lasagna
1a0588d233
## Summary Fixes #13008 Azure AD has a [known bug](https://learn.microsoft.com/en-us/answers/questions/5570899/our-adminconsent-url-always-fails-with-aadsts65005) where the first consent attempt for a multi-tenant app fails with `AADSTS650051` because the service principal is mid-provisioning in the target tenant. Microsoft's own engineers have acknowledged the issue with no fix ETA. This PR adds a transparent retry to the `MicrosoftOAuthGuard`: 1. When the OAuth redirect returns `AADSTS650051`, the guard parses the `state` parameter to recover the original query params (workspaceId, invite hash, locale, etc.) 2. Redirects the user back to `/auth/microsoft` with a `msRetry=1` counter 3. The full OAuth flow restarts — by this point the service principal has finished provisioning, so consent succeeds 4. Capped at 1 retry (`MAX_MICROSOFT_AUTH_RETRIES`) to prevent infinite loops. If it still fails, falls through to the normal error page From the user's perspective, they just see a brief extra redirect instead of a cryptic error page. ### Context - `AADSTS650051` is a race condition in Azure AD's service principal provisioning during multi-tenant app consent - It's distinct from missing consent (`AADSTS65001`) or admin consent required (`AADSTS90094`) - The error is transient — retrying the same flow immediately succeeds - Microsoft Q&A threads confirm this affects many multi-tenant apps, not just Twenty ### References - [Microsoft Q&A: adminconsent always fails with AADSTS650051 on first attempt](https://learn.microsoft.com/en-us/answers/questions/5570899/our-adminconsent-url-always-fails-with-aadsts65005) - [Microsoft Q&A: AADSTS650051 for multiple applications](https://learn.microsoft.com/en-us/answers/questions/5571098/when-customers-attempt-to-sign-in-and-grant-consen) ## Test plan - [ ] Deploy to a staging environment with Microsoft OAuth enabled - [ ] Have a user from a new Azure AD tenant attempt Microsoft sign-in for the first time - [ ] If AADSTS650051 occurs, verify the user is transparently retried and signs in successfully - [ ] Verify `msRetry` counter prevents infinite redirect loops (check server logs for the warn message) - [ ] Verify normal Microsoft sign-in flow (no error) is unaffected 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: neo773 <62795688+neo773@users.noreply.github.com> Co-authored-by: neo773 <neo773@protonmail.com>
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Why Twenty
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Jotai, Linaria and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!