improvement(auth): bind sealed tokens to their column and guard the backfill key

Author: waleedlatif1

apps/sim/instrumentation-node.ts

@@ -378,6 +378,9 @@ export async function register() {
 
   await initializeOpenTelemetry()
 
+  const { reportAccountTokenSealing } = await import('@sim/db/sealed-text')
+  reportAccountTokenSealing()
+
   const shutdownPostHog = async () => {
     try {
       const { getPostHogClient } = await import('@/lib/posthog/server')

apps/sim/lib/core/config/env.ts

@@ -142,7 +142,7 @@ export const env = createEnv({
     TURNSTILE_SECRET_KEY:                  z.string().min(1).optional(),           // Cloudflare Turnstile secret key for captcha verification
     ENCRYPTION_KEY:                        z.string().min(32),                     // Key for encrypting sensitive data
     API_ENCRYPTION_KEY:                    z.string().min(32).optional(),          // Dedicated key for encrypting API keys (optional for OSS)
-    ENCRYPT_ACCOUNT_TOKENS:                z.boolean().optional(),                 // Seal OAuth access/refresh tokens with ENCRYPTION_KEY on write (read by @sim/db). Enable only once every app, worker, and background-task deployment runs a release that reads sealed tokens
+    ENCRYPT_ACCOUNT_TOKENS:                z.boolean().optional(),                 // Seal OAuth access/refresh tokens on write (read by @sim/db); takes effect only with a 64-hex ENCRYPTION_KEY. Enable only once every app, worker, and background-task deployment runs a release that reads sealed tokens
     INTERNAL_API_SECRET:                   z.string().min(32),                     // Secret for internal API authentication
     INTERNAL_JWT_SECRET:                   z.string().min(32).optional(),          // Dedicated signing key for internal JWTs (falls back to INTERNAL_API_SECRET); separating limits blast radius if one leaks
 

apps/sim/lib/oauth/credential-revocation.integration.ts

@@ -36,6 +36,7 @@ import { fanOutSlackTokenChain } from '@/lib/oauth/slack'
 import { completeOAuthCredentialToken } from '@/lib/oauth/token-resolution'
 
 const originalFetch = globalThis.fetch
+const fixtureEncryptionKey = process.env.ENCRYPTION_KEY
 const userId = generateId()
 const workspaceId = generateId()
 const accountId = generateId()
@@ -189,6 +190,7 @@ beforeEach(async () => {
 
 afterEach((context) => {
   sealWrites(false)
+  process.env.ENCRYPTION_KEY = fixtureEncryptionKey
   pausedProvider?.release.resolve()
   checks.push({
     name: context.task.name,
@@ -488,6 +490,15 @@ describe('OAuth refresh chains with sealed account tokens', () => {
     })
   })
 
+  it('keeps writing readable tokens when sealing is requested without a usable key', async () => {
+    sealWrites(true)
+    process.env.ENCRYPTION_KEY = 'not-hex'.repeat(6)
+    providerAnswer = REFRESHED
+
+    await expect(resolveToken()).resolves.toEqual({ accessToken: 'fresh-access', refreshed: true })
+    expect(await rawTokens()).toMatchObject({ access_token: 'fresh-access' })
+  })
+
   it('rotates a chain stored before sealing was enabled', async () => {
     sealWrites(true)
     providerAnswer = REFRESHED

apps/sim/lib/oauth/credential-service.test.ts

@@ -86,6 +86,11 @@ const serviceLogger = getMockLogger('OAuthCredentialService')
 const transportLogger = getMockLogger('GoogleServiceAccountTransport')
 const mocks = { ...hoisted, decryptSecret: encryptionMockFns.mockDecryptSecret }
 
+beforeEach(() => {
+  // Schema mocks carry no table to seal against; credential-revocation.integration.ts covers sealing.
+  vi.stubEnv('ENCRYPTION_KEY', '')
+})
+
 /** Every call the credential service and its token transport logged at the given levels. */
 function loggedCalls(...levels: Array<'info' | 'warn' | 'error'>) {
   return levels.flatMap((level) => [

apps/sim/trigger.config.ts

@@ -133,6 +133,8 @@ export default defineConfig({
       createLogger('TriggerInit').error('Could not distrust compromised CA roots', tlsTrust)
     }
     markInsideTriggerRun()
+    const { reportAccountTokenSealing } = await import('@sim/db/sealed-text')
+    reportAccountTokenSealing()
     const { warmRedisConnection } = await import('./lib/core/config/redis')
     await warmRedisConnection()
   },

