user f3000bda36 chore(mcp): encrypt user-scoped credentials at rest ... LiteLLM_MCPUserCredentials.credential_b64 stored both BYOK API keys and OAuth2 access tokens as plain urlsafe-base64 of the raw value. Any DB read could recover the upstream-provider key. Run all writes through encrypt_value_helper (nacl SecretBox, the same helper used for the server-level credentials column) and read back via a small dual-path helper that tries decryption first, then falls back to plain base64 so existing rows keep working until they get rewritten. Folds the three near-identical "decode -> json.loads -> check type == oauth2" sites into _decode_oauth_payload, which simplifies the BYOK guard inside store_user_oauth_credential.		2026-04-30 00:27:15 +00:00
..
mcp_server	chore(mcp): encrypt user-scoped credentials at rest	2026-04-30 00:27:15 +00:00