Function decryptOAuthToken

packages/shared/src/crypto.ts:202–229

(encryptedText: string | null | undefined)

 * Decrypts OAuth token using AUTH_SECRET. Returns plaintext tokens unchanged during migration.
 */
export function decryptOAuthToken(encryptedText: string | null | undefined): string | undefined {
    if (!encryptedText) {
        return undefined;
    }

    if (!isOAuthTokenEncrypted(encryptedText)) {
        return encryptedText;
    }

    try {
        const decoded = Buffer.from(encryptedText, 'base64').toString('utf8');
        const tokenData = encryptedOAuthTokenSchema.parse(JSON.parse(decoded));

        const salt = Buffer.from(tokenData.salt, 'hex');
        const iv = Buffer.from(tokenData.iv, 'hex');
        const tag = Buffer.from(tokenData.tag, 'hex');
        const encrypted = Buffer.from(tokenData.data, 'hex');

        const key = deriveOAuthKey(env.AUTH_SECRET, salt);
        const decipher = crypto.createDecipheriv(oauthAlgorithm, key, iv);
        decipher.setAuthTag(tag);

        return decipher.update(encrypted, undefined, 'utf8') + decipher.final('utf8');
    } catch {
        // Decryption failed - likely a plaintext token, return as-is
        return encryptedText;
    }
}

export function encryptActivationCode(code: string): string {
    const { iv, encryptedData } = encrypt(code);