package.json

@@ -76,6 +76,7 @@
     "check:spec-example-ids": "bun run scripts/check-spec-example-ids.ts",
     "check:script-tests": "bun run scripts/check-script-test-coverage.ts",
     "check:test-patterns": "bun run scripts/check-test-patterns.ts",
+    "check:sealed-columns": "bun run scripts/check-sealed-columns.ts",
     "check:schema-mock": "bun run scripts/generate-schema-mock.ts --check",
     "check:audits": "bun run scripts/run-audits.ts",
     "check:skills": "bun run scripts/sync-skills.ts --check",

packages/db/schema.ts

@@ -177,8 +177,8 @@ export const account = pgTable(
     userId: text('user_id')
       .notNull()
       .references(() => user.id, { onDelete: 'cascade' }),
-    accessToken: sealedText('access_token'),
-    refreshToken: sealedText('refresh_token'),
+    accessToken: sealedText('account', 'access_token'),
+    refreshToken: sealedText('account', 'refresh_token'),
     idToken: text('id_token'),
     accessTokenExpiresAt: timestamp('access_token_expires_at'),
     refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),

packages/db/script-migrations/0037_seal_account_tokens.integration.ts

@@ -1,11 +1,16 @@
 import { sealAccountTokens } from '@sim/db/script-migrations/0037_seal_account_tokens'
 import { openText } from '@sim/db/sealed-text'
 import { readTestDatabaseUrl } from '@sim/db/testing/test-infrastructure'
+import { seal, sealingKeyId } from '@sim/security/encryption'
 import { generateId } from '@sim/utils/id'
 import postgres, { type Sql } from 'postgres'
 import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'vitest'
 
 const databaseUrl = readTestDatabaseUrl()
+const KEY_HEX = 'a'.repeat(64)
+const KEY_ID = sealingKeyId(Buffer.from(KEY_HEX, 'hex'))
+const ACCESS_CONTEXT = 'account.access_token'
+const REFRESH_CONTEXT = 'account.refresh_token'
 
 interface StoredRow {
   id: string
@@ -22,7 +27,7 @@ describe('sealing stored account tokens in PostgreSQL', () => {
   const previousKey = process.env.ENCRYPTION_KEY
 
   beforeAll(async () => {
-    process.env.ENCRYPTION_KEY = 'a'.repeat(64)
+    process.env.ENCRYPTION_KEY = KEY_HEX
     admin = postgres(databaseUrl, { max: 1, onnotice: () => undefined })
     await admin.unsafe(`CREATE SCHEMA "${schemaName}"`)
     await admin.unsafe(
@@ -69,37 +74,55 @@ describe('sealing stored account tokens in PostgreSQL', () => {
     const accessOnly = await insertAccount('access-only', null)
     const before = await storedRows()
 
-    expect(await sealAccountTokens(sql, { mode: 'seal', batchSize: 2, pauseMs: 0 })).toEqual({
+    expect(
+      await sealAccountTokens(sql, {
+        mode: 'seal',
+        expectedKeyId: KEY_ID,
+        batchSize: 2,
+        pauseMs: 0,
+      })
+    ).toEqual({
+      keyId: KEY_ID,
       scanned: 6,
       pending: 6,
       updated: 6,
+      foreignKey: 0,
     })
 
     const after = await storedRows()
     for (const row of after) {
       const original = before.find((candidate) => candidate.id === row.id)
       expect(row.updated_at).toBe(original?.updated_at)
       expect(row.access_token).toMatch(/^enc:v1:/)
-      expect(openText(row.access_token ?? '')).toBe(original?.access_token)
+      expect(openText(row.access_token ?? '', ACCESS_CONTEXT)).toBe(original?.access_token)
       if (row.id === accessOnly) {
         expect(row.refresh_token).toBeNull()
       } else {
         expect(row.refresh_token).toMatch(/^enc:v1:/)
-        expect(openText(row.refresh_token ?? '')).toBe(original?.refresh_token)
+        expect(openText(row.refresh_token ?? '', REFRESH_CONTEXT)).toBe(original?.refresh_token)
       }
     }
   })
 
   it('finds nothing left to do on a rerun or a dry run after a completed pass', async () => {
     await insertAccount('access', 'refresh')
-    await sealAccountTokens(sql, { mode: 'seal', pauseMs: 0 })
+    await sealAccountTokens(sql, { mode: 'seal', expectedKeyId: KEY_ID, pauseMs: 0 })
     const sealed = await storedRows()
 
