{"record":{"id":"ddc055a948f0d2c2","repo":"hcengineering/platform","slug":"invalid-grant-workspace-uuid-grant-workspace","errorCode":null,"errorMessage":"Invalid grant workspace uuid: \"${grant?.workspace}\"","messagePattern":"Invalid grant workspace uuid: \"(.+?)\"","errorType":"exception","errorClass":"TokenError","httpStatus":null,"severity":"error","filePath":"foundations/core/packages/token/src/token.ts","lineNumber":75,"sourceCode":"  workspaceUuid?: WorkspaceUuid,\n  extra?: Record<string, string>,\n  secret?: string,\n  options?: {\n    grant?: PermissionsGrant\n    nbf?: number\n    exp?: number\n    sub?: PersonUuid\n  }\n): string {\n  if (!validate(accountUuid)) {\n    throw new TokenError(`Invalid account uuid: \"${accountUuid}\"`)\n  }\n  if (workspaceUuid !== undefined && !validate(workspaceUuid)) {\n    throw new TokenError(`Invalid workspace uuid: \"${workspaceUuid}\"`)\n  }\n  const { grant, nbf, exp, sub } = options ?? {}\n  if (grant?.workspace !== undefined && !validate(grant?.workspace)) {\n    throw new TokenError(`Invalid grant workspace uuid: \"${grant?.workspace}\"`)\n  }\n\n  if (grant != null && sub == null && (nbf == null || exp == null)) {\n    throw new TokenError('nbf and exp are required when sub is not provided')\n  }\n\n  const service = getMetadata(serverPlugin.metadata.Service)\n  if (service !== undefined) {\n    extra = { service, ...extra }\n  }\n\n  const sanitizedGrant: PermissionsGrant | undefined =\n    grant !== undefined\n      ? {\n          workspace: grant.workspace,\n          role: grant.role,\n          grantedBy: grant.grantedBy,\n          firstName: grant.firstName,","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/hcengineering/platform/blob/63e28dc96483967b2fc21c881b3f1023c1de7718/foundations/core/packages/token/src/token.ts#L57-L93","documentation":"When options.grant.workspace is set, generateToken validates it is a real UUID before embedding it into the token's grant. This prevents signing tokens whose workspace grant references a malformed id.","triggerScenarios":"Passing grant: { workspace: '...' } with a workspace id that is undefined-ish, empty, or not a valid UUID (note the check only runs when the property is present).","commonSituations":"Constructing grants programmatically where the workspace id comes from a lookup that failed and returned a partial string; JSON config with placeholder values.","solutions":["Validate grant.workspace with a UUID validator before building the options object","Omit the workspace property entirely if there is no valid workspace grant","Fix the upstream lookup that produced the bad workspace id"],"exampleFix":"// before\nconst grant = { workspace: row.ws_id }\n// after\nconst grant = validate(row.ws_id) ? { workspace: row.ws_id } : undefined","handlingStrategy":"validation","validationCode":"const grant = grantWorkspace !== undefined\n  ? (isUuid(grantWorkspace) ? { workspace: grantWorkspace } : undefined)\n  : undefined\nif (grantWorkspace !== undefined && grant === undefined) {\n  throw new Error(`grant.workspace \"${grantWorkspace}\" is not a valid UUID`)\n}","typeGuard":"function isValidGrant(g: unknown): g is { workspace: string } {\n  return typeof g === 'object' && g !== null && 'workspace' in g && isUuid((g as any).workspace)\n}","tryCatchPattern":"try {\n  const token = generateToken(accountUuid, workspaceUuid, { grant })\n} catch (e) {\n  if (e instanceof TokenError && e.message.includes('Invalid grant workspace uuid')) {\n    throw new ConfigError(`grant.workspace \"${grant?.workspace}\" is malformed`)\n  }\n  throw e\n}","preventionTips":["Build grant objects only from validated uuid fields","Omit the workspace key rather than setting it to an empty/invalid value","Fix upstream lookups that can return partial ids"],"tags":["uuid","validation","token","grant"],"backgroundTag":"invalid-uuid-parameter","analyzedSha":"63e28dc96483967b2fc21c881b3f1023c1de7718","analyzedAt":"2026-08-29T15:21:27.377Z","schemaVersion":2},"datasetVersion":"2026-08-29T17:17:51.833Z"}