Encryption and decryption of access_token

pages/api/auth/[...nextauth].ts

@@ -7,6 +7,7 @@ import { getUserByAlias, getUserByProvider, DbUser, createUser, updateUser } fro
 import rudderStackEvents from "../events";
 import axios from "axios"
 import { OAuthConfig, OAuthUserConfig } from "next-auth/providers";
+import { encryptToken } from "../../../utils/secure";
 import { v4 as uuidv4 } from "uuid";
 interface signInParam {
 	user: User,
@@ -140,6 +141,8 @@ const getHandleFromProfile = (profile: Profile | undefined) => {
 const createUserUpdateObj = (user: User, account: Account | null, profile: Profile | undefined, db_user?: DbUser) => {
 	const updateObj: DbUser = {}
 	if (account) {
+		const encryptedAccessToken = encryptToken(account.access_token);
+		account.access_token=encryptedAccessToken
 		updateObj.auth_info = {
 			[account.provider]: {
 				[account.providerAccountId]: {
@@ -228,4 +231,4 @@ function BitbucketProvider<P extends BitbucketProfile>(options: OAuthUserConfig<
 	}
 }
 
-export default NextAuth(authOptions)
+export default NextAuth(authOptions)

pages/u.tsx

@@ -14,6 +14,7 @@ import Footer from "../components/Footer";
 import { useSession } from "next-auth/react";
 import Button from "../components/Button";
 import { getAndSetAnonymousIdFromLocalStorage } from "../utils/url_utils";
+import { decryptToken } from "../utils/secure";
 
 type ProfileProps = {
 	session: Session,
@@ -90,7 +91,7 @@ export const getServerSideProps: GetServerSideProps<ProfileProps> = async ({ req
 
 	if (Object.keys(session.user.auth_info!).includes("github")) {
 		for (const gh_auth_info of Object.values(session.user.auth_info!["github"])) {
-			const access_key: string = gh_auth_info['access_token'];
+			const access_key: string = decryptToken(gh_auth_info['access_token']);
 			axios.get("https://api.github.com/user/emails", {
 				headers: {
 					'Accept': 'application/vnd.github+json',
@@ -113,7 +114,7 @@ export const getServerSideProps: GetServerSideProps<ProfileProps> = async ({ req
 
 	if (Object.keys(session.user.auth_info!).includes("bitbucket")) {
 		for (const bb_auth_info of Object.values(session.user.auth_info!["bitbucket"])) {
-			const access_key: string = bb_auth_info['access_token'];
+			const access_key: string = decryptToken(bb_auth_info['access_token']);
 			axios.get("https://api.bitbucket.org/2.0/user/emails", {
 				headers: {
 					'Authorization': `Bearer ${access_key}`
@@ -135,7 +136,7 @@ export const getServerSideProps: GetServerSideProps<ProfileProps> = async ({ req
 
 	if (Object.keys(session.user.auth_info!).includes("gitlab")) {
 		for (const gl_auth_info of Object.values(session.user.auth_info!["gitlab"])) {
-			const access_key: string = gl_auth_info['access_token'];
+			const access_key: string = decryptToken(gl_auth_info['access_token']);
 			axios.get("https://gitlab.com/api/v4/user/emails", {
 				headers: {
 					'Authorization': `Bearer ${access_key}`
@@ -166,4 +167,4 @@ export const getServerSideProps: GetServerSideProps<ProfileProps> = async ({ req
 	}
 }
 
-export default Profile;
+export default Profile;

utils/secure.ts

@@ -0,0 +1,32 @@
+import * as crypto from 'crypto';
+
+export function encryptToken(data: string | undefined): string {
+  const algorithm = 'aes-256-cbc';
+  const iv = crypto.randomBytes(16);
+  const key = 'JaNdRgUkXp2s5u8x/A?D(G+KbPeShVmY'
+  const cipher = crypto.createCipheriv(algorithm, key, iv);
+  cipher.setAutoPadding(true);
+  if(data === undefined) return "null";
+  let encryptedData = cipher.update(data, 'utf8', 'hex');
+  encryptedData += cipher.final('hex');
+
+  const combinedData = `${iv.toString('hex')}:${encryptedData}`;
+  return combinedData;
+}
+
+
+export function decryptToken(combinedData: string): string {
+  const algorithm = 'aes-256-cbc';
+  const key = 'JaNdRgUkXp2s5u8x/A?D(G+KbPeShVmY'
+  const ivLength = 32; // Length of the IV in characters
+  const iv = combinedData.substring(0, ivLength);
+  const encryptedData = combinedData.substring(ivLength + 1); // Skip the ":" separator
+
+  const decipher = crypto.createDecipheriv(algorithm, key, Buffer.from(iv, 'hex'));
+  decipher.setAutoPadding(true);
+
+  let decryptedData = decipher.update(encryptedData, 'hex', 'utf8');
+  decryptedData += decipher.final('utf8');
+
+  return decryptedData;
+}