refactor: extract encryptTokenPair utility (#584)

## Summary

- Extracts a shared `encryptTokenPair(accessToken, refreshToken,
encryptionKey)` utility in `auth/crypto.ts` that encrypts an
access/refresh token pair, returning `null` for unprovided tokens and
throwing on encryption failure
- Replaces 3 inline try/catch encryption blocks in `router.ts`
(`handleCreateSession` and `handleSessionWsToken`) with calls to the
shared utility
- Callers decide error policy: `handleCreateSession` catches and returns
500, `handleSessionWsToken` catches and continues with null tokens

## Test plan

- [x] 5 new unit tests for `encryptTokenPair` covering: both undefined,
access-only, refresh-only, both provided (with round-trip decryption
verification), and invalid key (throws)
- [x] All 1039 existing control-plane tests pass
- [x] Typecheck passes
- [x] Lint passes

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Unified encryption of access and refresh tokens into a single
token-pair flow and tightened error handling so encryption failures now
surface as errors instead of being partially ignored.

* **Tests**
* Added tests covering token-pair encryption, missing-token cases,
successful encrypt/decrypt, and failure/error scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: ColeMurray

packages/control-plane/src/auth/crypto.test.ts

@@ -1,6 +1,13 @@
 import { describe, it, expect } from "vitest";
 import { timingSafeEqual } from "@open-inspect/shared";
-import { encryptToken, decryptToken, generateEncryptionKey, generateId, hashToken } from "./crypto";
+import {
+  encryptToken,
+  encryptTokenPair,
+  decryptToken,
+  generateEncryptionKey,
+  generateId,
+  hashToken,
+} from "./crypto";
 
 describe("crypto", () => {
   describe("generateEncryptionKey", () => {
@@ -153,6 +160,53 @@ describe("crypto", () => {
     });
   });
 
+  describe("encryptTokenPair", () => {
+    it("returns null for both tokens when both are undefined", async () => {
+      const key = generateEncryptionKey();
+      const result = await encryptTokenPair(undefined, undefined, key);
+      expect(result.accessTokenEncrypted).toBeNull();
+      expect(result.refreshTokenEncrypted).toBeNull();
+    });
+
+    it("encrypts provided access token and returns null for undefined refresh token", async () => {
+      const key = generateEncryptionKey();
+      const result = await encryptTokenPair("access-token-123", undefined, key);
+      expect(result.accessTokenEncrypted).not.toBeNull();
+      expect(result.refreshTokenEncrypted).toBeNull();
+
+      const decrypted = await decryptToken(result.accessTokenEncrypted!, key);
+      expect(decrypted).toBe("access-token-123");
+    });
+
+    it("encrypts provided refresh token and returns null for undefined access token", async () => {
+      const key = generateEncryptionKey();
+      const result = await encryptTokenPair(undefined, "refresh-token-456", key);
+      expect(result.accessTokenEncrypted).toBeNull();
+      expect(result.refreshTokenEncrypted).not.toBeNull();
+
+      const decrypted = await decryptToken(result.refreshTokenEncrypted!, key);
+      expect(decrypted).toBe("refresh-token-456");
+    });
+
+    it("encrypts both tokens when both are provided", async () => {
+      const key = generateEncryptionKey();
+      const result = await encryptTokenPair("access-token", "refresh-token", key);
+      expect(result.accessTokenEncrypted).not.toBeNull();
+      expect(result.refreshTokenEncrypted).not.toBeNull();
+
+      const decryptedAccess = await decryptToken(result.accessTokenEncrypted!, key);
+      const decryptedRefresh = await decryptToken(result.refreshTokenEncrypted!, key);
+      expect(decryptedAccess).toBe("access-token");
+      expect(decryptedRefresh).toBe("refresh-token");
+    });
+
+    it("throws when encryption fails (invalid key)", async () => {
+      await expect(
+        encryptTokenPair("access-token", "refresh-token", "not-a-valid-base64-key!!!")
+      ).rejects.toThrow();
+    });
+  });
+
   describe("timingSafeEqual", () => {
     it("returns true for equal strings", () => {
       expect(timingSafeEqual("abc", "abc")).toBe(true);

packages/control-plane/src/auth/crypto.ts

@@ -108,4 +108,21 @@ export async function hashToken(token: string): Promise<string> {
     .join("");
 }
 
