fix(sso): mark encrypted provider secrets with an explicit prefix

Detecting ciphertext by its iv:ciphertext:authTag shape was ambiguous: a client secret is an arbitrary string chosen at the identity provider, so one shaped like an envelope would have been read back as ciphertext and broken that provider. Encrypted values now carry a versioned prefix. The providers list also lets a decryption failure surface instead of reporting the provider as having no config, and the helper moved next to the adapter that uses it.

Author: waleedlatif1

apps/sim/app/api/auth/sso/providers/route.test.ts

@@ -28,7 +28,7 @@ import { GET } from '@/app/api/auth/sso/providers/route'
 
 const IV = 'a'.repeat(32)
 const TAG = 'b'.repeat(32)
-const sealed = (secret: string) => `${IV}:${Buffer.from(secret).toString('hex')}:${TAG}`
+const sealed = (secret: string) => `sim.sso.v1:${IV}:${Buffer.from(secret).toString('hex')}:${TAG}`
 
 const CLIENT_SECRET = 'a-long-client-secret-wxyz'
 
@@ -94,6 +94,16 @@ describe('GET /api/auth/sso/providers', () => {
     expect(mockDecryptSecret).not.toHaveBeenCalled()
   })
 
+  it('fails the request when a stored secret cannot be decrypted', async () => {
+    mockDecryptSecret.mockRejectedValue(new Error('auth tag mismatch'))
+    queueTableRows(schemaMock.ssoProvider, [providerRow])
+
+    const res = await GET(createMockRequest('GET'))
+
+    /** Reporting a key problem as a provider with no config would hide it behind a 200. */
+    expect(res.status).toBe(500)
+  })
+
   it('redacts SAML key material and keeps the certificate', async () => {
     queueTableRows(schemaMock.ssoProvider, [
       {

apps/sim/app/api/auth/sso/providers/route.ts

@@ -11,7 +11,7 @@ import { listSsoProvidersContract } from '@/lib/api/contracts/auth'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { markSignInProviders } from '@/lib/auth/sso/primary-provider'
-import { decryptProviderConfig } from '@/lib/auth/sso/provider-secrets'
+import { decryptProviderConfig } from '@/lib/auth/sso-provider-secrets'
 import { REDACTED_MARKER } from '@/lib/core/security/redaction'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
@@ -40,8 +40,14 @@ function buildClientSecretHint(clientSecret: unknown): string | null {
  */
 async function redactOidcConfig(oidcConfig: string | null): Promise<string | null> {
   if (!oidcConfig) return oidcConfig
+  /**
+   * Outside the catch: a config that will not decrypt is a key problem, and
+   * reporting it as a provider with no config would hide it behind a healthy
+   * 200. Unreadable JSON stays tolerated below, as it was before.
+   */
+  const decrypted = await decryptProviderConfig(oidcConfig, 'oidcConfig')
   try {
-    const parsed = JSON.parse((await decryptProviderConfig(oidcConfig, 'oidcConfig')) as string)
+    const parsed = JSON.parse(decrypted as string)
     const hint = buildClientSecretHint(parsed.clientSecret)
     parsed.clientSecret = REDACTED_MARKER
     if (hint) parsed.clientSecretHint = hint

apps/sim/app/api/auth/sso/register/route.test.ts

@@ -305,7 +305,7 @@ describe('POST /api/auth/sso/register', () => {
    * directly rather than through Better Auth, so it decrypts it itself.
    */
   it('reuses the stored client secret, decrypting it first', async () => {
-    const sealed = `${'a'.repeat(32)}:${Buffer.from('stored-secret').toString('hex')}:${'b'.repeat(32)}`
+    const sealed = `sim.sso.v1:${'a'.repeat(32)}:${Buffer.from('stored-secret').toString('hex')}:${'b'.repeat(32)}`
     queueMembers([{ organizationId: 'org1', role: 'owner' }])
     // In route order: providerId conflict and domain refusal, the reuse read,
     // both checks again before the write, then the pre-image being updated.

