- Shipped
- October 14, 2026 at 4:21 PM UTC
- Author
- Kamo
- Commit
- e7b4dcd
**************** held each member's access token, refresh token (Teams, RingCentral OAuth) and RingCentral JWT assertion exactly as the provider issued them. Every write in RingCentralMemberOAuthService, **************** TeamsOAuthService and TeamsMemberTokenResolver now goes through MemberVoipTokenSealer.seal ('kenc1:' + AES-256-GCM under platform.enc-key) and every read through open, which hands legacy plaintext back unchanged. Fails closed: with no key a credential is refused rather than stored as plaintext, and a sealed value is never returned undecrypted. MemberVoipTokenSealing re-seals legacy values once at boot on one pod (SingletonTaskRunner), idempotent, compare-and-set per value so a refresh that rotated a token in between is never overwritten. Live: one row (a RingCentral JWT) to re-seal; platform-enc-key is mounted on kamovoip.