-    expect(await sealAccountTokens(sql, { mode: 'seal', pauseMs: 0 })).toMatchObject({
+    expect(
+      await sealAccountTokens(sql, { mode: 'seal', expectedKeyId: KEY_ID, pauseMs: 0 })
+    ).toMatchObject({
       pending: 0,
       updated: 0,
     })
-    expect(await sealAccountTokens(sql, { mode: 'seal', dryRun: true, pauseMs: 0 })).toMatchObject({
+    expect(
+      await sealAccountTokens(sql, {
+        mode: 'seal',
+        expectedKeyId: KEY_ID,
+        dryRun: true,
+        pauseMs: 0,
+      })
+    ).toMatchObject({
       pending: 0,
     })
     expect(await storedRows()).toEqual(sealed)
@@ -109,10 +132,19 @@ describe('sealing stored account tokens in PostgreSQL', () => {
     await insertAccount('access', 'refresh')
     const before = await storedRows()
 
-    expect(await sealAccountTokens(sql, { mode: 'seal', dryRun: true, pauseMs: 0 })).toEqual({
+    expect(
+      await sealAccountTokens(sql, {
+        mode: 'seal',
+        expectedKeyId: KEY_ID,
+        dryRun: true,
+        pauseMs: 0,
+      })
+    ).toEqual({
+      keyId: KEY_ID,
       scanned: 1,
       pending: 1,
       updated: 0,
+      foreignKey: 0,
     })
     expect(await storedRows()).toEqual(before)
   })
@@ -121,11 +153,47 @@ describe('sealing stored account tokens in PostgreSQL', () => {
     await insertAccount('ya29.access:with:colons', 'refresh')
     await insertAccount(null, 'refresh-only')
     const plaintext = await storedRows()
-    await sealAccountTokens(sql, { mode: 'seal', pauseMs: 0 })
+    await sealAccountTokens(sql, { mode: 'seal', expectedKeyId: KEY_ID, pauseMs: 0 })
 
-    expect(await sealAccountTokens(sql, { mode: 'unseal', pauseMs: 0 })).toMatchObject({
+    expect(
+      await sealAccountTokens(sql, { mode: 'unseal', expectedKeyId: KEY_ID, pauseMs: 0 })
+    ).toMatchObject({
       updated: 2,
     })
     expect(await storedRows()).toEqual(plaintext)
   })
+
+  it('refuses to start under a key the fleet does not use, before touching any row', async () => {
+    await insertAccount('access', 'refresh')
+    const before = await storedRows()
+
+    for (const dryRun of [false, true]) {
+      await expect(
+        sealAccountTokens(sql, { mode: 'seal', expectedKeyId: 'ffffffff', dryRun, pauseMs: 0 })
+      ).rejects.toThrow(KEY_ID)
+    }
+    await expect(sealAccountTokens(sql, { mode: 'seal', pauseMs: 0 })).rejects.toThrow()
+    expect(await storedRows()).toEqual(before)
+  })
+
+  it('skips and reports rows sealed under another key instead of failing the pass', async () => {
+    const otherKey = Buffer.from('b'.repeat(64), 'hex')
+    const foreignAccess = seal('foreign-access', otherKey, ACCESS_CONTEXT)
+    const foreign = await insertAccount(foreignAccess, 'foreign-refresh')
+    await insertAccount('own-access', 'own-refresh')
+    await sealAccountTokens(sql, { mode: 'seal', expectedKeyId: KEY_ID, pauseMs: 0 })
+
+    expect(
+      await sealAccountTokens(sql, { mode: 'unseal', expectedKeyId: KEY_ID, pauseMs: 0 })
+    ).toMatchObject({ scanned: 2, updated: 1, foreignKey: 1 })
+    const rows = await storedRows()
+    expect(rows.find((row) => row.id === foreign)).toMatchObject({
+      access_token: foreignAccess,
+      refresh_token: 'foreign-refresh',
+    })
+    expect(rows.find((row) => row.id !== foreign)).toMatchObject({
+      access_token: 'own-access',
+      refresh_token: 'own-refresh',
+    })
+  })
 })

packages/db/script-migrations/0037_seal_account_tokens.ts

@@ -1,12 +1,20 @@
-import { openText, sealText } from '@sim/db/sealed-text'
+import { account } from '@sim/db/schema'
+import { openText, readEncryptionKey, sealedTextContext, sealText } from '@sim/db/sealed-text'
 import { createLogger } from '@sim/logger'
+import { sealedKeyId, sealingKeyId } from '@sim/security/encryption'
 import { sleep } from '@sim/utils/helpers'
 import type { Sql } from 'postgres'
 
