fix(db): reject seal-account-tokens payloads without a boolean dryRun

Author: waleedlatif1

apps/sim/background/seal-account-tokens.test.ts

@@ -3,16 +3,19 @@
  */
 
 import { sealingKeyId } from '@sim/security/encryption'
-import { databaseMockFns } from '@sim/testing'
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { databaseMockFns } from '@sim/testing/mocks/database.mock'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { mockPostgres } = vi.hoisted(() => ({ mockPostgres: vi.fn() }))
 
 vi.mock('postgres', () => ({ default: mockPostgres }))
 /** The pass derives each column's sealing context from the real column definitions. */
 vi.unmock('@sim/db/schema')
 
-import { runSealAccountTokens } from '@/background/seal-account-tokens'
+import {
+  runSealAccountTokens,
+  type SealAccountTokensPayload,
+} from '@/background/seal-account-tokens'
 
 const ENCRYPTION_KEY = 'ab'.repeat(32)
 const WORKER_KEY_ID = sealingKeyId(Buffer.from(ENCRYPTION_KEY, 'hex'))
@@ -31,17 +34,20 @@ describe('runSealAccountTokens', () => {
     mockPostgres.mockImplementation(emptyAccountTable)
   })
 
-  afterEach(() => {
-    vi.unstubAllEnvs()
-  })
-
   it('refuses a real seal under a key id other than the worker’s, before connecting', async () => {
     await expect(
       runSealAccountTokens({ mode: 'seal', dryRun: false, expectedKeyId: 'deadbeef' })
     ).rejects.toThrow(`ENCRYPTION_KEY has key id ${WORKER_KEY_ID}, not the expected deadbeef`)
     expect(mockPostgres).not.toHaveBeenCalled()
   })
 
+  it('refuses a payload without dryRun instead of treating it as a real run', async () => {
+    const payload = { mode: 'seal', expectedKeyId: WORKER_KEY_ID } as SealAccountTokensPayload
+
+    await expect(runSealAccountTokens(payload)).rejects.toThrow('dryRun must be a boolean')
+    expect(mockPostgres).not.toHaveBeenCalled()
+  })
+
   it('refuses to seal while this worker writes plaintext tokens, before connecting', async () => {
     vi.stubEnv('ENCRYPT_ACCOUNT_TOKENS', 'false')
 

apps/sim/background/seal-account-tokens.ts

@@ -41,6 +41,8 @@ function assertIntegerInRange(name: string, value: number | undefined, min: numb
 export async function runSealAccountTokens(payload: SealAccountTokensPayload) {
   const { mode, dryRun, expectedKeyId, batchSize, pauseMs } = payload
   if (mode !== 'seal' && mode !== 'unseal') throw new Error(`Unknown mode ${String(mode)}`)
+  if (typeof dryRun !== 'boolean') throw new Error('dryRun must be a boolean')
+  if (typeof expectedKeyId !== 'string') throw new Error('expectedKeyId must be a string')
   assertIntegerInRange('batchSize', batchSize, 1, MAX_BATCH_SIZE)
   assertIntegerInRange('pauseMs', pauseMs, 0, MAX_PAUSE_MS)