fix: encrypt stored GitHub credentials (#797)

src/core/model/anonymizedGists/anonymizedGists.schema.ts

@@ -18,7 +18,7 @@ const AnonymizedGistSchema = new Schema({
   conference: String,
   source: {
     gistId: String,
-    accessToken: String,
+    accessToken: { type: String, select: false },
   },
   options: {
     terms: [String],

src/core/model/anonymizedPullRequests/anonymizedPullRequests.schema.ts

@@ -19,7 +19,7 @@ const AnonymizedPullRequestSchema = new Schema({
   source: {
     pullRequestId: Number,
     repositoryFullName: String,
-    accessToken: String,
+    accessToken: { type: String, select: false },
   },
   options: {
     terms: [String],

src/core/model/anonymizedRepositories/anonymizedRepositories.schema.ts

@@ -14,7 +14,7 @@ const AnonymizedRepositorySchema = new Schema({
   anonymizeDate: Date,
   lastView: Date,
   pageView: Number,
-  accessToken: String,
+  accessToken: { type: String, select: false },
   owner: {
     type: Schema.Types.ObjectId,
     ref: "user",
@@ -36,7 +36,7 @@ const AnonymizedRepositorySchema = new Schema({
     commitDate: Date,
     repositoryId: String,
     repositoryName: String,
-    accessToken: String,
+    accessToken: { type: String, select: false },
   },
   truncatedFolders: {
     type: [String],

src/core/model/credentials/credentials.model.ts

@@ -0,0 +1,24 @@
+import { model, Schema, Types } from "mongoose";
+import { EncryptedToken } from "../../credential-crypto";
+
+export interface ICredential {
+  ownerId: Types.ObjectId;
+  provider: string;
+  encryptedToken: EncryptedToken;
+  updatedAt: Date;
+}
+const envelope = new Schema({
+  version: { type: Number, required: true, enum: [1] },
+  keyId: { type: String, required: true },
+  nonce: { type: String, required: true },
+  ciphertext: { type: String, required: true },
+  tag: { type: String, required: true },
+}, { _id: false });
+const schema = new Schema<ICredential>({
+  ownerId: { type: Schema.Types.ObjectId, required: true, ref: "user" },
+  provider: { type: String, required: true, enum: ["github"] },
+  encryptedToken: { type: envelope, required: true, select: false },
+  updatedAt: { type: Date, required: true },
+}, { collection: "credentials" });
+schema.index({ ownerId: 1, provider: 1 }, { unique: true });
+export default model<ICredential>("Credential", schema);

src/core/model/users/users.schema.ts

@@ -2,7 +2,7 @@ import { Schema } from "mongoose";
 
 const UserSchema = new Schema({
   accessTokens: {
-    github: { type: String },
+    github: { type: String, select: false },
   },
   accessTokenDates: {
     github: { type: Date },

src/core/model/users/users.types.ts

@@ -1,7 +1,8 @@
 import { Document, Model } from "mongoose";
 
 export interface IUser {
-  accessTokens: {
+  /** Legacy storage, read only when CREDENTIAL_LEGACY_READS is enabled. */
+  accessTokens?: {
     github: string;
   };
   accessTokenDates?: {