-const logger = createLogger('AccountTokenSealing')
+const logger = createLogger('AccountTokenSealing', { enabled: true, logLevel: 'INFO' })
 
 interface AccountTokenSealingOptions {
   mode: 'seal' | 'unseal'
+  /**
+   * The id the fleet logs at startup (`Account token sealing`). A pass refuses to start under any
+   * other `ENCRYPTION_KEY`, so it can never seal rows with a key the fleet cannot open. Optional
+   * only for a dry run.
+   */
+  expectedKeyId?: string
   /** Counts the rows that would change without writing any. */
   dryRun?: boolean
   batchSize?: number
@@ -15,9 +23,12 @@ interface AccountTokenSealingOptions {
 }
 
 interface AccountTokenSealingResult {
+  keyId: string
   scanned: number
   pending: number
   updated: number
+  /** Rows left untouched because a token is sealed under another key. */
+  foreignKey: number
 }
 
 interface StoredTokens {
@@ -26,20 +37,46 @@ interface StoredTokens {
   refresh_token: string | null
 }
 
+const ACCESS_TOKEN_CONTEXT = sealedTextContext(account.accessToken)
+const REFRESH_TOKEN_CONTEXT = sealedTextContext(account.refreshToken)
+
 /**
  * Rewrites `account.access_token` and `account.refresh_token` into the sealed form (`seal`) or back
  * to plaintext (`unseal`, the rollback). Idempotent and resumable: a value already in the target
  * form is skipped, so a rerun only finishes what an interrupted run left. Each row is rewritten only
  * while it still holds the value this pass read, so a refresh that rotates the chain concurrently
- * wins, and `updated_at` is left alone because the refresh path reads it as the chain version.
+ * wins, and `updated_at` is left alone because the refresh path reads it as the chain version. Rows
+ * sealed under another key are skipped and counted rather than failing the pass.
  */
 export async function sealAccountTokens(
   sql: Sql,
-  { mode, dryRun = false, batchSize = 200, pauseMs = 100 }: AccountTokenSealingOptions
+  {
+    mode,
+    expectedKeyId,
+    dryRun = false,
+    batchSize = 200,
+    pauseMs = 100,
+  }: AccountTokenSealingOptions
 ): Promise<AccountTokenSealingResult> {
-  const convert = (value: string | null) =>
-    value === null ? null : mode === 'seal' ? sealText(value) : openText(value)
-  const result: AccountTokenSealingResult = { scanned: 0, pending: 0, updated: 0 }
+  const keyId = sealingKeyId(readEncryptionKey())
+  if ((!dryRun || expectedKeyId !== undefined) && expectedKeyId !== keyId) {
+    throw new Error(
+      `ENCRYPTION_KEY has key id ${keyId}, not the expected ${expectedKeyId ?? '(none)'}`
+    )
+  }
+  const isForeign = (value: string | null) => {
+    const sealedUnder = value === null ? null : sealedKeyId(value)
+    return sealedUnder !== null && sealedUnder !== keyId
+  }
+  const convert = (value: string | null, context: string) =>
+    value === null ? null : mode === 'seal' ? sealText(value, context) : openText(value, context)
+  const result: AccountTokenSealingResult = {
+    keyId,
+    scanned: 0,
+    pending: 0,
+    updated: 0,
+    foreignKey: 0,
+  }
   let afterId = ''
 
   for (;;) {
@@ -52,11 +89,15 @@ export async function sealAccountTokens(
     afterId = rows[rows.length - 1].id
     result.scanned += rows.length
 
-    const changes = rows
+    const ownRows = rows.filter(
+      (row) => !isForeign(row.access_token) && !isForeign(row.refresh_token)
+    )
+    result.foreignKey += rows.length - ownRows.length
+    const changes = ownRows
       .map((row) => ({
         row,
-        accessToken: convert(row.access_token),
-        refreshToken: convert(row.refresh_token),
+        accessToken: convert(row.access_token, ACCESS_TOKEN_CONTEXT),
+        refreshToken: convert(row.refresh_token, REFRESH_TOKEN_CONTEXT),
       }))
       .filter(
         ({ row, accessToken, refreshToken }) =>