THU-506: Move integration secrets to local-only table#859
Open
raivieiraadriano92 wants to merge 10 commits into
Open
THU-506: Move integration secrets to local-only table#859raivieiraadriano92 wants to merge 10 commits into
raivieiraadriano92 wants to merge 10 commits into
Conversation
raivieiraadriano92
changed the title
Semgrep Security ScanNo security issues found. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
raivieiraadriano92
had a problem deploying
to
preview
GitHub Actions
Failure
PR Metrics
Updated Fri, 15 May 2026 20:08:03 GMT · run #1506 |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Token refresh paths called saveIntegrationCredentials with enabled=true, which silently re-enabled integrations the user had disabled. Add updateIntegrationCredentials to update the credentials column only. getIntegrationStatus now also returns googleEmail/microsoftEmail so the integrations settings page can display the connected account again.
ital0
requested changes
May 14, 2026
ital0
requested changes
May 14, 2026
raivieiraadriano92
temporarily deployed
to
preview
GitHub Actions
Inactive
|
Preview environment deployed 🚀
Stack: Auto-destroys on PR close/merge. Login via the bundled Keycloak realm — |
| export const setOAuthState = (update: Partial<OAuthState>): void => { | ||
| const current = getOAuthState() | ||
| const merged = { ...current, ...update } | ||
| localStorage.setItem(storageKey, JSON.stringify(merged)) |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1d2e5ba. Configure here.
ital0
approved these changes
May 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
integrations_secretslocal-only table (PowerSynclocalOnly: true) for Google/Microsoft OAuth credentials and enabled flags — credentials never leave the deviceoauth_state,oauth_verifier, etc.) from synced settings tosessionStorage— PKCE verifiers and CSRF tokens are security-critical single-use values that should not syncintegrations_google_is_enabledandintegrations_microsoft_is_enabledto the local table alongside credentials — enabled flag is meaningless without local credentials on other devicesintegrations_pro_is_enabledandintegrations_do_not_ask_againremain in synced settings (not credential-dependent)src/dal/integrations.tsDAL module centralizes credential CRUD (uses SELECT-then-INSERT-or-UPDATE pattern for PowerSync view compatibility)Test plan
integrations_secrets, not settings tableenabledfrom local tableoauth_*keys in settings table)integrations_pro_is_enabledandintegrations_do_not_ask_againstill sync correctly🤖 Generated with Claude Code
Note
Medium Risk
Touches OAuth credential storage, token refresh persistence, and integration gating logic; bugs could break connect/disconnect flows or accidentally disable tools despite valid credentials.
Overview
Moves Google/Microsoft integration credentials and enabled flags out of synced
settingsand into a new local-only SQLite tableintegrations_secrets(registered in PowerSync schema aslocalOnly: true), with a new DAL (dal/integrations.ts) to read/write/delete and compute per-provider status (including surfaced email).Updates OAuth connect/disconnect, integrations settings UI, onboarding state, and tool availability/AI prompt labeling to use
getIntegrationStatus+ React Query invalidation instead of settings keys, and centralizes OAuth token refresh logic via newintegrations/oauth-credentials.ts.Shifts OAuth flow state (
state/verifier/returnContext) from the database to browser storage vialib/oauth-state.ts, and updates the deep-link listener/tests accordingly.Reviewed by Cursor Bugbot for commit 1d2e5ba. Bugbot is set up for automated code reviews on this repo. Configure here.