Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix auth exceptions #6590

Merged
merged 3 commits into from
Aug 9, 2024
Merged

Fix auth exceptions #6590

merged 3 commits into from
Aug 9, 2024

Conversation

Weiko
Copy link
Member

@Weiko Weiko commented Aug 9, 2024

A regression has been introduced in https://github.com/twentyhq/twenty/pull/6459/files#diff-0a06bf2b624f77f1b7ded0fcc4ce266d1a56f4329222b46d1cf4d76a18000c97L505 where 401 have been changed to 403. However the renew token logic on the FE expects a 401, see here https://github.com/twentyhq/twenty/blob/main/packages/twenty-front/src/modules/apollo/services/apollo.factory.ts#L100

I've also introduced a fix with a proxy class in GraphQLHydrateRequestFromTokenMiddleware since this middleware calls validateToken from tokenService which are never converted back to graphqlErrors so handleExceptionAndConvertToGraphQLError below will receive an AuthException and will send capture it and return it as a 500

both issues have been fixed and should resolve the renewToken logic

Test

tested locally by playing with token expiration dates in the env

Screenshot 2024-08-09 at 12 47 05

Copy link
Contributor

@greptile-apps greptile-apps bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PR Summary

The pull request addresses a regression where 401 errors were incorrectly changed to 403, affecting the frontend's token renewal logic. Key changes include introducing a new exception code UNAUTHENTICATED, updating error handling, and adding a proxy class for better exception management.

  • /packages/twenty-server/src/engine/core-modules/auth/auth.exception.ts: Added UNAUTHENTICATED to AuthExceptionCode enum.
  • /packages/twenty-server/src/engine/core-modules/auth/filters/auth-graphql-api-exception.filter.ts: Updated to handle UNAUTHENTICATED by throwing AuthenticationError.
  • /packages/twenty-server/src/engine/core-modules/auth/services/token.service.ts: Corrected error codes in verifyJwt method from 403 to 401.
  • /packages/twenty-server/src/engine/middlewares/graphql-hydrate-request-from-token.middleware.ts: Introduced GraphqlTokenValidationProxy to convert exceptions into GraphQL errors.

4 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings

@@ -564,12 +564,12 @@ export class TokenService {
if (error instanceof TokenExpiredError) {
throw new AuthException(
'Token has expired.',
AuthExceptionCode.FORBIDDEN_EXCEPTION,
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@thomtrp thomtrp merged commit b1aa115 into main Aug 9, 2024
6 checks passed
@thomtrp thomtrp deleted the c--fix-auth-exceptions branch August 9, 2024 12:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants