Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/api/admin.py

@@ -20,6 +20,7 @@ from backend.app.services.email_service import (
 )
 from backend.app.services.email_verification import create_verification_token
 from backend.app.services.theme_service import THEMES, get_enabled_themes, save_enabled_themes
+from backend.app.services.secret_store import encrypt_secret
 from backend.app.core.config import settings
 
 router = APIRouter()
@@ -345,6 +346,9 @@ def update_plugin(
         config = json.loads(current['config']) if current['config'] else {}
         if payload.config is not None:
             config.update(payload.config)
+        for secret_name in ('access_token', 'client_secret', 'smtp_password'):
+            if config.get(secret_name):
+                config[secret_name] = encrypt_secret(config[secret_name])
 
         conn.execute(
             '''

backend/app/api/auth.py

@@ -15,6 +15,7 @@ from backend.app.services.email_verification import verify_email
 from backend.app.services.password_reset import create_reset_token, reset_password
 from backend.app.services.token_service import issue_token, revoke_token, validate_token
 from backend.app.services.otp_service import verify_code
+from backend.app.services.secret_store import decrypt_secret
 from backend.app.services.email_addresses import verify_user_email_address
 
 router = APIRouter()
@@ -48,7 +49,7 @@ def login(payload: LoginRequest):
         raise HTTPException(status_code=401, detail='Invalid username or password')
     if not user['email_verified']:
         raise HTTPException(status_code=403, detail='Email address is not verified')
-    if user['otp_enabled'] and not verify_code(user['otp_secret'], payload.otp):
+    if user['otp_enabled'] and not verify_code(decrypt_secret(user['otp_secret']), payload.otp):
         raise HTTPException(status_code=401, detail='One-time password required or invalid')
 
     token_data = issue_token(user['id'], user['username'])

backend/app/api/user_config.py

@@ -15,6 +15,7 @@ from backend.app.services.otp_service import create_secret, provisioning_uri, ve
 from backend.app.services.email_addresses import add_user_email_address, create_email_verification, list_user_email_addresses
 from backend.app.services.email_service import send_verification_email, smtp_configured
 from backend.app.core.config import settings
+from backend.app.services.secret_store import decrypt_secret, encrypt_secret
 
 router = APIRouter()
 
@@ -116,7 +117,7 @@ def setup_otp(user: dict = Depends(get_current_user)):
         raise HTTPException(status_code=409, detail='One-time password is already enabled')
     secret = create_secret()
     with get_connection() as conn:
-        conn.execute('UPDATE users SET otp_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (secret, user['id']))
+        conn.execute('UPDATE users SET otp_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (encrypt_secret(secret), user['id']))
         conn.commit()
     return {'secret': secret, 'otpauth_url': provisioning_uri(secret, user['username'])}
 
@@ -125,7 +126,7 @@ def setup_otp(user: dict = Depends(get_current_user)):
 def update_otp(payload: OtpUpdate, user: dict = Depends(get_current_user)):
     if payload.action not in {'enable', 'disable'}:
         raise HTTPException(status_code=422, detail='OTP action must be enable or disable')
-    if not verify_code(user['otp_secret'], payload.code):
+    if not verify_code(decrypt_secret(user['otp_secret']), payload.code):
         raise HTTPException(status_code=400, detail='Invalid one-time password')
     with get_connection() as conn:
         if payload.action == 'enable':
@@ -329,6 +330,8 @@ def get_user_plugin_config(plugin_name: str, user: dict = Depends(get_current_us
         return {}
 
     config = json.loads(row['config']) if row['config'] else {}
+    if config.get('access_token'):
+        config.pop('access_token')
     return config
 
 
@@ -346,6 +349,8 @@ def update_user_plugin_config(
 
         current_config = json.loads(current['config']) if current and current['config'] else {}
         updates = payload.model_dump(exclude_none=True)
+        if updates.get('access_token'):
+            updates['access_token'] = encrypt_secret(updates['access_token'])
         merged = {**current_config, **updates}
 
         if current is None:
@@ -368,4 +373,6 @@ def update_user_plugin_config(
 
         conn.commit()
 
-    return merged
+    public_config = dict(merged)
+    public_config.pop('access_token', None)
+    return public_config