improvement(auth): encrypt stored integration tokens (#9346)

* improvement(auth): encrypt stored integration tokens

* fix(settings): read permission predicates from the db-free entry

* improvement(security): detect sealed envelopes by their full shape

* improvement(auth): bind sealed tokens to their column and guard the backfill key

* improvement(auth): read the sealed context from the column definition

* fix(audit): report the line of a raw sealed column name

* improvement(audit): flag wildcard and identifier reads of sealed columns

Author: waleedlatif1

apps/sim/components/settings/navigation.ts

@@ -27,7 +27,7 @@ import {
   Users,
   Wrench,
 } from '@sim/emcn/icons'
-import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/workspace'
+import { type PermissionType, permissionSatisfies } from '@sim/platform-authz/predicates'
 import { CodeIcon, McpIcon, SlackIcon } from '@/components/icons'
 import type { SettingsHeaderMeta } from '@/components/settings/settings-header'
 import type { DeploymentFeatures, DeploymentShape } from '@/lib/api/contracts/workspaces'

apps/sim/instrumentation-node.ts

@@ -378,6 +378,9 @@ export async function register() {
 
   await initializeOpenTelemetry()
 
+  const { reportAccountTokenSealing } = await import('@sim/db/sealed-text')
+  reportAccountTokenSealing()
+
   const shutdownPostHog = async () => {
     try {
       const { getPostHogClient } = await import('@/lib/posthog/server')

apps/sim/lib/core/config/env.ts

@@ -144,6 +144,7 @@ export const env = createEnv({
     TURNSTILE_SECRET_KEY:                  z.string().min(1).optional(),           // Cloudflare Turnstile secret key for captcha verification
     ENCRYPTION_KEY:                        z.string().min(32),                     // Key for encrypting sensitive data
     API_ENCRYPTION_KEY:                    z.string().min(32).optional(),          // Dedicated key for encrypting API keys (optional for OSS)
+    ENCRYPT_ACCOUNT_TOKENS:                z.boolean().optional(),                 // Seal OAuth access/refresh tokens on write (read by @sim/db); takes effect only with a 64-hex ENCRYPTION_KEY. Enable only once every app, worker, and background-task deployment runs a release that reads sealed tokens
     INTERNAL_API_SECRET:                   z.string().min(32),                     // Secret for internal API authentication
     INTERNAL_JWT_SECRET:                   z.string().min(32).optional(),          // Dedicated signing key for internal JWTs (falls back to INTERNAL_API_SECRET); separating limits blast radius if one leaks
 

apps/sim/lib/oauth/credential-revocation.integration.ts

@@ -5,7 +5,7 @@ import { account, credential, user, workspace } from '@sim/db/schema'
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { createDeferred, type Deferred } from '@sim/testing/helpers/deferred'
 import { generateId } from '@sim/utils/id'
-import { eq, inArray } from 'drizzle-orm'
+import { eq, inArray, sql } from 'drizzle-orm'
 import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { redisUrl } = await vi.hoisted(async () => {
@@ -36,6 +36,7 @@ import { fanOutSlackTokenChain } from '@/lib/oauth/slack'
 import { completeOAuthCredentialToken } from '@/lib/oauth/token-resolution'
 
 const originalFetch = globalThis.fetch
+const fixtureEncryptionKey = process.env.ENCRYPTION_KEY
 const userId = generateId()
 const workspaceId = generateId()
 const accountId = generateId()
@@ -81,6 +82,17 @@ async function storedRow(rowId: string) {
   return row
 }
 
