Enforce corporate_id claim across all Twenty auth paths - #19
Merged
Conversation
When SMB_CORPORATE_ID is set and AUTH_TYPE=SSO, decode the X-Auth-Request-Access-Token JWT payload and verify custom:is_corporate="true" and custom:corporate_id matches. Enforced in MiddlewareService (REST + GraphQL), JwtAuthGuard, and SsoProxyLoginController. No-op when env var is unset.
UsamaSadiq
force-pushed
the
usama/enforce-corporate-id-auth
branch
from
July 13, 2026 14:26
9a7de35 to
c90f4b6
Compare
Requests without x-auth-request-access-token (MCP OAuth, API-key, internal) never went through oauth2-proxy and have no Cognito claims to validate. The middleware/guard paths now silently skip instead of 403-ing. The proxy-login controller retains strict enforcement since it is always behind ForwardAuth.
UsamaSadiq
changed the title
LogDetails |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Layer 2 tenant isolation for Twenty: when
SMB_CORPORATE_IDis set, every proxy-routed request must carry a Cognito access token with a matchingcustom:corporate_idclaim. This closes the Bearer token bypass gap whereSKIP_JWT_BEARER_TOKENS=truein oauth2-proxy validates JWT signatures but not tenant isolation.Enforcement points (all gated on
AUTH_TYPE=SSO+SMB_CORPORATE_IDnon-empty):sso-proxy-login.controller.ts-- rejects at login/provisioning time (strictest: missing header = 403)jwt-auth.guard.ts-- rejects stale/mismatched tokens on guarded endpointsmiddleware.service.ts-- covershydrateRestRequestandhydrateGraphqlRequestNon-proxy traffic (MCP OAuth, API-key, internal service calls) does not carry the
x-auth-request-access-tokenheader and is silently skipped -- no 403 for paths that never went through oauth2-proxy.When
SMB_CORPORATE_IDis empty/unset (the default), all checks return immediately with no behavioral change.Testing
SMB_CORPORATE_IDunset (no regression)SMB_CORPORATE_IDset: browser login with matching corporate_id succeeds, mismatched gets 403SMB_CORPORATE_IDsetting