From c68eb3504309831196410aeba8a33c3fc5d9785c Mon Sep 17 00:00:00 2001
From: Etienne <45695613+etiennejouan@users.noreply.github.com>
Date: Thu, 4 Dec 2025 16:23:49 +0100
Subject: [PATCH] Remove suggestion in gql error for un-authenticated users
 (#16328)

Closes https://github.com/twentyhq/private-issues/issues/357
Closes https://github.com/twentyhq/private-issues/issues/358
---
 .../graphql-config/graphql-config.service.ts       |  4 ++--
 .../engine/api/graphql/metadata.module-factory.ts  |  4 ++--
 ...-suggestions-for-unauthenticated-users.hook.ts} |  4 +++-
 .../rules/remove-suggestion-in-errors.rule.ts      | 14 ++++++++++++++
 4 files changed, 21 insertions(+), 5 deletions(-)
 rename packages/twenty-server/src/engine/core-modules/graphql/hooks/{use-disable-introspection-for-unauthenticated-users.hook.ts => use-disable-introspection-and-suggestions-for-unauthenticated-users.hook.ts} (71%)
 create mode 100644 packages/twenty-server/src/engine/core-modules/graphql/rules/remove-suggestion-in-errors.rule.ts

diff --git a/packages/twenty-server/src/engine/api/graphql/graphql-config/graphql-config.service.ts b/packages/twenty-server/src/engine/api/graphql/graphql-config/graphql-config.service.ts
index d833158425..e8d0bc605d 100644
--- a/packages/twenty-server/src/engine/api/graphql/graphql-config/graphql-config.service.ts
+++ b/packages/twenty-server/src/engine/api/graphql/graphql-config/graphql-config.service.ts
@@ -34,7 +34,7 @@ import { CoreEngineModule } from 'src/engine/core-modules/core-engine.module';
 import { ExceptionHandlerService } from 'src/engine/core-modules/exception-handler/exception-handler.service';
 import { useSentryTracing } from 'src/engine/core-modules/exception-handler/hooks/use-sentry-tracing';
 import { useComputeComplexity } from 'src/engine/core-modules/graphql/hooks/use-compute-complexity.hook';
-import { useDisableIntrospectionForUnauthenticatedUsers } from 'src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook';
+import { useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers } from 'src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook';
 import { useGraphQLErrorHandlerHook } from 'src/engine/core-modules/graphql/hooks/use-graphql-error-handler.hook';
 import { I18nService } from 'src/engine/core-modules/i18n/i18n.service';
 import { MetricsService } from 'src/engine/core-modules/metrics/metrics.service';
@@ -73,7 +73,7 @@ export class GraphQLConfigService
         i18nService: this.i18nService,
         twentyConfigService: this.twentyConfigService,
       }),
-      useDisableIntrospectionForUnauthenticatedUsers(
+      useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers(
         this.twentyConfigService.get('NODE_ENV') === NodeEnvironment.PRODUCTION,
       ),
       useComputeComplexity(
diff --git a/packages/twenty-server/src/engine/api/graphql/metadata.module-factory.ts b/packages/twenty-server/src/engine/api/graphql/metadata.module-factory.ts
index ed0fa7c7ce..cc57b2d17e 100644
--- a/packages/twenty-server/src/engine/api/graphql/metadata.module-factory.ts
+++ b/packages/twenty-server/src/engine/api/graphql/metadata.module-factory.ts
@@ -8,7 +8,7 @@ import { MetadataGraphQLApiModule } from 'src/engine/api/graphql/metadata-graphq
 import { type CacheStorageService } from 'src/engine/core-modules/cache-storage/services/cache-storage.service';
 import { type ExceptionHandlerService } from 'src/engine/core-modules/exception-handler/exception-handler.service';
 import { useComputeComplexity } from 'src/engine/core-modules/graphql/hooks/use-compute-complexity.hook';
-import { useDisableIntrospectionForUnauthenticatedUsers } from 'src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook';
+import { useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers } from 'src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook';
 import { useGraphQLErrorHandlerHook } from 'src/engine/core-modules/graphql/hooks/use-graphql-error-handler.hook';
 import { type I18nService } from 'src/engine/core-modules/i18n/i18n.service';
 import { type MetricsService } from 'src/engine/core-modules/metrics/metrics.service';
@@ -43,7 +43,7 @@ export const metadataModuleFactory = async (
         cacheSetter: cacheStorageService.set.bind(cacheStorageService),
         operationsToCache: ['ObjectMetadataItems', 'FindAllCoreViews'],
       }),
-      useDisableIntrospectionForUnauthenticatedUsers(
+      useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers(
         twentyConfigService.get('NODE_ENV') === NodeEnvironment.PRODUCTION,
       ),
       useComputeComplexity(twentyConfigService.get('GRAPHQL_MAX_COMPLEXITY')),
diff --git a/packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook.ts b/packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook.ts
similarity index 71%
rename from packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook.ts
rename to packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook.ts
index 96a4c6c752..d1e2c8f24e 100644
--- a/packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-for-unauthenticated-users.hook.ts
+++ b/packages/twenty-server/src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook.ts
@@ -3,8 +3,9 @@ import { NoSchemaIntrospectionCustomRule } from 'graphql/validation/rules/custom
 import { isDefined } from 'twenty-shared/utils';
 
 import { type GraphQLContext } from 'src/engine/api/graphql/graphql-config/graphql-config.service';
+import { removeSuggestionInErrorsRule } from 'src/engine/core-modules/graphql/rules/remove-suggestion-in-errors.rule';
 
-export const useDisableIntrospectionForUnauthenticatedUsers = (
+export const useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers = (
   isProductionEnvironment: boolean,
 ): Plugin<GraphQLContext> => ({
   onValidate: ({ context, addValidationRule }) => {
@@ -12,6 +13,7 @@ export const useDisableIntrospectionForUnauthenticatedUsers = (
 
     if (!isAuthenticated && isProductionEnvironment) {
       addValidationRule(NoSchemaIntrospectionCustomRule);
+      addValidationRule(removeSuggestionInErrorsRule);
     }
   },
 });
diff --git a/packages/twenty-server/src/engine/core-modules/graphql/rules/remove-suggestion-in-errors.rule.ts b/packages/twenty-server/src/engine/core-modules/graphql/rules/remove-suggestion-in-errors.rule.ts
new file mode 100644
index 0000000000..25d4c05436
--- /dev/null
+++ b/packages/twenty-server/src/engine/core-modules/graphql/rules/remove-suggestion-in-errors.rule.ts
@@ -0,0 +1,14 @@
+import { type ASTVisitor, type ValidationContext } from 'graphql';
+
+export const removeSuggestionInErrorsRule = (
+  context: ValidationContext,
+): ASTVisitor => {
+  const originalReportError = context.reportError.bind(context);
+
+  context.reportError = (error) => {
+    error.message = error.message.replace(/ Did you mean[^?]*\?/g, '');
+    originalReportError(error);
+  };
+
+  return {};
+};