BREAKING CHANGE: Fix graphql errors #12775

charlesBochet · 2025-06-21T14:14:16Z

We were using a global ValidationPipe in main.ts. This is an issue as @controllers should return HttpExecption and @resolvers should return GraphqlErrors

Removing the global pipe and creating a ResolverValidationPipe able to generate GraphqlError. We also need to handle the exception in a filter to avoid nest to think it's unhandled and make it flow to logs

Next step:

it would be nice to have both @UsePipes(ResolverValidationPipe) + @UseFilters(GraphqlValidationExceptionFilter) come together. This should be possible if we create a @GraphQLResolver annotation

greptile-apps

PR Summary

Major overhaul of validation architecture across the server, moving from global validation to resolver-specific validation with new pipe implementations.

Significant security concern: CaptchaService now bypasses all CAPTCHA validation by always returning success, potentially exposing the system to automated attacks
Introduced ResolverValidationPipe for GraphQL and HttpControllerValidationPipe for REST endpoints, implementing proper validation using class-validator
Removed global validation pipe from main.ts in favor of module-specific validation pipes in GraphQL resolvers
Added consistent validation across key resolvers including FieldMetadataResolver and AuthResolver

_{8 files reviewed, 4 comments}
_{Edit PR Review Bot Settings | Greptile}

greptile-apps · 2025-06-21T14:14:43Z

packages/twenty-server/src/engine/core-modules/captcha/captcha.service.ts

@@ -10,12 +10,8 @@ export class CaptchaService implements CaptchaDriver {
  constructor(@Inject(CAPTCHA_DRIVER) private driver: CaptchaDriver) {}


logic: Driver is injected but never used. Either remove the injection or use the driver for validation.

greptile-apps · 2025-06-21T14:14:53Z

...enty-server/src/engine/core-modules/http-controller/pipes/http-controller-validation.pipe.ts

+  private toValidate(metatype: any): boolean {
+    const types = [String, Boolean, Number, Array, Object];


style: Replace 'any' type with 'Function | undefined' for better type safety

Suggested change

private toValidate(metatype: any): boolean {

const types = [String, Boolean, Number, Array, Object];

private toValidate(metatype: Function | undefined): boolean {

const types = [String, Boolean, Number, Array, Object];

greptile-apps · 2025-06-21T14:14:56Z

packages/twenty-server/src/engine/core-modules/graphql/pipes/resolver-validation.pipe.ts

+  private toValidate(metatype: unknown): boolean {
+    const types: unknown[] = [String, Boolean, Number, Array, Object];
+


logic: The types array is typed as unknown[] but contains concrete types. This could cause type safety issues. Use const types: Function[] instead for proper type checking.

Suggested change

private toValidate(metatype: unknown): boolean {

const types: unknown[] = [String, Boolean, Number, Array, Object];

private toValidate(metatype: unknown): boolean {

const types: Function[] = [String, Boolean, Number, Array, Object];

greptile-apps · 2025-06-21T14:14:56Z

packages/twenty-server/src/engine/core-modules/graphql/pipes/resolver-validation.pipe.ts

+  private formatErrorMessage(errors: ValidationError[]): string {
+    const messages = errors.flatMap((error) => {
+      if (error.constraints) {
+        return Object.values(error.constraints);
+      }
+
+      return [];
+    });


style: Consider handling nested validation errors by recursively processing error.children. Currently nested object validation errors might not be properly formatted.

github-actions · 2025-06-21T14:28:17Z

🚀 Preview Environment Ready!

