Addressed SA-3 by encrypting the sqlite content with a .env secret

backend/app/api/user_config.py

@@ -15,6 +15,7 @@ from backend.app.services.otp_service import create_secret, provisioning_uri, ve
 from backend.app.services.email_addresses import add_user_email_address, create_email_verification, list_user_email_addresses
 from backend.app.services.email_service import send_verification_email, smtp_configured
 from backend.app.core.config import settings
+from backend.app.services.secret_store import decrypt_secret, encrypt_secret
 
 router = APIRouter()
 
@@ -116,7 +117,7 @@ def setup_otp(user: dict = Depends(get_current_user)):
         raise HTTPException(status_code=409, detail='One-time password is already enabled')
     secret = create_secret()
     with get_connection() as conn:
-        conn.execute('UPDATE users SET otp_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (secret, user['id']))
+        conn.execute('UPDATE users SET otp_secret = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?', (encrypt_secret(secret), user['id']))
         conn.commit()
     return {'secret': secret, 'otpauth_url': provisioning_uri(secret, user['username'])}
 
@@ -125,7 +126,7 @@ def setup_otp(user: dict = Depends(get_current_user)):
 def update_otp(payload: OtpUpdate, user: dict = Depends(get_current_user)):
     if payload.action not in {'enable', 'disable'}:
         raise HTTPException(status_code=422, detail='OTP action must be enable or disable')
-    if not verify_code(user['otp_secret'], payload.code):
+    if not verify_code(decrypt_secret(user['otp_secret']), payload.code):
         raise HTTPException(status_code=400, detail='Invalid one-time password')
     with get_connection() as conn:
         if payload.action == 'enable':
@@ -329,6 +330,8 @@ def get_user_plugin_config(plugin_name: str, user: dict = Depends(get_current_us
         return {}
 
     config = json.loads(row['config']) if row['config'] else {}
+    if config.get('access_token'):
+        config.pop('access_token')
     return config
 
 
@@ -346,6 +349,8 @@ def update_user_plugin_config(
 
         current_config = json.loads(current['config']) if current and current['config'] else {}
         updates = payload.model_dump(exclude_none=True)
+        if updates.get('access_token'):
+            updates['access_token'] = encrypt_secret(updates['access_token'])
         merged = {**current_config, **updates}
 
         if current is None:
@@ -368,4 +373,6 @@ def update_user_plugin_config(
 
         conn.commit()
 
-    return merged
+    public_config = dict(merged)
+    public_config.pop('access_token', None)
+    return public_config