From e92f5c0b6396204682d5cc12d247409c6de2a871 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@rubenfiszel.com>
Date: Wed, 27 Jul 2022 15:39:39 +0200
Subject: [PATCH] fix: encrypt the refresh token

---
 backend/src/oauth2.rs | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/backend/src/oauth2.rs b/backend/src/oauth2.rs
index bc7c55dbbe..5cd9730835 100644
--- a/backend/src/oauth2.rs
+++ b/backend/src/oauth2.rs
@@ -29,6 +29,7 @@ use crate::jobs;
 use crate::jobs::{get_latest_hash_for_path, JobPayload};
 use crate::users::Authed;
 use crate::utils::not_found_if_none;
+use crate::variables::{build_crypt, encrypt};
 use crate::workspaces::WorkspaceSettings;
 use crate::BaseUrl;
 
@@ -476,17 +477,20 @@ pub async fn _refresh_token<'c>(
     )
     .execute(&mut tx)
     .await?;
-    let token = token.access_token.to_string();
+
+    let mc = build_crypt(&mut tx, &w_id).await?;
+    let encrypted_token = encrypt(&mc, token.access_token.to_string());
+
     sqlx::query!(
         "UPDATE variable SET value = $1 WHERE workspace_id = $2 AND path = $3",
-        token,
+        encrypted_token,
         w_id,
         path
     )
     .execute(&mut tx)
     .await?;
     tx.commit().await?;
-    Ok(token)
+    Ok(encrypted_token)
 }
 
 #[derive(Deserialize)]