Promote foss-sandbox to foss-main - #21
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Add standard PR template
node-redis session and cache clients crash the process when Memorystore drops idle TLS connections. Add error handlers, pingInterval, TCP keepalive, and reconnect strategy to both the session-storage and cache-storage Redis clients.
- Use keepAlive: 30_000 (number) instead of keepAlive: true (boolean) since node-redis v4 types socket.keepAlive as number | false - Remove keepAliveInitialDelay which node-redis ignores - Cast redisClient as RedisClientType for redisInsStore compatibility
Fix Redis crash loop from unhandled socket errors
When SMB_CORPORATE_ID is set and AUTH_TYPE=SSO, decode the X-Auth-Request-Access-Token JWT payload and verify custom:is_corporate="true" and custom:corporate_id matches. Enforced in MiddlewareService (REST + GraphQL), JwtAuthGuard, and SsoProxyLoginController. No-op when env var is unset.
Requests without x-auth-request-access-token (MCP OAuth, API-key, internal) never went through oauth2-proxy and have no Cognito claims to validate. The middleware/guard paths now silently skip instead of 403-ing. The proxy-login controller retains strict enforcement since it is always behind ForwardAuth.
Enforce corporate_id claim across all Twenty auth paths
The MCP OAuth /authorize page was lost during the SSO round-trip because returnToPath lived only in a Jotai atom destroyed by the full-page navigation to /auth/sso/proxy-login. Thread it as a query parameter so the controller can redirect back after setting the JWT cookie.
Fix MCP OAuth redirect staying on Twenty dashboard after SSO
LogDetails |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Promotes foss-sandbox changes to foss-main, including the fix for MCP OAuth redirect staying on Twenty dashboard after SSO login (returnToPath threading through proxy-login).