+/**
+ * Encrypt an access/refresh token pair.
+ * Returns null for tokens that weren't provided (undefined/empty).
+ * Throws if encryption of a provided token fails.
+ */
+export async function encryptTokenPair(
+  accessToken: string | undefined,
+  refreshToken: string | undefined,
+  encryptionKey: string
+): Promise<{ accessTokenEncrypted: string | null; refreshTokenEncrypted: string | null }> {
+  const accessTokenEncrypted = accessToken ? await encryptToken(accessToken, encryptionKey) : null;
+  const refreshTokenEncrypted = refreshToken
+    ? await encryptToken(refreshToken, encryptionKey)
+    : null;
+  return { accessTokenEncrypted, refreshTokenEncrypted };
+}
+
 // timingSafeEqual is exported from @open-inspect/shared — use that instead.

packages/control-plane/src/router.ts

@@ -9,7 +9,7 @@ import type {
   CreateSessionResponse,
   SpawnSource,
 } from "./types";
-import { generateId, encryptToken } from "./auth/crypto";
+import { generateId, encryptTokenPair } from "./auth/crypto";
 import { verifyInternalToken } from "./auth/internal";
 import {
   buildMediaObjectKey,
@@ -924,28 +924,20 @@ async function handleCreateSession(
   let scmTokenEncrypted: string | null = null;
   let scmRefreshTokenEncrypted: string | null = null;
 
-  // If SCM token provided, encrypt it
-  if (scmToken && env.TOKEN_ENCRYPTION_KEY) {
+  if (env.TOKEN_ENCRYPTION_KEY) {
     try {
-      scmTokenEncrypted = await encryptToken(scmToken, env.TOKEN_ENCRYPTION_KEY);
+      ({
+        accessTokenEncrypted: scmTokenEncrypted,
+        refreshTokenEncrypted: scmRefreshTokenEncrypted,
+      } = await encryptTokenPair(scmToken, scmRefreshToken, env.TOKEN_ENCRYPTION_KEY));
     } catch (e) {
       logger.error("Failed to encrypt SCM token", {
-        error: e instanceof Error ? e : String(e),
+        error: e instanceof Error ? e.message : String(e),
       });
       return error("Failed to process SCM token", 500);
     }
   }
 
-  if (scmRefreshToken && env.TOKEN_ENCRYPTION_KEY) {
-    try {
-      scmRefreshTokenEncrypted = await encryptToken(scmRefreshToken, env.TOKEN_ENCRYPTION_KEY);
-    } catch (e) {
-      logger.warn("Session created without refresh token — token refresh will be unavailable", {
-        error: e instanceof Error ? e : String(e),
-      });
-    }
-  }
-
   // Enrich owner participant with linked GitHub identity from D1.
   // Fills in SCM fields the bot didn't provide (email, display name, OAuth tokens).
   if (resolvedUserId) {
@@ -1725,35 +1717,24 @@ async function handleSessionWsToken(
   const scmRefreshToken = body.scmRefreshToken;
 
   // Encrypt the SCM tokens if provided
-  const { scmTokenEncrypted, scmRefreshTokenEncrypted } = await ctx.metrics.time(
-    "encrypt_tokens",
-    async () => {
-      let accessToken: string | null = null;
-      let refreshToken: string | null = null;
-
-      if (scmToken && env.TOKEN_ENCRYPTION_KEY) {
-        try {
-          accessToken = await encryptToken(scmToken, env.TOKEN_ENCRYPTION_KEY);
-        } catch (e) {
-          logger.error("Failed to encrypt SCM token", {
-            error: e instanceof Error ? e : String(e),
-          });
-        }
-      }
-
-      if (scmRefreshToken && env.TOKEN_ENCRYPTION_KEY) {
-        try {
-          refreshToken = await encryptToken(scmRefreshToken, env.TOKEN_ENCRYPTION_KEY);
-        } catch (e) {
-          logger.error("Failed to encrypt SCM refresh token", {
-            error: e instanceof Error ? e : String(e),
-          });
-        }
-      }
+  let scmTokenEncrypted: string | null = null;
+  let scmRefreshTokenEncrypted: string | null = null;
 
-      return { scmTokenEncrypted: accessToken, scmRefreshTokenEncrypted: refreshToken };
+  if (env.TOKEN_ENCRYPTION_KEY) {
+    try {
+      ({
+        accessTokenEncrypted: scmTokenEncrypted,
+        refreshTokenEncrypted: scmRefreshTokenEncrypted,
+      } = await ctx.metrics.time("encrypt_tokens", () =>
+        encryptTokenPair(scmToken, scmRefreshToken, env.TOKEN_ENCRYPTION_KEY!)
+      ));
+    } catch (e) {
+      logger.error("Failed to encrypt SCM tokens", {
+        error: e instanceof Error ? e.message : String(e),
+      });
+      return error("Failed to process SCM tokens", 500);
     }
-  );
+  }
 
   // Populate D1 with the user's SCM tokens (non-blocking) so centralized refresh works
   if (scmUserId && scmToken && scmRefreshToken && env.TOKEN_ENCRYPTION_KEY) {