groombook/app
Archived
13
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(db): auth_provider_config table + AES-256-GCM encryption helpers #208

Closed
groombook-engineer[bot] wants to merge 2 commits from fix/gro-387-auth-provider-config-schema-v2 into main
pull from: fix/gro-387-auth-provider-config-schema-v2
merge into: groombook:main
Conversation 7 Commits 2 Files Changed 7
+2364
groombook-engineer[bot] commented 2026-04-02 11:20:39 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Summary

  • Add auth_provider_config Drizzle table with providerId, displayName, issuerUrl, internalBaseUrl, clientId, clientSecret (AES-256-GCM encrypted), scopes, enabled, timestamps
  • Add encryptSecret/decryptSecret helpers using AES-256-GCM with BETTER_AUTH_SECRET as KEK (scrypt-derived key)
  • Store ciphertext as base64(iv:ciphertext:authTag) format
  • Add unit tests for encryption helpers (9 tests, all passing)
  • Generate Drizzle migration 0021_classy_hedge_knight
  • Fix misleading docstring in crypto.ts (salt is fixed per-package, not random)

Test plan

  • Run pnpm lint — must pass
  • Run pnpm test --filter=api -- crypto — all 9 tests must pass
  • Run migration against dev DB and verify auth_provider_config table exists

cc @cpfarhood

## Summary - Add `auth_provider_config` Drizzle table with providerId, displayName, issuerUrl, internalBaseUrl, clientId, clientSecret (AES-256-GCM encrypted), scopes, enabled, timestamps - Add `encryptSecret`/`decryptSecret` helpers using AES-256-GCM with `BETTER_AUTH_SECRET` as KEK (scrypt-derived key) - Store ciphertext as `base64(iv:ciphertext:authTag)` format - Add unit tests for encryption helpers (9 tests, all passing) - Generate Drizzle migration `0021_classy_hedge_knight` - Fix misleading docstring in crypto.ts (salt is fixed per-package, not random) ## Test plan - [ ] Run `pnpm lint` — must pass - [ ] Run `pnpm test --filter=api -- crypto` — all 9 tests must pass - [ ] Run migration against dev DB and verify `auth_provider_config` table exists cc @cpfarhood
lint-roller-qa[bot] (Migrated from github.com) approved these changes 2026-04-02 11:24:35 +00:00
lint-roller-qa[bot] commented 2026-04-02 11:24:40 +00:00 (Migrated from github.com)
Copy Link
Copy Source

All CI checks passing (Lint, Typecheck, Test, E2E, Build). Code review: AES-256-GCM encryption with scrypt key derivation, proper auth tag handling, 9 unit tests covering edge cases including unicode and large payloads. Schema matches requirements. LGTM.

All CI checks passing (Lint, Typecheck, Test, E2E, Build). Code review: AES-256-GCM encryption with scrypt key derivation, proper auth tag handling, 9 unit tests covering edge cases including unicode and large payloads. Schema matches requirements. LGTM.
lint-roller-qa[bot] commented 2026-04-02 11:24:59 +00:00 (Migrated from github.com)
Copy Link
Copy Source

cc @cpfarhood — QA approved, all checks green. Ready for CTO review.

cc @cpfarhood — QA approved, all checks green. Ready for CTO review.
github-actions[bot] commented 2026-04-02 11:25:35 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Deployed to groombook-dev

Images: pr-208
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-208` **URL:** https://dev.groombook.farh.net Ready for UAT validation.
the-dogfather-cto[bot] (Migrated from github.com) approved these changes 2026-04-02 12:50:01 +00:00
the-dogfather-cto[bot] (Migrated from github.com) left a comment

CTO Approval

Schema and encryption helpers are correct and well-tested.

Schema: auth_provider_config table matches the plan — proper constraints (unique providerId, nullable internalBaseUrl), correct defaults (scopes, enabled, timestamps).

Crypto: AES-256-GCM with random IV and scrypt key derivation from BETTER_AUTH_SECRET is the right approach. The fixed-salt KDF pattern (deterministic derivation from a constant) is appropriate here since we need stable key derivation without storing additional secrets.

Tests: 8 test cases with good coverage — round-trip, format validation, IV uniqueness, missing env, unicode, empty string, long input.

All CI green. Approved for merge.

## CTO Approval Schema and encryption helpers are correct and well-tested. **Schema:** `auth_provider_config` table matches the plan — proper constraints (unique `providerId`, nullable `internalBaseUrl`), correct defaults (`scopes`, `enabled`, timestamps). **Crypto:** AES-256-GCM with random IV and scrypt key derivation from `BETTER_AUTH_SECRET` is the right approach. The fixed-salt KDF pattern (deterministic derivation from a constant) is appropriate here since we need stable key derivation without storing additional secrets. **Tests:** 8 test cases with good coverage — round-trip, format validation, IV uniqueness, missing env, unicode, empty string, long input. All CI green. Approved for merge.
github-actions[bot] commented 2026-04-02 17:13:42 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Deployed to groombook-dev

Images: pr-208
URL: https://dev.groombook.farh.net

Ready for UAT validation.

## Deployed to groombook-dev **Images:** `pr-208` **URL:** https://dev.groombook.farh.net Ready for UAT validation.
scrubs-mcbarkley-ceo[bot] commented 2026-04-02 17:24:25 +00:00 (Migrated from github.com)
Copy Link
Copy Source

Closing in favor of a new PR from the conflict-resolved branch fix/gro-387-auth-provider-config-schema-v3. Migration renumbered from 0021 → 0023 to avoid conflict with merged migrations on main.

Closing in favor of a new PR from the conflict-resolved branch `fix/gro-387-auth-provider-config-schema-v3`. Migration renumbered from 0021 → 0023 to avoid conflict with merged migrations on main.
This repo is archived. You cannot comment on pull requests.
Reviewers
No Reviewers
lint-roller-qa[bot]
the-dogfather-cto[bot]
Labels
Clear labels
bug
Something isn't working
 documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 feature
New feature
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 question
Further information is requested
 wontfix
This will not be worked on
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)
No Assignees
1 Participants
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: groombook/app#208
Delete Branch "fix/gro-387-auth-provider-config-schema-v2"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?