Budibase/budibase · error

Invitation is not valid or has expired, please request a new

Error message

Invitation is not valid or has expired, please request a new one.

What it means

In fetchSharePointListDocument's item loop, a non-empty '@odata.nextLink' that fails isAllowedSharePointNextLink (not an https URL under graph.microsoft.com/v1.0) throws this HTTPError, aborting CSV generation. It is the SSRF/allowlist guard applied to list-items pagination.

Source

Thrown at packages/backend-core/src/cache/invite.ts:99

function toInviteWithCode(
  code: string,
  invite: InviteListEntry
): InviteWithCode {
  return {
    code,
    email: invite.email,
    info: invite.info,
  }
}

async function findInviteInList(code: string, tenantId: string) {
  const client = await redis.getInviteListClient()
  const list = normaliseInviteList(
    (await client.get(tenantId)) as InviteListPayload | undefined,
    tenantId
  )
  if (!list) {
    throw new Error(INVALID_INVITE_MESSAGE)
  }
  const inviteCodes = Object.keys(list.invites)
  if (!inviteCodes.includes(code)) {
    throw new Error(INVALID_INVITE_MESSAGE)
  }
  return { list, invite: list.invites[code] }
}

/**
 * Given an invite code and invite body, allow the update an existing/valid invite in redis
 * @param code The invite code for an invite in redis
 * @param value The body of the updated user invitation
 */
export async function updateCode(code: string, value: Invite) {
  const info: Invite["info"] = {
    ...value.info,
  }
  const tenantId = info.tenantId || getTenantId()

View on GitHub (pinned to a81a902e9a)

Solutions

1. Bypass response-rewriting proxies so Graph's absolute nextLinks arrive intact.
2. Fix test/mocked payloads to emit absolute https://graph.microsoft.com/v1.0/... nextLinks.
3. Investigate any TLS-intercepting appliances modifying response bodies.
4. Confirm the target tenant is on the global Microsoft Graph cloud.

if (page["@odata.nextLink"] && !/^https:\/\/graph\.microsoft\.com\/v1\.0\//.test(page["@odata.nextLink"])) {
  throw new Error("Environment is rewriting Microsoft Graph pagination URLs")
}

const isAbsoluteGraphLink = (v: unknown): v is string =>
  typeof v === "string" && (() => { try { return new URL(v).hostname === "graph.microsoft.com" } catch { return false } })()

try {
  await fetchSharePointListDocument(token, siteId, listId)
} catch (e) {
  if (e instanceof Error && e.message === "Invalid SharePoint pagination URL") {
    // audit proxy / mock / TLS-interception layer
  } else throw e
}

When it happens

Trigger: The items page JSON carries a nextLink that is relative, http://, on another host/port, or not parseable as a URL.

Common situations: Corporate proxy rewriting Graph payloads; hand-built mock responses in tests; sovereign cloud hostnames; MITM or corrupted responses.

Related errors

• Error getting status
• Could not refresh OAuth Token
• Invalid SharePoint pagination URL
• Error getting account by email ${email}
• Error getting account by tenantId ${tenantId}

AI-assisted analysis of Budibase/budibase@a81a902e9a (2026-08-29). Data as JSON: /api/errors/b16d9d6d0f7048fe. Report an issue: GitHub.