{"record":{"id":"6ec853fecab9f9de","repo":"hcengineering/platform","slug":"invalid-workspace-uuid-workspaceuuid","errorCode":null,"errorMessage":"Invalid workspace uuid: \"${workspaceUuid}\"","messagePattern":"Invalid workspace uuid: \"(.+?)\"","errorType":"exception","errorClass":"TokenError","httpStatus":null,"severity":"error","filePath":"foundations/core/packages/token/src/token.ts","lineNumber":71,"sourceCode":" * @public\n */\nexport function generateToken (\n  accountUuid: PersonUuid,\n  workspaceUuid?: WorkspaceUuid,\n  extra?: Record<string, string>,\n  secret?: string,\n  options?: {\n    grant?: PermissionsGrant\n    nbf?: number\n    exp?: number\n    sub?: PersonUuid\n  }\n): string {\n  if (!validate(accountUuid)) {\n    throw new TokenError(`Invalid account uuid: \"${accountUuid}\"`)\n  }\n  if (workspaceUuid !== undefined && !validate(workspaceUuid)) {\n    throw new TokenError(`Invalid workspace uuid: \"${workspaceUuid}\"`)\n  }\n  const { grant, nbf, exp, sub } = options ?? {}\n  if (grant?.workspace !== undefined && !validate(grant?.workspace)) {\n    throw new TokenError(`Invalid grant workspace uuid: \"${grant?.workspace}\"`)\n  }\n\n  if (grant != null && sub == null && (nbf == null || exp == null)) {\n    throw new TokenError('nbf and exp are required when sub is not provided')\n  }\n\n  const service = getMetadata(serverPlugin.metadata.Service)\n  if (service !== undefined) {\n    extra = { service, ...extra }\n  }\n\n  const sanitizedGrant: PermissionsGrant | undefined =\n    grant !== undefined\n      ? {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/core/packages/token/src/token.ts#L53-L89","documentation":"generateToken validates workspaceUuid only if provided, but a provided value that is not a valid UUID is rejected with a TokenError to prevent signing tokens with malformed workspace scoping.","triggerScenarios":"Calling generateToken with a workspaceUuid that is present but malformed — wrong length, non-hex characters, missing dashes, or a non-string value.","commonSituations":"Workspace ids taken from URL path segments, CSV/fixture data, or user input; config mistakes where an account uuid is pasted into the workspace slot.","solutions":["Validate workspaceUuid with a UUID validator before calling generateToken","Ensure the value comes from a trusted source that emits canonical UUIDs","Check argument order — account and workspace uuids are easy to swap"],"exampleFix":"// before\ngenerateToken(accountUuid, req.params.workspace, ...)\n// after\nconst ws = req.params.workspace\nif (!validate(ws)) return res.status(400).send('invalid workspace id')\ngenerateToken(accountUuid, ws, ...)","handlingStrategy":"validation","validationCode":"if (workspaceUuid !== undefined && !isUuid(workspaceUuid)) {\n  throw new Error('workspaceUuid must be a valid UUID when provided')\n}","typeGuard":"function isUuidOrUndefined(v: unknown): v is string | undefined {\n  return v === undefined || (typeof v === 'string' && UUID_RE.test(v))\n}","tryCatchPattern":"try {\n  const token = generateToken(accountUuid, workspaceUuid, opts)\n} catch (e) {\n  if (e instanceof TokenError && e.message.includes('Invalid workspace uuid')) {\n    throw new ConfigError(`workspace id \"${workspaceUuid}\" is not a uuid`)\n  }\n  throw e\n}","preventionTips":["Don't pass URL path segments or raw user input as uuids without validation","Watch for swapped argument order (account vs workspace)","Store workspace ids in typed fields, never free-form strings"],"tags":["uuid","validation","token"],"backgroundTag":"invalid-uuid-parameter","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}