fix: Server-level impersonation doesn't bypass 2FA when enabled (#14340)

## Description

- This PR solves the a sub-issue from
https://github.com/twentyhq/core-team-issues/issues/1421
- impersonation tokens bypasses 2FA as intended 
- Added Audit trails to cover all impersonation events
- Added Proper testing coverage

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
This commit is contained in:
Harshit Singh
2025-09-07 19:23:23 +05:30
committed by GitHub
parent 214375556a
commit b78d139db5
22 changed files with 365 additions and 61 deletions
@@ -48,7 +48,7 @@ export class CallWebhookJob {
webhookId: data.webhookId,
eventName: data.eventName,
};
const analytics = this.auditService.createContext({
const auditService = this.auditService.createContext({
workspaceId: data.workspaceId,
});
@@ -79,13 +79,13 @@ export class CallWebhookJob {
const success = response.status >= 200 && response.status < 300;
analytics.insertWorkspaceEvent(WEBHOOK_RESPONSE_EVENT, {
auditService.insertWorkspaceEvent(WEBHOOK_RESPONSE_EVENT, {
status: response.status,
success,
...commonPayload,
});
} catch (err) {
analytics.insertWorkspaceEvent(WEBHOOK_RESPONSE_EVENT, {
auditService.insertWorkspaceEvent(WEBHOOK_RESPONSE_EVENT, {
success: false,
...commonPayload,
...(err.response && { status: err.response.status }),