feat(portal): Encrypt third-party access tokens and other sensitive information at rest

elixir/apps/domain/lib/domain/application.ex

@@ -16,6 +16,7 @@ defmodule Domain.Application do
     [
       # Core services
       Domain.Repo,
+      Domain.Vault,
       Domain.PubSub,
 
       # Infrastructure services

elixir/apps/domain/lib/domain/auth/adapter.ex

@@ -30,6 +30,11 @@ defmodule Domain.Auth.Adapter do
   """
   @callback capabilities() :: [capability()]
 
+  @doc """
+  Loads the polymorphic provider data and puts it back to the provider struct.
+  """
+  @callback load(%Provider{}) :: %Provider{}
+
   @doc """
   Applies provider-specific validations for the Identity changeset before it's created.
   """

elixir/apps/domain/lib/domain/auth/adapter/directory_sync.ex

@@ -370,7 +370,7 @@ defmodule Domain.Auth.Adapter.DirectorySync do
     end)
     |> Enum.reduce({:ok, %{}}, fn
       {_name, task}, {:error, reason} ->
-        Task.Supervisor.terminate_child(supervisor, task.pid)
+        Task.ignore(task)
         {:error, reason}
 
       {name, task}, {:ok, acc} ->

elixir/apps/domain/lib/domain/auth/adapters/email.ex

@@ -114,4 +114,7 @@ defmodule Domain.Auth.Adapters.Email do
       {:error, :invalid_or_expired_token} -> {:error, :invalid_secret}
     end
   end
+
+  @impl true
+  def load(provider), do: provider
 end

elixir/apps/domain/lib/domain/auth/adapters/google_workspace.ex

@@ -1,9 +1,11 @@
 defmodule Domain.Auth.Adapters.GoogleWorkspace do
   use Supervisor
+  alias Domain.Repo
   alias Domain.Actors
   alias Domain.Auth.{Provider, Adapter}
   alias Domain.Auth.Adapters.OpenIDConnect
   alias Domain.Auth.Adapters.GoogleWorkspace
+  alias Domain.Auth.Adapters.GoogleWorkspace.{IdentityState, ProviderConfig, ProviderState}
   require Logger
 
   @behaviour Adapter
@@ -40,6 +42,12 @@ defmodule Domain.Auth.Adapters.GoogleWorkspace do
     |> Domain.Repo.Changeset.trim_change(:provider_identifier)
     |> Domain.Repo.Changeset.copy_change(:provider_virtual_state, :provider_state)
     |> Ecto.Changeset.put_change(:provider_virtual_state, %{})
+    |> Domain.Repo.Changeset.cast_polymorphic_embed(:provider_state,
+      required: true,
+      with: fn current_attrs, _attrs ->
+        Ecto.embedded_load(IdentityState, current_attrs, :json)
+      end
+    )
   end
 
   @impl true
@@ -48,8 +56,13 @@ defmodule Domain.Auth.Adapters.GoogleWorkspace do
     |> Domain.Repo.Changeset.cast_polymorphic_embed(:adapter_config,
       required: true,
       with: fn current_attrs, attrs ->
-        Ecto.embedded_load(GoogleWorkspace.Settings, current_attrs, :json)
-        |> GoogleWorkspace.Settings.Changeset.changeset(attrs)
+        Ecto.embedded_load(ProviderConfig, current_attrs, :json)
+        |> ProviderConfig.Changeset.changeset(attrs)
+      end
+    )
+    |> Domain.Repo.Changeset.cast_polymorphic_embed(:adapter_state,
+      with: fn current_attrs, _attrs ->
+        Ecto.embedded_load(ProviderState, current_attrs, :json)
       end
     )
   end
@@ -66,19 +79,32 @@ defmodule Domain.Auth.Adapters.GoogleWorkspace do
 
   @impl true
   def sign_out(provider, identity, redirect_url) do
+    provider = load(provider)
     OpenIDConnect.sign_out(provider, identity, redirect_url)
   end
 
   @impl true
   def verify_and_update_identity(%Provider{} = provider, payload) do
+    provider = load(provider)
     OpenIDConnect.verify_and_update_identity(provider, payload)
   end
 
   def verify_and_upsert_identity(%Actors.Actor{} = actor, %Provider{} = provider, payload) do
+    provider = load(provider)
     OpenIDConnect.verify_and_upsert_identity(actor, provider, payload)
   end
 
   def refresh_access_token(%Provider{} = provider) do
+    provider = load(provider)
     OpenIDConnect.refresh_access_token(provider)
   end
+
+  @impl true
+  def load(%Provider{adapter_config: adapter_config, adapter_state: adapter_state} = provider) do
+    %{
+      provider
+      | adapter_config: Repo.Changeset.load_polymorphic_embed(ProviderConfig, adapter_config),
+        adapter_state: Repo.Changeset.load_polymorphic_embed(ProviderState, adapter_state)
+    }
+  end
 end

elixir/apps/domain/lib/domain/auth/adapters/google_workspace/identity_state.ex

@@ -0,0 +1,14 @@
+defmodule Domain.Auth.Adapters.GoogleWorkspace.IdentityState do
+  use Domain, :schema
+
+  @primary_key false
+  embedded_schema do
+    field :access_token, Domain.Types.EncryptedString
+    field :refresh_token, Domain.Types.EncryptedString
+
+    field :userinfo, :map
+    field :claims, :map
+
+    field :expires_at, :utc_datetime_usec
+  end
+end

elixir/apps/domain/lib/domain/auth/adapters/google_workspace/jobs/sync_directory.ex

