Sonarly Claude Code
c457a0266e
https://sonarly.com/issue/9509?type=bug Workspace-agnostic refresh tokens that have been renewed once embed `workspaceId: null` in their JWT payload, making all subsequent renewal attempts fail with "Invalid token type". Combined with a frontend race condition on OAuth redirects, this locks returning users out of the app. Fix: ## Two-layer fix for workspace-agnostic refresh token renewal failure ### Problem After one token renewal cycle, workspace-agnostic refresh tokens embed `workspaceId: null` in their JWT payload. On the next renewal attempt, `verifyJwtToken` in `jwt-wrapper.service.ts` uses the `in` operator (`'workspaceId' in payload`) which returns `true` even when the value is `null`, selecting `null` as `appSecretBody`. Since `isDefined(null)` is `false`, the token is rejected with "Invalid token type" — permanently locking the user out after their first renewal. ### Fix 1: Prevent new bad tokens (`renew-token.service.ts`) Changed `workspaceId` to `workspaceId ?? undefined` when calling `generateRefreshToken`. Since `undefined` values are omitted by `JSON.stringify` during JWT signing, the renewed refresh token will not contain a `workspaceId` key at all — matching the structure of the original first-generation token. ### Fix 2: Handle existing bad tokens (`jwt-wrapper.service.ts`) Added `isDefined(payload.workspaceId)` to the `'workspaceId' in payload` check, so tokens already in the wild with `workspaceId: null` will correctly fall through to `userId` as the secret body. This is backward-compatible: tokens with a valid `workspaceId` string are unaffected. ### Test Added a spec covering the workspace-agnostic renewal case with `workspaceId: null` from the DB entity, asserting that `generateRefreshToken` receives `workspaceId: undefined`.
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Why Twenty
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in Open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Jotai, Linaria and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!