_network_root_nwo | sourcebot-dev/sourcebot |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 309153364422b3c499922d1a2a6404910a58ed8e |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width