@@ -23,7 +23,8 @@ defmodule Domain.Auth.Adapters.GoogleWorkspace.Jobs.SyncDirectory do
   end
 
   def gather_provider_data(provider, task_supervisor_pid) do
-    access_token = provider.adapter_state["access_token"]
+    provider = GoogleWorkspace.load(provider)
+    access_token = provider.adapter_state.access_token
 
     async_results =
       DirectorySync.run_async_requests(task_supervisor_pid,

elixir/apps/domain/lib/domain/auth/adapters/google_workspace/settings.ex → elixir/apps/domain/lib/domain/auth/adapters/google_workspace/provider_config.ex

@@ -1,4 +1,4 @@
-defmodule Domain.Auth.Adapters.GoogleWorkspace.Settings do
+defmodule Domain.Auth.Adapters.GoogleWorkspace.ProviderConfig do
   use Domain, :schema
 
   @scope ~w[
@@ -15,7 +15,7 @@ defmodule Domain.Auth.Adapters.GoogleWorkspace.Settings do
     field :scope, :string, default: Enum.join(@scope, " ")
     field :response_type, :string, default: "code"
     field :client_id, :string
-    field :client_secret, :string
+    field :client_secret, Domain.Types.EncryptedString
     field :discovery_document_uri, :string, default: @discovery_document_uri
   end
 

elixir/apps/domain/lib/domain/auth/adapters/google_workspace/provider_config/changeset.ex

@@ -0,0 +1,19 @@
+defmodule Domain.Auth.Adapters.GoogleWorkspace.ProviderConfig.Changeset do
+  use Domain, :changeset
+  alias Domain.Auth.Adapters.GoogleWorkspace.ProviderConfig
+  alias Domain.Auth.Adapters.OpenIDConnect
+
+  @fields ~w[scope
+             response_type
+             client_id client_secret
+             discovery_document_uri]a
+
+  def changeset(%ProviderConfig{} = settings, attrs) do
+    settings
+    |> cast(attrs, @fields)
+    |> validate_required(@fields)
+    |> validate_inclusion(:response_type, ~w[code])
+    |> OpenIDConnect.ProviderConfig.Changeset.validate_discovery_document_uri()
+    |> OpenIDConnect.ProviderConfig.Changeset.validate_scope(:scope, ProviderConfig.scope())
+  end
+end

elixir/apps/domain/lib/domain/auth/adapters/google_workspace/provider_state.ex

@@ -0,0 +1,14 @@
+defmodule Domain.Auth.Adapters.GoogleWorkspace.ProviderState do
+  use Domain, :schema
+
+  @primary_key false
+  embedded_schema do
+    field :access_token, Domain.Types.EncryptedString
+    field :refresh_token, Domain.Types.EncryptedString
+
+    field :userinfo, :map
+    field :claims, :map
+
+    field :expires_at, :utc_datetime_usec
+  end
+end

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra.ex

@@ -1,9 +1,11 @@
 defmodule Domain.Auth.Adapters.MicrosoftEntra do
   use Supervisor
+  alias Domain.Repo
   alias Domain.Actors
   alias Domain.Auth.{Provider, Adapter}
   alias Domain.Auth.Adapters.OpenIDConnect
   alias Domain.Auth.Adapters.MicrosoftEntra
+  alias Domain.Auth.Adapters.MicrosoftEntra.{IdentityState, ProviderConfig, ProviderState}
   require Logger
 
   @behaviour Adapter
@@ -40,6 +42,12 @@ defmodule Domain.Auth.Adapters.MicrosoftEntra do
     |> Domain.Repo.Changeset.trim_change(:provider_identifier)
     |> Domain.Repo.Changeset.copy_change(:provider_virtual_state, :provider_state)
     |> Ecto.Changeset.put_change(:provider_virtual_state, %{})
+    |> Domain.Repo.Changeset.cast_polymorphic_embed(:provider_state,
+      required: true,
+      with: fn current_attrs, _attrs ->
+        Ecto.embedded_load(IdentityState, current_attrs, :json)
+      end
+    )
   end
 
