{"record":{"id":"96b23cf686b26aa5","repo":"hcengineering/platform","slug":"invalid-account-uuid-accountuuid","errorCode":null,"errorMessage":"Invalid account uuid: \"${accountUuid}\"","messagePattern":"Invalid account uuid: \"(.+?)\"","errorType":"exception","errorClass":"TokenError","httpStatus":null,"severity":"error","filePath":"foundations/core/packages/token/src/token.ts","lineNumber":68,"sourceCode":"}\n\n/**\n * @public\n */\nexport function generateToken (\n  accountUuid: PersonUuid,\n  workspaceUuid?: WorkspaceUuid,\n  extra?: Record<string, string>,\n  secret?: string,\n  options?: {\n    grant?: PermissionsGrant\n    nbf?: number\n    exp?: number\n    sub?: PersonUuid\n  }\n): string {\n  if (!validate(accountUuid)) {\n    throw new TokenError(`Invalid account uuid: \"${accountUuid}\"`)\n  }\n  if (workspaceUuid !== undefined && !validate(workspaceUuid)) {\n    throw new TokenError(`Invalid workspace uuid: \"${workspaceUuid}\"`)\n  }\n  const { grant, nbf, exp, sub } = options ?? {}\n  if (grant?.workspace !== undefined && !validate(grant?.workspace)) {\n    throw new TokenError(`Invalid grant workspace uuid: \"${grant?.workspace}\"`)\n  }\n\n  if (grant != null && sub == null && (nbf == null || exp == null)) {\n    throw new TokenError('nbf and exp are required when sub is not provided')\n  }\n\n  const service = getMetadata(serverPlugin.metadata.Service)\n  if (service !== undefined) {\n    extra = { service, ...extra }\n  }\n","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/core/packages/token/src/token.ts#L50-L86","documentation":"generateToken validates the accountUuid with a UUID validator before signing a token. If the string is not a valid UUID it throws a TokenError rather than embedding an invalid subject into a signed token.","triggerScenarios":"Calling generateToken (directly or via token/config/githubToken/gmailToken/devTool helpers) with an accountUuid that is undefined, empty, malformed, or not a canonical UUID string.","commonSituations":"Config values read from env vars or CLI args passed unvalidated, test fixtures with placeholder strings, IDs fetched from external systems that are not UUIDs.","solutions":["Validate the accountUuid with a UUID validator (e.g. crypto's validate) before calling generateToken","Fix the source of the id — check env/config/lookup actually produced a UUID","Log/inspect the offending value; verify it is not truncated or wrapped in quotes"],"exampleFix":"// before\nconst t = generateToken(process.env.ACCOUNT as string, workspaceUuid, ...)\n// after\nconst account = process.env.ACCOUNT ?? ''\nif (!validate(account)) throw new Error('ACCOUNT env must be a uuid')\nconst t = generateToken(account, workspaceUuid, ...)","handlingStrategy":"validation","validationCode":"import { validate } from '@tooee/uuid' // or your uuid lib\nif (typeof accountUuid !== 'string' || !validate(accountUuid)) {\n  throw new Error('accountUuid must be a valid UUID')\n}","typeGuard":"const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\nfunction isUuid(v: unknown): v is string {\n  return typeof v === 'string' && UUID_RE.test(v)\n}","tryCatchPattern":"try {\n  const token = generateToken(accountUuid, workspaceUuid, opts)\n} catch (e) {\n  if (e instanceof TokenError && e.message.includes('Invalid account uuid')) {\n    throw new ConfigError(`ACCOUNT id is not a uuid: got \"${accountUuid}\"`)\n  }\n  throw e\n}","preventionTips":["Validate ids at config-load time, not at token-generation time","Use a branded UUID type so raw strings cannot be passed accidentally","Check env vars exist and are well-formed before starting the app"],"tags":["uuid","validation","token"],"backgroundTag":"invalid-uuid-parameter","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}