Function encryptOAuthToken

packages/shared/src/crypto.ts:171–197

(text: string | null | undefined)

 * Encrypts OAuth token using AUTH_SECRET. Idempotent - returns token unchanged if already encrypted.
 */
export function encryptOAuthToken(text: string | null | undefined): string | undefined {
    if (!text) {
        return undefined;
    }

    if (isOAuthTokenEncrypted(text)) {
        return text;
    }

    const iv = crypto.randomBytes(oauthIvLength);
    const salt = crypto.randomBytes(oauthSaltLength);
    const key = deriveOAuthKey(env.AUTH_SECRET, salt);

    const cipher = crypto.createCipheriv(oauthAlgorithm, key, iv);
    const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
    const tag = cipher.getAuthTag();

    const tokenData: EncryptedOAuthToken = {
        v: 1,
        salt: salt.toString('hex'),
        iv: iv.toString('hex'),
        tag: tag.toString('hex'),
        data: encrypted.toString('hex'),
    };

    return Buffer.from(JSON.stringify(tokenData)).toString('base64');
}

/**
 * Decrypts OAuth token using AUTH_SECRET. Returns plaintext tokens unchanged during migration.