THU-506: Move integration secrets to local-only table#859
THU-506: Move integration secrets to local-only table#859raivieiraadriano92 wants to merge 4 commits into
Conversation
raivieiraadriano92
changed the title
Semgrep Security ScanNo security issues found. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| export const setOAuthState = (update: Partial<OAuthState>): void => { | ||
| const current = getOAuthState() | ||
| const merged = { ...current, ...update } | ||
| sessionStorage.setItem(storageKey, JSON.stringify(merged)) |
raivieiraadriano92
had a problem deploying
to
preview
GitHub Actions
Failure
PR Metrics
Updated Tue, 12 May 2026 17:49:24 GMT · run #1469 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit a6aee2d. Configure here.
|
|
||
| const db = getDb() | ||
| await updateSettings(db, { integrations_google_credentials: JSON.stringify(updated) }) | ||
| await saveIntegrationCredentials(db, 'google', updated, true) |
There was a problem hiding this comment.
Token refresh hardcodes enabled flag to true
Medium Severity
Both ensureValidGoogleToken and the Microsoft ensureValidToken call saveIntegrationCredentials with enabled hardcoded to true. The old code only updated the credentials JSON via updateSettings without touching the enabled flag. Now, a token refresh will always force the integration back to enabled, which is a behavioral change that could silently re-enable an integration the user intentionally disabled.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit a6aee2d. Configure here.
| userEmail: mParsed?.profile?.email, | ||
| credentials: mParsed, | ||
| isEnabled: integrationStatusData?.microsoftEnabled ?? false, | ||
| isConnected: integrationStatusData?.microsoftConnected ?? false, |
There was a problem hiding this comment.
Connected integration no longer displays user email
Medium Severity
The Google and Microsoft integration objects no longer set userEmail or credentials. Previously these were populated by parsing the credentials JSON (which contained profile.email). The UI at line 197 conditionally renders integration.userEmail for connected accounts, so it now always falls back to showing "Google" or "Microsoft" instead of the user's email address.
Reviewed by Cursor Bugbot for commit a6aee2d. Configure here.
2 participants
Summary
integrations_secretslocal-only table (PowerSynclocalOnly: true) for Google/Microsoft OAuth credentials and enabled flags — credentials never leave the deviceoauth_state,oauth_verifier, etc.) from synced settings tosessionStorage— PKCE verifiers and CSRF tokens are security-critical single-use values that should not syncintegrations_google_is_enabledandintegrations_microsoft_is_enabledto the local table alongside credentials — enabled flag is meaningless without local credentials on other devicesintegrations_pro_is_enabledandintegrations_do_not_ask_againremain in synced settings (not credential-dependent)src/dal/integrations.tsDAL module centralizes credential CRUD (uses SELECT-then-INSERT-or-UPDATE pattern for PowerSync view compatibility)Test plan
integrations_secrets, not settings tableenabledfrom local tableoauth_*keys in settings table)integrations_pro_is_enabledandintegrations_do_not_ask_againstill sync correctly🤖 Generated with Claude Code
Note
Medium Risk
Medium risk because it changes how OAuth state and integration credentials/enabled flags are persisted, which can break connect/disconnect flows or tool availability if the new local-only table/sessionStorage state isn’t populated as expected.
Overview
Moves Google/Microsoft integration credentials and enabled flags out of synced
settingsand into a new local-only SQLite table (integrations_secrets) with a dedicated DAL (getIntegrationStatus,saveIntegrationCredentials,setIntegrationEnabled,deleteIntegrationCredentials).Updates OAuth and deep-link handling to store PKCE/CSRF state in
sessionStorage(src/lib/oauth-state.ts) instead of SQLite settings, and rewires UI/hooks/tool gating (useOAuthConnect,useIntegrationStatus, onboarding, integrations settings page, AI prompt/tool selection, token refresh) to read/write the new integration status source and invalidate theintegrationStatusquery after changes.Refactors tests accordingly to seed/clear sessionStorage and the local-only integrations table.
Reviewed by Cursor Bugbot for commit a6aee2d. Bugbot is set up for automated code reviews on this repo. Configure here.