- Shipped
- October 14, 2026 at 4:24 PM UTC
- Author
- Kamo
- Commit
- c08636d
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the entity documents them as encrypted. Writes now go through IntegrationTokenSealer.seal ('kenc1:' + PlatformSecretCipher, AES-256-GCM under platform.enc-key, the envelope VOIPService uses) and reads through open, which passes legacy plaintext through. Fails closed: with no key a token is refused rather than stored as plaintext. IntegrationTokenSealing re-seals legacy values once at boot on one pod, idempotent, compare-and-set per value. The Microsoft refresh now keeps a rotated refresh token and URL-encodes the one it sends. Live table is empty; platform-enc-key is mounted on kamowssecurity.