{"record":{"id":"0925509704d8d084","repo":"Tencent/WeKnora","slug":"workspace-mismatch-got-d-want-d","errorCode":null,"errorMessage":"workspace mismatch: got %d want %d","messagePattern":"workspace mismatch: got (.+?) want (.+?)","errorType":"validation","errorClass":null,"httpStatus":401,"severity":"error","filePath":"internal/middleware/auth.go","lineNumber":649,"sourceCode":"\t})\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\tif token == nil || !token.Valid {\n\t\treturn \"\", errors.New(\"invalid external user token\")\n\t}\n\texp, err := claims.GetExpirationTime()\n\tif err != nil || exp == nil {\n\t\treturn \"\", errors.New(\"missing expiration\")\n\t}\n\tif time.Until(exp.Time) > maxExternalUserTokenTTL {\n\t\treturn \"\", fmt.Errorf(\"token lifetime exceeds %s\", maxExternalUserTokenTTL)\n\t}\n\tif nbf, nbfErr := claims.GetNotBefore(); nbfErr == nil && nbf != nil && time.Now().Before(nbf.Time) {\n\t\treturn \"\", errors.New(\"token not yet valid\")\n\t}\n\tif got := principalTenantIDFromClaims(claims); got != tenantID {\n\t\treturn \"\", fmt.Errorf(\"workspace mismatch: got %d want %d\", got, tenantID)\n\t}\n\tsub, _ := claims[\"sub\"].(string)\n\tsub = strings.TrimSpace(sub)\n\tif sub == \"\" {\n\t\treturn \"\", errors.New(\"missing subject\")\n\t}\n\treturn sub, nil\n}\n\nfunc validateExternalUserID(id string) error {\n\tid = strings.TrimSpace(id)\n\tif id == \"\" {\n\t\treturn errors.New(\"empty external user id\")\n\t}\n\tif len(id) > maxExternalUserIDLen {\n\t\treturn fmt.Errorf(\"external user id too long (max %d)\", maxExternalUserIDLen)\n\t}\n\tfor _, r := range id {","sourceCodeStart":631,"sourceCodeEnd":667,"githubUrl":"https://github.com/Tencent/WeKnora/blob/988cbb03305e055d8ebb7d46d9ac6cc0803cd074/internal/middleware/auth.go#L631-L667","documentation":"verifyExternalUserJWT in internal/middleware/auth.go:649 rejects tokens whose tenant/workspace claim does not match the tenant resolved for the request. principalTenantIDFromClaims extracts the workspace id from the claims; if it differs from the request's tenant ID the token is refused, preventing cross-workspace token reuse.","triggerScenarios":"A correctly signed token whose workspace/tenant claim is for tenant A is presented on a request authenticated as tenant B; principalTenantIDFromClaims returns a value != tenantID.","commonSituations":"Reusing one token across multiple workspaces; tenant ID changed (e.g. recreated workspace with new ID) but cached tokens still carry the old ID; client misconfigured with another workspace's token endpoint.","solutions":["Issue a token per workspace with the correct tenant/workspace claim.","Re-mint tokens after a workspace is recreated or its ID changes.","Verify the client is pointed at the intended tenant's API endpoint."],"exampleFix":"// before\nclaims := jwt.MapClaims{\"aud\": \"weknora\", \"sub\": uid} // no/mismatched workspace claim\n// after\nclaims := jwt.MapClaims{\"aud\": \"weknora\", \"sub\": uid, \"workspace_id\": tenantID}","handlingStrategy":"validation","validationCode":"if got := workspaceIDFromClaims(claims); got != requestTenantID { // mint token for the right workspace\n}","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"workspace mismatch\") {\n        // obtain a token bound to the current tenant/workspace id\n    }\n}","preventionTips":["Embed the workspace/tenant claim per token; never share tokens across workspaces.","Invalidate cached tokens when a workspace is recreated with a new ID.","Verify tenant resolution on both client and server after config changes."],"tags":["jwt","multi-tenancy","authorization"],"backgroundTag":"jwt-workspace-mismatch","analyzedSha":"988cbb03305e055d8ebb7d46d9ac6cc0803cd074","analyzedAt":"2026-09-02T14:41:08.344Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}