fix(auth): encrypt OAuth tokens using encryption utility directly (#144)

* fix(auth): encrypt OAuth tokens using encryption utility directly

auth.ts silently stored GitHub OAuth access tokens as plaintext because
the encryption check relied on a non-existent `app.encryption` Fastify
decorator - the condition always evaluated false, falling back to the raw
token. connect.ts called `app.encryption.encrypt()` directly, throwing
a TypeError at runtime and breaking the GitHub connect flow entirely.

Both routes now import `encrypt()` directly from utils/encryption.ts,
consistent with how follow.ts already imports `decrypt()` from the same module.

* fix(auth): isolate OAuth token persistence with focused try/catch

Wrap the encrypt + oAuthToken.upsert block in its own try/catch so that
a transient DB failure during token storage does not abort the login flow.
The platform token is supplementary -- authentication (JWT issuance) proceeds
even when persistence fails, and the error is logged for observability.

Addresses reviewer feedback on PR #144.

---------

Signed-off-by: Prashantkumar Khatri <96608160+ShantKhatri@users.noreply.github.com>
Co-authored-by: Prashantkumar Khatri <96608160+ShantKhatri@users.noreply.github.com>

Author: Ridanshi

apps/backend/src/routes/auth.ts

@@ -1,5 +1,6 @@
 import type { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
 import { randomBytes } from 'crypto';
+import { encrypt } from '../utils/encryption.js';
 
 const GITHUB_AUTH_URL = 'https://github.com/login/oauth/authorize';
 const GITHUB_TOKEN_URL = 'https://github.com/login/oauth/access_token';
@@ -119,6 +120,19 @@ export async function authRoutes(app: FastifyInstance) {
         },
       });
 
+      // Save the authentication token for 'user:email read:user' so we have a basic platform connection.
+      // Failure here is non-fatal — the user can still authenticate; the token can be reconnected later.
+      try {
+        const encryptedToken = encrypt(tokenData.access_token);
+        await app.prisma.oAuthToken.upsert({
+          where: { userId_platform: { userId: user.id, platform: 'github' } },
+          update: { accessToken: encryptedToken, scopes: 'read:user user:email' },
+          create: { userId: user.id, platform: 'github', accessToken: encryptedToken, scopes: 'read:user user:email' },
+        });
+      } catch (err) {
+        app.log.error({ err, userId: user.id }, 'Failed to persist GitHub OAuth token — authentication proceeds');
+      }
+
       // Generate JWT
       const token = app.jwt.sign(
         { id: user.id, username: user.username },