Compare commits

...
Author SHA1 Message Date
Sonarly Claude Code 56f21c3a7c Missing null-safe access on token pair property crashes SSE subscription during SSO login
https://sonarly.com/issue/9838?type=bug

A subscription hook accessing `tokenPair.accessToken.token` without optional chaining on the nested property throws a TypeError when users arrive at `/welcome` from Microsoft SSO and the token pair is in an intermediate authentication state.

Fix: ## Root Cause

`useIsLogged` returns `true` for any truthy `tokenPair` value (`!!tokenPair`), but during a Microsoft SSO redirect to `/welcome`, the `tokenPairState` cookie can contain a stale or partially-populated object that has the top-level object but lacks `accessOrWorkspaceAgnosticToken.token` (the nested path that SSE subscription code requires). This causes downstream consumers like `SSEClientEffect` and `SSEEventStreamEffect` to believe the user is fully authenticated and proceed with token-dependent operations that then crash on `undefined.token`.

## Fix

Use the already-existing `isValidAuthTokenPair` utility in `useIsLogged` so that `isLoggedIn` is only `true` when the token pair is structurally complete — i.e., `accessOrWorkspaceAgnosticToken` is a non-null object with a `token` string property. This is a 1-file, 2-line change.

```tsx file=packages/twenty-front/src/modules/auth/hooks/useIsLogged.ts lines=1-8
import { tokenPairState } from '@/auth/states/tokenPairState';
import { isValidAuthTokenPair } from '@/apollo/utils/isValidAuthTokenPair';
import { useAtomState } from '@/ui/utilities/state/jotai/hooks/useAtomState';

export const useIsLogged = (): boolean => {
  const [tokenPair] = useAtomState(tokenPairState);
  return isValidAuthTokenPair(tokenPair);
};
```

This prevents all `isLoggedIn`-gated SSE logic from running on a partially-populated token pair, eliminating the null-dereference on the nested `.token` property during SSO login flows.
2026-03-05 11:48:30 +00:00
@@ -1,7 +1,8 @@
import { tokenPairState } from '@/auth/states/tokenPairState';
import { isValidAuthTokenPair } from '@/apollo/utils/isValidAuthTokenPair';
import { useAtomState } from '@/ui/utilities/state/jotai/hooks/useAtomState';
export const useIsLogged = (): boolean => {
const [tokenPair] = useAtomState(tokenPairState);
return !!tokenPair;
return isValidAuthTokenPair(tokenPair);
};