+async function rawTokens() {
+  const [row] = await db.execute<{ access_token: string | null; refresh_token: string | null }>(
+    sql`SELECT access_token, refresh_token FROM account WHERE id = ${accountId}`
+  )
+  return row
+}
+
+function sealWrites(enabled: boolean) {
+  process.env.ENCRYPT_ACCOUNT_TOKENS = enabled ? 'true' : 'false'
+}
+
 async function resolveToken(rowId = accountId) {
   return refreshTokenIfNeeded('revocation-integration', await storedRow(rowId), rowId)
 }
@@ -177,6 +189,8 @@ beforeEach(async () => {
 })
 
 afterEach((context) => {
+  sealWrites(false)
+  process.env.ENCRYPTION_KEY = fixtureEncryptionKey
   pausedProvider?.release.resolve()
   checks.push({
     name: context.task.name,
@@ -453,3 +467,79 @@ describe('OAuth refresh-token revocation against PostgreSQL and Redis', () => {
     })
   })
 })
+
+describe('OAuth refresh chains with sealed account tokens', () => {
+  async function sealStoredChain() {
+    sealWrites(true)
+    await db
+      .update(account)
+      .set({ accessToken: 'expired-access', refreshToken: 'issued-refresh' })
+      .where(eq(account.id, accountId))
+  }
+
+  it('stores tokens sealed and reads them back as plaintext', async () => {
+    await sealStoredChain()
+
+    const raw = await rawTokens()
+    expect(raw.access_token).toMatch(/^enc:v1:/)
+    expect(raw.refresh_token).toMatch(/^enc:v1:/)
+    expect(JSON.stringify(raw)).not.toContain('issued-refresh')
+    expect(await storedAccount()).toMatchObject({
+      accessToken: 'expired-access',
+      refreshToken: 'issued-refresh',
+    })
+  })
+
+  it('keeps writing readable tokens when sealing is requested without a usable key', async () => {
+    sealWrites(true)
+    process.env.ENCRYPTION_KEY = 'not-hex'.repeat(6)
+    providerAnswer = REFRESHED
+
+    await expect(resolveToken()).resolves.toEqual({ accessToken: 'fresh-access', refreshed: true })
+    expect(await rawTokens()).toMatchObject({ access_token: 'fresh-access' })
+  })
+
+  it('rotates a chain stored before sealing was enabled', async () => {
+    sealWrites(true)
+    providerAnswer = REFRESHED
+
+    await expect(resolveToken()).resolves.toEqual({ accessToken: 'fresh-access', refreshed: true })
+    expect(await rawTokens()).toMatchObject({
+      access_token: expect.stringMatching(/^enc:v1:/),
+      refresh_token: 'issued-refresh',
+    })
+    expect((await storedAccount()).accessToken).toBe('fresh-access')
+  })
+
+  it('rotates a sealed chain on a process that does not seal writes', async () => {
+    await sealStoredChain()
+    sealWrites(false)
+    providerAnswer = REFRESHED
+
+    await expect(resolveToken()).resolves.toEqual({ accessToken: 'fresh-access', refreshed: true })
+    expect(await rawTokens()).toMatchObject({
+      access_token: 'fresh-access',
+      refresh_token: expect.stringMatching(/^enc:v1:/),
+    })
+  })
+
+  it('records a revocation against a sealed chain on a process that does not seal writes', async () => {
+    await sealStoredChain()
+    sealWrites(false)
+
+    await expect(resolveToken()).rejects.toBeInstanceOf(CredentialRevokedError)
+    await expect(getCredentialTerminalRefreshError(credentialId)).resolves.toEqual({
+      errorCode: 'invalid_grant',
+      providerId: PROVIDER_ID,
+    })
+  })
+
+  it('keeps a revocation recorded before the chain was sealed', async () => {
+    await expect(resolveToken()).rejects.toBeInstanceOf(CredentialRevokedError)
+    await expireRedisFlags()
+    await sealStoredChain()
+
+    await expect(resolveToken()).rejects.toBeInstanceOf(CredentialRevokedError)
+    expect(providerRequests).toBe(1)
+  })
+})

apps/sim/lib/oauth/credential-service.test.ts

@@ -86,6 +86,11 @@ const serviceLogger = getMockLogger('OAuthCredentialService')
 const transportLogger = getMockLogger('GoogleServiceAccountTransport')
 const mocks = { ...hoisted, decryptSecret: encryptionMockFns.mockDecryptSecret }
 