apps/sim/app/api/auth/sso/register/route.ts

@@ -8,8 +8,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { ssoRegistrationContract } from '@/lib/api/contracts/auth'
 import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { auth, getSession } from '@/lib/auth'
-import { decryptProviderConfig } from '@/lib/auth/sso/provider-secrets'
 import { invalidateSsoPolicyCache } from '@/lib/auth/sso-policy'
+import { decryptProviderConfig } from '@/lib/auth/sso-provider-secrets'
 import { hasSSOAccess } from '@/lib/billing'
 import { isSsoEnabled } from '@/lib/core/config/env-flags'
 import { runWithOutboundOrganization } from '@/lib/core/network/context.server'

apps/sim/lib/auth/sso-provider-secret-adapter.postgres.test.ts

@@ -89,7 +89,7 @@ describe.skipIf(!databaseUrl)('SSO provider secrets in PostgreSQL', () => {
 
     const atRest = JSON.parse(await storedConfig(providerId))
     expect(atRest.clientSecret).not.toBe(CLIENT_SECRET)
-    expect(atRest.clientSecret).toMatch(/^[0-9a-f]{32}:[0-9a-f]+:[0-9a-f]{32}$/)
+    expect(atRest.clientSecret).toMatch(/^sim\.sso\.v1:[0-9a-f]{32}:[0-9a-f]+:[0-9a-f]{32}$/)
     expect(atRest.clientId).toBe('client')
 
     const loaded = await adapter.findOne<{ oidcConfig: string }>({
@@ -127,7 +127,7 @@ describe.skipIf(!databaseUrl)('SSO provider secrets in PostgreSQL', () => {
 
     expect(JSON.parse(updated!.oidcConfig).clientSecret).toBe(CLIENT_SECRET)
     const atRest = JSON.parse(await storedConfig(providerId))
-    expect(atRest.clientSecret).toMatch(/^[0-9a-f]{32}:[0-9a-f]+:[0-9a-f]{32}$/)
+    expect(atRest.clientSecret).toMatch(/^sim\.sso\.v1:[0-9a-f]{32}:[0-9a-f]+:[0-9a-f]{32}$/)
   })
 
   it('reads a row written before the secret was encrypted', async () => {

apps/sim/lib/auth/sso-provider-secret-adapter.test.ts

@@ -18,7 +18,9 @@ import { encryptSsoProviderSecrets } from '@/lib/auth/sso-provider-secret-adapte
 
 const IV = 'a'.repeat(32)
 const TAG = 'b'.repeat(32)
-const sealed = (secret: string) => `${IV}:${Buffer.from(secret).toString('hex')}:${TAG}`
+/** What `encryptSecret` returns; `provider-secrets` adds the prefix around it. */
+const raw = (secret: string) => `${IV}:${Buffer.from(secret).toString('hex')}:${TAG}`
+const sealed = (secret: string) => `sim.sso.v1:${raw(secret)}`
 
 const PLAIN_OIDC = JSON.stringify({ clientId: 'client', clientSecret: 'super-secret' })
 const SEALED_OIDC = JSON.stringify({ clientId: 'client', clientSecret: sealed('super-secret') })
@@ -44,7 +46,7 @@ const asAdapter = (adapter: ReturnType<typeof createBaseAdapter>) =>
 describe('encryptSsoProviderSecrets', () => {
   beforeEach(() => {
     vi.clearAllMocks()
-    mockEncryptSecret.mockImplementation(async (secret: string) => ({ encrypted: sealed(secret) }))
+    mockEncryptSecret.mockImplementation(async (secret: string) => ({ encrypted: raw(secret) }))
     mockDecryptSecret.mockImplementation(async (value: string) => ({
       decrypted: Buffer.from(value.split(':')[1], 'hex').toString('utf8'),
     }))

apps/sim/lib/auth/sso-provider-secret-adapter.ts

@@ -3,7 +3,7 @@ import {
   decryptProviderConfig,
   encryptProviderConfig,
   type SsoConfigColumn,
-} from '@/lib/auth/sso/provider-secrets'
+} from '@/lib/auth/sso-provider-secrets'
 
