Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location:
packages/twenty-server/src/engine/core-modules/two-factor-authentication/two-factor-authentication.service.ts#L49-L52

Potential issue: The unit tests for the `TwoFactorAuthenticationService` are mocking the
wrong function. The tests set up a mock for `decryptVersionedWithLegacyFallback`, but
the service's implementation was updated to call `decryptVersionedOrThrow` instead. This
discrepancy means the tests are not correctly verifying the behavior of the new code
path and may produce misleading results, as the actual function call to
`decryptVersionedOrThrow` is not being mocked.

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-server/src/engine/core-modules/twenty-config/storage/__tests__/config-storage.service.spec.ts, line 85:

<comment>Test mock/expectations renamed to decryptVersionedWithLegacyFallback but production code calls decryptVersionedOrThrow. Tests will fail because the mock object won't have decryptVersionedOrThrow defined.</comment>

<file context>
@@ -82,7 +82,7 @@ describe('ConfigStorageService', () => {
           provide: SecretEncryptionService,
           useValue: {
-            decryptVersioned: jest.fn((value) => value),
+            decryptVersionedWithLegacyFallback: jest.fn((value) => value),
             encryptVersioned: jest.fn((value) => value),
           },
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-server/src/engine/core-modules/two-factor-authentication/two-factor-authentication.service.spec.ts, line 96:

<comment>Mock provides `decryptVersionedWithLegacyFallback` but service calls `decryptVersionedOrThrow`. Tests will fail at runtime because `decryptVersionedOrThrow` is `undefined` on the mock.</comment>

<file context>
@@ -93,7 +93,7 @@ describe('TwoFactorAuthenticationService', () => {
           useValue: {
             encryptVersioned: jest.fn(),
-            decryptVersioned: jest.fn(),
+            decryptVersionedWithLegacyFallback: jest.fn(),
           },
         },
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/utils/__tests__/build-env-var.spec.ts, line 15:

<comment>Test mock provides `decryptVersionedWithLegacyFallback` but `buildEnvVar` calls `decryptVersionedOrThrow` — tests will throw TypeError at runtime</comment>

<file context>
@@ -12,7 +12,7 @@ describe('buildEnvVar', () => {
         `enc:v2:deadbeef:${value}|${opts?.workspaceId ?? 'instance'}`,
     ),
-    decryptVersioned: jest.fn(
+    decryptVersionedWithLegacyFallback: jest.fn(
       (value: string, _opts?: { workspaceId?: string }) =>
         value.replace(/^enc:v2:[0-9a-f]+:/, '').replace(/\|.*$/, ''),
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-server/src/database/commands/secret-encryption-rotation/handlers/sensitive-config-storage-rotation.handler.ts, line 121:

<comment>Legacy fallback is unreachable for unprefixed ciphertext because the precheck still rejects non-`enc:` values. Cross-upgrade rotation can keep failing/marking errors for legacy rows instead of re-encrypting them.</comment>

<file context>
@@ -118,7 +118,7 @@ export class SensitiveConfigStorageRotationHandler extends SecretEncryptionRotat
 
     try {
-      const plaintext = this.secretEncryptionService.decryptVersioned(rawValue);
+      const plaintext = this.secretEncryptionService.decryptVersionedWithLegacyFallback(rawValue);
       const reEncrypted =
         this.secretEncryptionService.encryptVersioned(plaintext);
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/utils/build-env-var.ts, line 19:

<comment>Decryption is still prefix-gated, so `buildEnvVar` does not always attempt decrypt and silently passes through non-`enc:v2` values. This defeats the strict runtime read path intended by `decryptVersionedOrThrow`.

(Based on your team's feedback about always decrypting in buildEnvVar without envelope-prefix gating.) .</comment>

<file context>
@@ -16,7 +16,7 @@ export const buildEnvVar = (
       acc[flatApplicationVariable.key] =
         isNonEmptyString(value) && isEncryptedString(value)
-          ? secretEncryptionService.decryptVersioned(value, {
+          ? secretEncryptionService.decryptVersionedOrThrow(value, {
               workspaceId: flatApplicationVariable.workspaceId,
             })
</file context>