fix(generic-oauth): ensure encryptOAuthTokens is respected in account linking flow (#6874)

packages/better-auth/src/plugins/generic-oauth/routes.ts

@@ -14,6 +14,7 @@ import { sessionMiddleware } from "../../api";
 import { setSessionCookie } from "../../cookies";
 import { handleOAuthUserInfo } from "../../oauth2/link-account";
 import { generateState, parseState } from "../../oauth2/state";
+import { setTokenUtil } from "../../oauth2/utils";
 import type { User } from "../../types";
 import { HIDE_METADATA } from "../../utils";
 import { GENERIC_OAUTH_ERROR_CODES } from "./error-codes";
@@ -435,9 +436,12 @@ export const oAuth2Callback = (options: GenericOAuthOptions) =>
 					}
 					const updateData = Object.fromEntries(
 						Object.entries({
-							accessToken: tokens.accessToken,
+							accessToken: await setTokenUtil(tokens.accessToken, ctx.context),
 							idToken: tokens.idToken,
-							refreshToken: tokens.refreshToken,
+							refreshToken: await setTokenUtil(
+								tokens.refreshToken,
+								ctx.context,
+							),
 							accessTokenExpiresAt: tokens.accessTokenExpiresAt,
 							refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
 							scope: tokens.scopes?.join(","),
@@ -452,11 +456,11 @@ export const oAuth2Callback = (options: GenericOAuthOptions) =>
 						userId: link.userId,
 						providerId: providerConfig.providerId,
 						accountId: userInfo.id,
-						accessToken: tokens.accessToken,
+						accessToken: await setTokenUtil(tokens.accessToken, ctx.context),
 						accessTokenExpiresAt: tokens.accessTokenExpiresAt,
 						refreshTokenExpiresAt: tokens.refreshTokenExpiresAt,
 						scope: tokens.scopes?.join(","),
-						refreshToken: tokens.refreshToken,
+						refreshToken: await setTokenUtil(tokens.refreshToken, ctx.context),
 						idToken: tokens.idToken,
 					});
 					if (!newAccount) {