   @impl true
@@ -48,8 +56,13 @@ defmodule Domain.Auth.Adapters.MicrosoftEntra do
     |> Domain.Repo.Changeset.cast_polymorphic_embed(:adapter_config,
       required: true,
       with: fn current_attrs, attrs ->
-        Ecto.embedded_load(MicrosoftEntra.Settings, current_attrs, :json)
-        |> MicrosoftEntra.Settings.Changeset.changeset(attrs)
+        Ecto.embedded_load(ProviderConfig, current_attrs, :json)
+        |> ProviderConfig.Changeset.changeset(attrs)
+      end
+    )
+    |> Domain.Repo.Changeset.cast_polymorphic_embed(:adapter_state,
+      with: fn current_attrs, _attrs ->
+        Ecto.embedded_load(ProviderState, current_attrs, :json)
       end
     )
   end
@@ -66,19 +79,32 @@ defmodule Domain.Auth.Adapters.MicrosoftEntra do
 
   @impl true
   def sign_out(provider, identity, redirect_url) do
+    provider = load(provider)
     OpenIDConnect.sign_out(provider, identity, redirect_url)
   end
 
   @impl true
   def verify_and_update_identity(%Provider{} = provider, payload) do
+    provider = load(provider)
     OpenIDConnect.verify_and_update_identity(provider, payload, "oid")
   end
 
   def verify_and_upsert_identity(%Actors.Actor{} = actor, %Provider{} = provider, payload) do
+    provider = load(provider)
     OpenIDConnect.verify_and_upsert_identity(actor, provider, payload, "oid")
   end
 
   def refresh_access_token(%Provider{} = provider) do
+    provider = load(provider)
     OpenIDConnect.refresh_access_token(provider)
   end
+
+  @impl true
+  def load(%Provider{adapter_config: adapter_config, adapter_state: adapter_state} = provider) do
+    %{
+      provider
+      | adapter_config: Repo.Changeset.load_polymorphic_embed(ProviderConfig, adapter_config),
+        adapter_state: Repo.Changeset.load_polymorphic_embed(ProviderState, adapter_state)
+    }
+  end
 end

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/identity_state.ex

@@ -0,0 +1,14 @@
+defmodule Domain.Auth.Adapters.MicrosoftEntra.IdentityState do
+  use Domain, :schema
+
+  @primary_key false
+  embedded_schema do
+    field :access_token, Domain.Types.EncryptedString
+    field :refresh_token, Domain.Types.EncryptedString
+
+    field :userinfo, :map
+    field :claims, :map
+
+    field :expires_at, :utc_datetime_usec
+  end
+end

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/jobs/sync_directory.ex

@@ -23,7 +23,8 @@ defmodule Domain.Auth.Adapters.MicrosoftEntra.Jobs.SyncDirectory do
   end
 
   def gather_provider_data(provider, task_supervisor_pid) do
-    access_token = provider.adapter_state["access_token"]
+    provider = MicrosoftEntra.load(provider)
+    access_token = provider.adapter_state.access_token
 
     async_results =
       DirectorySync.run_async_requests(task_supervisor_pid,

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/settings.ex → elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/provider_config.ex

@@ -1,4 +1,4 @@
-defmodule Domain.Auth.Adapters.MicrosoftEntra.Settings do
+defmodule Domain.Auth.Adapters.MicrosoftEntra.ProviderConfig do
   use Domain, :schema
 
   @scope ~w[
@@ -15,7 +15,7 @@ defmodule Domain.Auth.Adapters.MicrosoftEntra.Settings do
     field :scope, :string, default: Enum.join(@scope, " ")
     field :response_type, :string, default: "code"
     field :client_id, :string
-    field :client_secret, :string
+    field :client_secret, Domain.Types.EncryptedString
     field :discovery_document_uri, :string
   end
 

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/provider_config/changeset.ex

@@ -0,0 +1,19 @@
+defmodule Domain.Auth.Adapters.MicrosoftEntra.ProviderConfig.Changeset do
+  use Domain, :changeset
+  alias Domain.Auth.Adapters.MicrosoftEntra.ProviderConfig
+  alias Domain.Auth.Adapters.OpenIDConnect
+
+  @fields ~w[scope
+             response_type
+             client_id client_secret
+             discovery_document_uri]a
+
+  def changeset(%ProviderConfig{} = settings, attrs) do
+    settings
+    |> cast(attrs, @fields)
+    |> validate_required(@fields)
+    |> validate_inclusion(:response_type, ~w[code])
+    |> OpenIDConnect.ProviderConfig.Changeset.validate_discovery_document_uri()
+    |> OpenIDConnect.ProviderConfig.Changeset.validate_scope(:scope, ProviderConfig.scope())
+  end
+end

elixir/apps/domain/lib/domain/auth/adapters/microsoft_entra/provider_state.ex

@@ -0,0 +1,14 @@
+defmodule Domain.Auth.Adapters.MicrosoftEntra.ProviderState do
+  use Domain, :schema
+
+  @primary_key false
+  embedded_schema do
+    field :access_token, Domain.Types.EncryptedString
+    field :refresh_token, Domain.Types.EncryptedString
+
+    field :userinfo, :map
+    field :claims, :map
+
+    field :expires_at, :utc_datetime_usec
+  end
+end