+beforeEach(() => {
+  // Schema mocks carry no table to seal against; credential-revocation.integration.ts covers sealing.
+  vi.stubEnv('ENCRYPTION_KEY', '')
+})
+
 /** Every call the credential service and its token transport logged at the given levels. */
 function loggedCalls(...levels: Array<'info' | 'warn' | 'error'>) {
   return levels.flatMap((level) => [

apps/sim/lib/oauth/credential-service.ts

@@ -1,6 +1,7 @@
 import { createHmac, createSign } from 'crypto'
 import { db } from '@sim/db'
 import { account, credential } from '@sim/db/schema'
+import { sealedTextEquals } from '@sim/db/sealed-text'
 import { createLogger } from '@sim/logger'
 import { getPostgresErrorCode, toError } from '@sim/utils/errors'
 import { and, desc, eq, isNotNull, sql } from 'drizzle-orm'
@@ -973,7 +974,7 @@ async function recordRefreshRevocation(
     .where(
       and(
         chainRowsFilter(scope.accountId, scope.slackTeamId),
-        eq(account.refreshToken, rejectedRefreshToken),
+        sealedTextEquals(account.refreshToken, rejectedRefreshToken),
         // Raw sql params skip drizzle's column mapping, so the Date is serialized explicitly;
         // truncation keeps a version read back at millisecond precision comparable. A row that
         // vanished before it could be read has no version and matches nothing anyway.
@@ -1366,7 +1367,9 @@ async function performCoalescedRefresh({
             const rotated = await db
               .update(account)
               .set(updateData)
-              .where(and(eq(account.id, accountId), eq(account.refreshToken, refreshToken)))
+              .where(
+                and(eq(account.id, accountId), sealedTextEquals(account.refreshToken, refreshToken))
+              )
               .returning({ id: account.id })
             if (rotated.length === 0) {
               const stored = await readStoredChain(accountId)

apps/sim/trigger.config.ts

@@ -133,6 +133,8 @@ export default defineConfig({
       createLogger('TriggerInit').error('Could not distrust compromised CA roots', tlsTrust)
     }
     markInsideTriggerRun()
+    const { reportAccountTokenSealing } = await import('@sim/db/sealed-text')
+    reportAccountTokenSealing()
     const { warmRedisConnection } = await import('./lib/core/config/redis')
     await warmRedisConnection()
   },

bun.lock

@@ -12,9 +12,10 @@ WORKDIR /app
 # Copy only package files needed for migrations (these change less frequently)
 COPY package.json bun.lock turbo.json ./
 COPY patches ./patches
-RUN mkdir -p packages/db packages/logger packages/tsconfig packages/utils
+RUN mkdir -p packages/db packages/logger packages/security packages/tsconfig packages/utils
 COPY packages/db/package.json ./packages/db/package.json
 COPY packages/logger/package.json ./packages/logger/package.json
+COPY packages/security/package.json ./packages/security/package.json
 COPY packages/tsconfig/package.json ./packages/tsconfig/package.json
 COPY packages/utils/package.json ./packages/utils/package.json
 
@@ -52,6 +53,9 @@ COPY --chown=nextjs:nodejs packages/utils ./packages/utils
 # Copy logger package (needed by @sim/db's tx-tripwire at import time)
 COPY --chown=nextjs:nodejs packages/logger ./packages/logger
 
+# Copy security package (the schema's sealed columns import its encryption)
+COPY --chown=nextjs:nodejs packages/security ./packages/security
+
 # Copy database package source code (changes most frequently - placed last)
 COPY --chown=nextjs:nodejs packages/db ./packages/db
 

docker/db.Dockerfile

@@ -76,6 +76,7 @@
     "check:spec-example-ids": "bun run scripts/check-spec-example-ids.ts",
     "check:script-tests": "bun run scripts/check-script-test-coverage.ts",
     "check:test-patterns": "bun run scripts/check-test-patterns.ts",
+    "check:sealed-columns": "bun run scripts/check-sealed-columns.ts",
     "check:schema-mock": "bun run scripts/generate-schema-mock.ts --check",
     "check:audits": "bun run scripts/run-audits.ts",
     "check:skills": "bun run scripts/sync-skills.ts --check",