Your preview environment is available at: http://bore.pub:56702

This environment will automatically shut down when the PR is closed or after 5 hours.

github-actions · 2025-06-21T15:12:42Z

📊 API Changes Report

GraphQL Schema Changes

[log]
Detected the following changes (2) between schemas:

[log] ✖ Type ClientConfig was removed
[log] ✖ Field clientConfig was removed from object type Query
[error] Detected 2 breaking changes
⚠️ Breaking changes or errors detected in GraphQL schema

[log] 
Detected the following changes (2) between schemas:

[log] ✖  Type ClientConfig was removed
[log] ✖  Field clientConfig was removed from object type Query
[error] Detected 2 breaking changes
Error generating diff

GraphQL Metadata Schema Changes

[log]
Detected the following changes (2) between schemas:

[log] ✖ Type ClientConfig was removed
[log] ✖ Field clientConfig was removed from object type Query
[error] Detected 2 breaking changes
⚠️ Breaking changes or errors detected in GraphQL metadata schema

[log] 
Detected the following changes (2) between schemas:

[log] ✖  Type ClientConfig was removed
[log] ✖  Field clientConfig was removed from object type Query
[error] Detected 2 breaking changes
Error generating diff

⚠️ Please review these API changes carefully before merging.

✅ Breaking Change Protocol

This PR title contains "breaking" and breaking changes were detected - the CI will fail as expected.

📝 Action Required: Please add BREAKING CHANGE: to your commit message to trigger a major version bump.

Example:

feat: add new API endpoint

BREAKING CHANGE: removed deprecated field from User schema

Weiko

LGTM, agree with the custom decorator

sentry-io · 2025-06-27T04:25:41Z

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

‼️ TypeError: options?.map is not a function in prod

_{Did you find this useful? React with a 👍 or 👎}

charlesBochet added 2 commits June 21, 2025 16:05

Separate graphql from controllers validation

2246ea5

Fix

667f1e4

greptile-apps bot reviewed Jun 21, 2025

View reviewed changes

Fix

7df5915

charlesBochet added 2 commits June 21, 2025 16:39

Fix

a672e1e

Fix

9fd691a

charlesBochet added 4 commits June 23, 2025 08:55

Fix

c72c4ed

Merge branch 'main' into fix-graphql-errors

f5a8edf

Fix

9596d3d

Fix

dd708aa

Weiko approved these changes Jun 23, 2025

View reviewed changes

Fix

8c1a983

charlesBochet changed the title ~~Fix graphql errors~~ BREAKING CHANGE: Fix graphql errors Jun 23, 2025

charlesBochet merged commit b76dac2 into main Jun 23, 2025
57 of 59 checks passed

charlesBochet deleted the fix-graphql-errors branch June 23, 2025 09:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

BREAKING CHANGE: Fix graphql errors #12775

BREAKING CHANGE: Fix graphql errors #12775

Uh oh!

charlesBochet commented Jun 21, 2025 •

edited

Loading

Uh oh!

greptile-apps bot left a comment

Uh oh!

greptile-apps bot Jun 21, 2025

Uh oh!

greptile-apps bot Jun 21, 2025

Uh oh!

greptile-apps bot Jun 21, 2025

Uh oh!

greptile-apps bot Jun 21, 2025

Uh oh!

github-actions bot commented Jun 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 21, 2025 •

edited

Loading

Uh oh!

Weiko left a comment

Uh oh!

Uh oh!

sentry-io bot commented Jun 27, 2025

Uh oh!

Uh oh!

		@@ -10,12 +10,8 @@ export class CaptchaService implements CaptchaDriver {
		constructor(@Inject(CAPTCHA_DRIVER) private driver: CaptchaDriver) {}

		private toValidate(metatype: any): boolean {
		const types = [String, Boolean, Number, Array, Object];

		private toValidate(metatype: unknown): boolean {
		const types: unknown[] = [String, Boolean, Number, Array, Object];

BREAKING CHANGE: Fix graphql errors #12775

BREAKING CHANGE: Fix graphql errors #12775

Uh oh!

Conversation

charlesBochet commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

PR Summary

Uh oh!

greptile-apps bot Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot Jun 21, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jun 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 API Changes Report

GraphQL Schema Changes

GraphQL Schema Changes

GraphQL Metadata Schema Changes

GraphQL Metadata Schema Changes

✅ Breaking Change Protocol

Uh oh!

Weiko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sentry-io bot commented Jun 27, 2025

Suspect Issues

Uh oh!

Uh oh!

charlesBochet commented Jun 21, 2025 •

edited

Loading

github-actions bot commented Jun 21, 2025 •

edited

Loading

github-actions bot commented Jun 21, 2025 •

edited

Loading