{"record":{"id":"77dc0bfcc8e036bb","repo":"Mintplex-Labs/anything-llm","slug":"public-token-is-required-to-validate-a-temporary-a","errorCode":null,"errorMessage":"Public token is required to validate a temporary auth token.","messagePattern":"Public token is required to validate a temporary auth token\\.","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"server/models/temporaryAuthToken.js","lineNumber":75,"sourceCode":"    await prisma.temporary_auth_tokens.deleteMany({\n      where: { userId: Number(userId) },\n    });\n    return true;\n  },\n\n  /**\n   * Validates a temporary auth token and returns the session token\n   * to be set in the browser localStorage for authentication.\n   * @param {string} publicToken - the token to validate against\n   * @returns {Promise<{sessionToken: string|null, token: import(\"@prisma/client\").temporary_auth_tokens & {user: import(\"@prisma/client\").users} | null, error: string | null}>}\n   */\n  validate: async function (publicToken = \"\") {\n    /** @type {import(\"@prisma/client\").temporary_auth_tokens & {user: import(\"@prisma/client\").users} | undefined | null} **/\n    let token;\n\n    try {\n      if (!publicToken)\n        throw new Error(\n          \"Public token is required to validate a temporary auth token.\"\n        );\n      token = await prisma.temporary_auth_tokens.findUnique({\n        where: { token: String(publicToken) },\n        include: { user: true },\n      });\n      if (!token) throw new Error(\"Invalid token.\");\n      if (token.expiresAt < new Date()) throw new Error(\"Token expired.\");\n      if (token.user.suspended) throw new Error(\"User account suspended.\");\n\n      // Create a new session token for the user valid for 30 days\n      const sessionToken = makeJWT(\n        { id: token.user.id, username: token.user.username },\n        process.env.JWT_EXPIRY\n      );\n\n      return { sessionToken, token, error: null };\n    } catch (error) {","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/Mintplex-Labs/anything-llm/blob/526360e320da9d1b36074be5ed64fe76e5bbfbbd/server/models/temporaryAuthToken.js#L57-L93","documentation":"Thrown by TemporaryAuthToken.validate when publicToken is falsy (empty string, null, undefined). Reached via the GET /request-token/sso/simple endpoint which reads request.query.token and passes it straight through. Tokens are single-use, time-boxed credentials for passwordless SSO login.","triggerScenarios":"GET /request-token/sso/simple with no 'token' query parameter, or with an empty one (e.g. /request-token/sso/simple?token=).","commonSituations":"SSO link is malformed, the token was stripped by a redirect/proxy, or the integration calling the endpoint forgot to append the token.","solutions":["Ensure the SSO login URL includes a non-empty 'token' query parameter (e.g. ?token=allm-tat-...).","Verify the upstream issuer (TemporaryAuthToken.issue) returned a token before building the link.","Check that no redirect or reverse proxy is dropping the query string."],"exampleFix":"// before\nconst url = `${baseURL}/request-token/sso/simple`;\n// after\nconst { token } = await TemporaryAuthToken.issue(userId);\nconst url = `${baseURL}/request-token/sso/simple?token=${encodeURIComponent(token)}`;","handlingStrategy":"validation","validationCode":"if (!publicToken || typeof publicToken !== 'string' || !publicToken.trim()) {\n  return respondWithError('Missing token');\n}","typeGuard":"const isNonEmptyToken = (t) => typeof t === 'string' && t.trim().length > 0;","tryCatchPattern":null,"preventionTips":["Build SSO links only after TemporaryAuthToken.issue returns a token.","URL-encode the token and verify the query string survives any redirects."],"tags":["sso","temporary-auth-token","validation","authentication"],"backgroundTag":null,"analyzedSha":"526360e320da9d1b36074be5ed64fe76e5bbfbbd","analyzedAt":"2026-08-13T01:45:47.170Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}