From 56f21c3a7cbafd85789fed3832b33964ddb044ff Mon Sep 17 00:00:00 2001 From: Sonarly Claude Code Date: Thu, 5 Mar 2026 11:48:30 +0000 Subject: [PATCH] Missing null-safe access on token pair property crashes SSE subscription during SSO login MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit https://sonarly.com/issue/9838?type=bug A subscription hook accessing `tokenPair.accessToken.token` without optional chaining on the nested property throws a TypeError when users arrive at `/welcome` from Microsoft SSO and the token pair is in an intermediate authentication state. Fix: ## Root Cause `useIsLogged` returns `true` for any truthy `tokenPair` value (`!!tokenPair`), but during a Microsoft SSO redirect to `/welcome`, the `tokenPairState` cookie can contain a stale or partially-populated object that has the top-level object but lacks `accessOrWorkspaceAgnosticToken.token` (the nested path that SSE subscription code requires). This causes downstream consumers like `SSEClientEffect` and `SSEEventStreamEffect` to believe the user is fully authenticated and proceed with token-dependent operations that then crash on `undefined.token`. ## Fix Use the already-existing `isValidAuthTokenPair` utility in `useIsLogged` so that `isLoggedIn` is only `true` when the token pair is structurally complete — i.e., `accessOrWorkspaceAgnosticToken` is a non-null object with a `token` string property. This is a 1-file, 2-line change. ```tsx file=packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts lines=1-8 import { tokenPairState } from '@/auth/states/tokenPairState'; import { isValidAuthTokenPair } from '@/apollo/utils/isValidAuthTokenPair'; import { useAtomState } from '@/ui/utilities/state/jotai/hooks/useAtomState'; export const useIsLogged = (): boolean => { const [tokenPair] = useAtomState(tokenPairState); return isValidAuthTokenPair(tokenPair); }; ``` This prevents all `isLoggedIn`-gated SSE logic from running on a partially-populated token pair, eliminating the null-dereference on the nested `.token` property during SSO login flows. --- packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts b/packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts index a7fda28fd9d..bd60f9c62e9 100644 --- a/packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts +++ b/packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts @@ -1,7 +1,8 @@ import { tokenPairState } from '@/auth/states/tokenPairState'; +import { isValidAuthTokenPair } from '@/apollo/utils/isValidAuthTokenPair'; import { useAtomState } from '@/ui/utilities/state/jotai/hooks/useAtomState'; export const useIsLogged = (): boolean => { const [tokenPair] = useAtomState(tokenPairState); - return !!tokenPair; + return isValidAuthTokenPair(tokenPair); };