Fix server logs leak (#18423)

# Introduction

Previously the auth jwt stragegy would lod the whole user entity in the
auth user context
On an exception it would completely get logged on the pods


## Security layer
- 0/ Updating the type system ( devxp only though )
- 1/ The jwt auth stragegy only load a specific sub set of the user
entity
- 2/ Sanitizing at the exception log level directly in case of a user
context
- 3/ Sanitizing at the console driver

The last two sanitization could sound a bit redundant though they're
still good fallback to keep in case new path occurs in the cb
This commit is contained in:
Paul Rastoin
2026-03-05 14:40:23 +01:00
committed by GitHub
parent 647c32ff3e
commit 38ad0820c0
31 changed files with 147 additions and 75 deletions
@@ -29,7 +29,7 @@ import {
} from 'src/engine/core-modules/billing/utils/to-display-credits.util';
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { type UserEntity } from 'src/engine/core-modules/user/user.entity';
import { type AuthContextUser } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthApiKey } from 'src/engine/decorators/auth/auth-api-key.decorator';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
@@ -86,7 +86,7 @@ export class BillingResolver {
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, NoPermissionGuard)
async checkoutSession(
@AuthWorkspace() workspace: WorkspaceEntity,
@AuthUser() user: UserEntity,
@AuthUser() user: AuthContextUser,
@AuthUserWorkspaceId() userWorkspaceId: string,
@Args()
{
@@ -10,7 +10,7 @@ import { BillingPlanKey } from 'src/engine/core-modules/billing/enums/billing-pl
import { StripeCustomerService } from 'src/engine/core-modules/billing/stripe/services/stripe-customer.service';
import { StripeSDKService } from 'src/engine/core-modules/billing/stripe/stripe-sdk/services/stripe-sdk.service';
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { type AuthContextUser } from 'src/engine/core-modules/auth/types/auth-context.type';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
@Injectable()
@@ -42,7 +42,7 @@ export class StripeCheckoutService {
requirePaymentMethod = true,
withTrialPeriod,
}: {
user: UserEntity;
user: AuthContextUser;
workspace: Pick<WorkspaceEntity, 'id' | 'displayName'>;
stripeSubscriptionLineItems: Stripe.Checkout.SessionCreateParams.LineItem[];
successUrl?: string;
@@ -97,7 +97,7 @@ export class StripeCheckoutService {
requirePaymentMethod = false,
withTrialPeriod,
}: {
user: UserEntity;
user: AuthContextUser;
workspace: Pick<WorkspaceEntity, 'id' | 'displayName'>;
stripeSubscriptionLineItems: Stripe.Checkout.SessionCreateParams.LineItem[];
stripeCustomerId?: string;
@@ -2,11 +2,11 @@
import { type BillingPlanKey } from 'src/engine/core-modules/billing/enums/billing-plan-key.enum';
import { type BillingGetPricesPerPlanResult } from 'src/engine/core-modules/billing/types/billing-get-prices-per-plan-result.type';
import { type UserEntity } from 'src/engine/core-modules/user/user.entity';
import { type AuthContextUser } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
export type BillingPortalCheckoutSessionParameters = {
user: UserEntity;
user: AuthContextUser;
workspace: WorkspaceEntity;
billingPricesPerPlan: BillingGetPricesPerPlanResult;
successUrlPath?: string;