bug: OAuth access tokens stored as plaintext due to missing encryption utility usage

[Ridanshi]

Bug Report

Summary

GitHub OAuth access tokens are currently being persisted unencrypted in the database.

Additionally, the GitHub connect flow crashes at runtime due to a call to a non-existent encryption decorator.

Root Cause

utils/encryption.ts exports standalone encrypt and decrypt utilities, but the application never registers them as a Fastify decorator (app.encryption).

As a result:

• routes/auth.ts silently falls back to storing plaintext tokens

• routes/connect.ts crashes with:

  TypeError: Cannot read properties of undefined (reading 'encrypt')
  

Impact

Security

OAuth access tokens are stored as plaintext in the database, exposing live GitHub credentials if the database is compromised.

Reliability

The GitHub account connect flow crashes at runtime for all users.

Consistency

follow.ts already imports decrypt() directly from the utility module, indicating direct utility imports were the intended pattern.

Affected Files

• apps/backend/src/routes/auth.ts
• apps/backend/src/routes/connect.ts

Proposed Fix

Import and use encrypt() directly from utils/encryption.ts in both routes instead of relying on a non-existent app.encryption decorator.

Benefits

• Ensures OAuth tokens are encrypted before persistence
• Fixes runtime crashes in GitHub connect flow
• Aligns implementation with existing follow.ts usage pattern
• Minimal and low-risk change

I would like to work on this issue as a GSSoC 2026 contributor.

[Harxhit]

Hey, @Ridanshi
Please wait until you get assigned before working on an issue and raising a PR. I’ve assigned this issue to you now. Also, please join our Discord community from the README section so we can communicate properly and provide valid labels for your contributions, which will help you score points in GSSoC.

[Ridanshi]

Thank you for the clarification and for assigning the issue to me.
I’ll make sure to wait for assignment before working on future issues and PRs. I’ll also join the Discord community from the README section for smoother communication and contribution tracking during GSSoC.
Appreciate the guidance!