 type BetterAuthAdapter = ReturnType<ReturnType<typeof drizzleAdapter>>
 

…im/lib/auth/sso/provider-secrets.test.ts …im/lib/auth/sso-provider-secrets.test.tsapps/sim/lib/auth/sso/provider-secrets.test.ts renamed to apps/sim/lib/auth/sso-provider-secrets.test.ts apps/sim/lib/auth/sso/provider-secrets.test.ts renamed to apps/sim/lib/auth/sso-provider-secrets.test.ts

@@ -14,17 +14,19 @@ vi.mock('@/lib/core/security/encryption', () => ({
   decryptSecret: mockDecryptSecret,
 }))
 
-import { decryptProviderConfig, encryptProviderConfig } from '@/lib/auth/sso/provider-secrets'
+import { decryptProviderConfig, encryptProviderConfig } from '@/lib/auth/sso-provider-secrets'
 
 const IV = 'a'.repeat(32)
 const TAG = 'b'.repeat(32)
-const envelope = (ciphertext: string) => `${IV}:${ciphertext}:${TAG}`
+/** What `encryptSecret` returns; the module under test adds the prefix. */
+const raw = (ciphertext: string) => `${IV}:${ciphertext}:${TAG}`
+const envelope = (ciphertext: string) => `sim.sso.v1:${raw(ciphertext)}`
 
 describe('provider secrets', () => {
   beforeEach(() => {
     vi.clearAllMocks()
     mockEncryptSecret.mockImplementation(async (secret: string) => ({
-      encrypted: envelope(Buffer.from(secret).toString('hex')),
+      encrypted: raw(Buffer.from(secret).toString('hex')),
     }))
     mockDecryptSecret.mockImplementation(async (value: string) => ({
       decrypted: Buffer.from(value.split(':')[1], 'hex').toString('utf8'),
@@ -74,6 +76,20 @@ describe('provider secrets', () => {
     expect(mockDecryptSecret).not.toHaveBeenCalled()
   })
 
+  it('treats a legacy secret shaped like an envelope as plain text', async () => {
+    /** A client secret is chosen at the identity provider and can be any string. */
+    const lookalike = `${'a'.repeat(32)}:${'c'.repeat(16)}:${'b'.repeat(32)}`
+    const legacy = JSON.stringify({ clientSecret: lookalike })
+
+    await expect(decryptProviderConfig(legacy, 'oidcConfig')).resolves.toBe(legacy)
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+
+    const stored = await encryptProviderConfig(legacy, 'oidcConfig')
+    expect(JSON.parse(stored as string).clientSecret).toBe(
+      envelope(Buffer.from(lookalike).toString('hex'))
+    )
+  })
+
   it('does not encrypt a value that is already encrypted', async () => {
     const stored = JSON.stringify({ clientSecret: envelope('deadbeef') })
 

apps/sim/lib/auth/sso/provider-secrets.ts apps/sim/lib/auth/sso-provider-secrets.tsapps/sim/lib/auth/sso/provider-secrets.ts renamed to apps/sim/lib/auth/sso-provider-secrets.ts

@@ -18,15 +18,20 @@ const SECRET_FIELDS = {
 export type SsoConfigColumn = keyof typeof SECRET_FIELDS
 
 /**
- * The shape {@link encryptSecret} produces: a 16-byte IV and a 16-byte GCM auth
- * tag around hex ciphertext. Matching it exactly is what lets a value written
- * before these fields were encrypted be recognized as legacy plain text and
- * returned unchanged — the same tolerance `decryptApiKey` gives API keys.
+ * Marks a value this module encrypted. An explicit prefix, rather than matching
+ * the `iv:ciphertext:authTag` shape, is what makes the distinction unambiguous:
+ * a client secret is an arbitrary string chosen at the identity provider, and
+ * one that happened to look like an envelope would otherwise be read back as
+ * ciphertext and fail to decrypt. Values without the prefix were stored before
+ * these fields were encrypted and are passed through unchanged, the tolerance
+ * `decryptApiKey` gives API keys.
+ *
+ * The version lets a future encoding change be told apart from this one.
  */
-const ENVELOPE = /^[0-9a-f]{32}:[0-9a-f]+:[0-9a-f]{32}$/
+const ENVELOPE_PREFIX = 'sim.sso.v1:'
 
 function isEnvelope(value: string): boolean {
-  return ENVELOPE.test(value)
+  return value.startsWith(ENVELOPE_PREFIX)
 }
 
 function parseConfig(config: string): Record<string, unknown> | null {
@@ -79,13 +84,13 @@ export function encryptProviderConfig(
   column: SsoConfigColumn
 ): Promise<string | null | undefined> {
   return mapSecretFields(config, column, async (value) =>
-    isEnvelope(value) ? value : (await encryptSecret(value)).encrypted
+    isEnvelope(value) ? value : `${ENVELOPE_PREFIX}${(await encryptSecret(value)).encrypted}`
   )
 }
 
 /**
  * Decrypts the secret fields of a stored provider config. Values written before
- * these fields were encrypted lack the envelope shape and are returned as-is.
+ * these fields were encrypted lack the prefix and are returned as-is.
  *
  * A value that IS an envelope but fails to decrypt — a wrong or rotated
  * `ENCRYPTION_KEY`, a tampered row — throws rather than degrading to ciphertext.
@@ -99,7 +104,8 @@ export function decryptProviderConfig(
   return mapSecretFields(config, column, async (value) => {
     if (!isEnvelope(value)) return value
     try {
-      return (await decryptSecret(value, { logFailure: false })).decrypted
+      return (await decryptSecret(value.slice(ENVELOPE_PREFIX.length), { logFailure: false }))
+        .decrypted
     } catch (error) {
       logger.error('Failed to decrypt an SSO provider secret', {
         column,

packages/db/scripts/register-sso-provider.ts

@@ -161,21 +161,26 @@ if (!ENCRYPTION_KEY || !/^[0-9a-f]{64}$/i.test(ENCRYPTION_KEY)) {
 const ENCRYPTION_KEY_BUFFER = Buffer.from(ENCRYPTION_KEY, 'hex')
 
 /**
- * AES-256-GCM in the `iv:ciphertext:authTag` envelope the app reads back. This
+ * AES-256-GCM in the prefixed envelope the app reads back — the prefix is what
+ * marks a value as encrypted, so a secret that merely looks like one is not
+ * mistaken for it. Keep it in step with `ENVELOPE_PREFIX` in
+ * `apps/sim/lib/auth/sso/provider-secrets.ts`. This
  * package cannot import from `apps/*`, so the primitive is repeated here rather
  * than shared; {@link assertCryptoRoundTrip} proves the key produces a readable
  * value before any row is written.
  */
+const ENVELOPE_PREFIX = 'sim.sso.v1:'
+
 function encryptSecretValue(secret: string): string {
   const iv = randomBytes(16)
   const cipher = createCipheriv('aes-256-gcm', ENCRYPTION_KEY_BUFFER, iv, { authTagLength: 16 })
   let encrypted = cipher.update(secret, 'utf8', 'hex')
   encrypted += cipher.final('hex')
-  return `${iv.toString('hex')}:${encrypted}:${cipher.getAuthTag().toString('hex')}`
+  return `${ENVELOPE_PREFIX}${iv.toString('hex')}:${encrypted}:${cipher.getAuthTag().toString('hex')}`
 }
 
 function decryptSecretValue(envelope: string): string {
-  const [ivHex, ciphertext, authTagHex] = envelope.split(':')
+  const [ivHex, ciphertext, authTagHex] = envelope.slice(ENVELOPE_PREFIX.length).split(':')
   const decipher = createDecipheriv(
     'aes-256-gcm',
     ENCRYPTION_KEY_BUFFER,