feat: encrypt auth config

db/migrate/20260406140414_change_auth_config_to_text_in_captain_custom_tools.rb

@@ -0,0 +1,13 @@
+class ChangeAuthConfigToTextInCaptainCustomTools < ActiveRecord::Migration[7.1]
+  def up
+    change_column :captain_custom_tools, :auth_config, :text, default: nil
+  end
+
+  def down
+    execute <<~SQL.squish
+      ALTER TABLE captain_custom_tools
+      ALTER COLUMN auth_config TYPE jsonb USING auth_config::jsonb,
+      ALTER COLUMN auth_config SET DEFAULT '{}'::jsonb
+    SQL
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2026_03_24_102005) do
+ActiveRecord::Schema[7.1].define(version: 2026_04_06_140414) do
   # These extensions should be enabled to support this database
   enable_extension "pg_stat_statements"
   enable_extension "pg_trgm"
@@ -334,7 +334,7 @@ ActiveRecord::Schema[7.1].define(version: 2026_03_24_102005) do
     t.text "request_template"
     t.text "response_template"
     t.string "auth_type", default: "none"
-    t.jsonb "auth_config", default: {}
+    t.text "auth_config"
     t.jsonb "param_schema", default: []
     t.boolean "enabled", default: true, null: false
     t.datetime "created_at", null: false

enterprise/app/models/captain/custom_tool.rb

@@ -3,7 +3,7 @@
 # Table name: captain_custom_tools
 #
 #  id                :bigint           not null, primary key
-#  auth_config       :jsonb
+#  auth_config       :text
 #  auth_type         :string           default("none")
 #  description       :text
 #  enabled           :boolean          default(TRUE), not null
@@ -31,6 +31,9 @@ class Captain::CustomTool < ApplicationRecord
   include Concerns::Toolable
   include Concerns::SafeEndpointValidatable
 
+  serialize :auth_config, coder: JSON
+  encrypts :auth_config if Chatwoot.encryption_configured?
+
   self.table_name = 'captain_custom_tools'
 
   NAME_PREFIX = 'custom'.freeze