feat(auth): add workspaceId validation and token expiration #9134
Conversation
Added validation to ensure refresh tokens include a workspaceId, throwing an exception for malformed tokens. Included workspaceId in payloads and introduced expiration handling for access tokens. This enhances token security and prevents potential misuse.
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
Enhanced token security by implementing workspaceId validation and expiration handling for both access and refresh tokens in the authentication system.
- Added
expiresInparameter to access token signing in/packages/twenty-server/src/engine/core-modules/auth/token/services/access-token.service.tsfor automatic token expiration - Implemented workspaceId validation in
/packages/twenty-server/src/engine/core-modules/auth/token/services/refresh-token.service.tswith AuthException handling - Added workspaceId to refresh token payload structure for improved context validation
- Enhanced workspace membership verification before token generation
2 file(s) reviewed, no comment(s)
Edit PR Review Bot Settings | Greptile
| if (!token.workspaceId) { | ||
| throw new AuthException( | ||
| 'This refresh token is malformed', | ||
| AuthExceptionCode.INVALID_INPUT, | ||
| ); | ||
| } |
There was a problem hiding this comment.
This error allows the front to redirect to the login page when the token has no workspace.
Instead, it's a blocking error that forces the user to clean his browser storage.
There was a problem hiding this comment.
Users should all meet it when we will deploy.
In 90d it will be useless.
Added a TODO comment to mark the workspaceId validation for removal after March 31st. This prepares for planned cleanup and ensures clear communication of future changes.
|
Thanks @AMoreaux for your contribution! |
Added validation to ensure refresh tokens include a workspaceId, throwing an exception for malformed tokens. Included workspaceId in payloads and introduced expiration handling for access tokens. This enhances token security and prevents potential misuse.
Close #9126