snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/__snapshots__/jwt-asymmetric-signing.integration-spec.ts.snap

@@ -0,0 +1,29 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`JWT Asymmetric Signing - new ES256 + kid implementation (integration) rejects a token signed by a revoked kid (publicKey present, revokedAt set) 1`] = `
+{
+  "extensions": {
+    "code": "UNAUTHENTICATED",
+    "subCode": "UNAUTHENTICATED",
+    "userFriendlyMessage": {
+      "id": Any<String>,
+      "message": "You must be authenticated to perform this action.",
+    },
+  },
+  "message": "Token invalid.",
+}
+`;
+
+exports[`JWT Asymmetric Signing - new ES256 + kid implementation (integration) rejects a token whose kid was never registered without leaking a 500 1`] = `
+{
+  "extensions": {
+    "code": "UNAUTHENTICATED",
+    "subCode": "UNAUTHENTICATED",
+    "userFriendlyMessage": {
+      "id": Any<String>,
+      "message": "You must be authenticated to perform this action.",
+    },
+  },
+  "message": "Token invalid.",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/admin-panel-signing-keys.integration-spec.ts

@@ -0,0 +1,266 @@
+import { randomUUID } from 'crypto';
+
+import { gql } from 'graphql-tag';
+import * as jwt from 'jsonwebtoken';
+import { decodeJwtCompleteOrThrow } from 'test/integration/graphql/utils/decode-jwt-complete-or-throw.util';
+import { deleteUser } from 'test/integration/graphql/utils/delete-user.util';
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { signUp } from 'test/integration/graphql/utils/sign-up.util';
+import { signUpInNewWorkspace } from 'test/integration/graphql/utils/sign-up-in-new-workspace.util';
+import { makeAdminPanelAPIRequest } from 'test/integration/twenty-config/utils/make-admin-panel-api-request.util';
+
+import { type AccessTokenJwtPayload } from 'src/engine/core-modules/auth/types/access-token-jwt-payload.type';
+import { JwtTokenTypeEnum } from 'src/engine/core-modules/auth/types/jwt-token-type.enum';
+
+import {
+  PREVIOUS_PRIVATE_KEY_PEM,
+  PREVIOUS_PUBLIC_KEY_PEM,
+} from './jwt-key-rotation.fixture';
+
+const buildAccessTokenPayload = (payload: AccessTokenJwtPayload) => ({
+  sub: payload.sub,
+  userId: payload.userId,
+  workspaceId: payload.workspaceId,
+  workspaceMemberId: payload.workspaceMemberId,
+  userWorkspaceId: payload.userWorkspaceId,
+  authProvider: payload.authProvider,
+  isImpersonating: false,
+  type: JwtTokenTypeEnum.ACCESS,
+});
+
+const GET_SIGNING_KEYS = gql`
+  query GetSigningKeys {
+    getSigningKeys {
+      signingKeys {
+        id
+        publicKey
+        isCurrent
+        createdAt
+        revokedAt
+        verifyCountInWindow
+      }
+      legacyVerifyCountInWindow
+      verifyWindowDays
+    }
+  }
+`;
+
+const REVOKE_SIGNING_KEY = gql`
+  mutation RevokeSigningKey($id: UUID!) {
+    revokeSigningKey(id: $id) {
+      id
+      isCurrent
+      revokedAt
+    }
+  }
+`;
+
+describe('Admin panel signing keys (integration)', () => {
+  let sharedAccessToken: string;
+  let sharedAccessPayload: AccessTokenJwtPayload;
+
+  beforeAll(async () => {
+    const uniqueEmail = `admin-signing-keys-${randomUUID()}@example.com`;
+
+    const { data: signUpData } = await signUp({
+      input: { email: uniqueEmail, password: 'Test123!@#' },
+      expectToFail: false,
+    });
+
+    const workspaceAgnosticToken =
+      signUpData.signUp.tokens.accessOrWorkspaceAgnosticToken.token;
+
+    await global.testDataSource.query(
+      'UPDATE core."user" SET "isEmailVerified" = true WHERE email = $1',
+      [uniqueEmail],
+    );
+
+    const { data: workspaceData } = await signUpInNewWorkspace({
+      accessToken: workspaceAgnosticToken,
+      expectToFail: false,
+    });
+
+    const subdomainUrl =
+      workspaceData.signUpInNewWorkspace.workspace.workspaceUrls.subdomainUrl;
+    const loginToken = workspaceData.signUpInNewWorkspace.loginToken.token;
+
+    const { data: tokensData } = await getAuthTokensFromLoginToken({
+      loginToken,
+      origin: subdomainUrl,
+      expectToFail: false,
+    });
+
+    sharedAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+    sharedAccessPayload = jwt.decode(
+      sharedAccessToken,
+    ) as AccessTokenJwtPayload;
+  });
+
+  afterAll(async () => {
+    try {
+      await deleteUser({
+        accessToken: sharedAccessToken,
+        expectToFail: false,
+      });
+    } catch {
+      /* */
+    }
+  });
+
+  it('exposes signing keys with current marker and a 7-day window', async () => {
+    const response = await makeAdminPanelAPIRequest({
+      query: GET_SIGNING_KEYS,
+    });
+
+    expect(response.body.errors).toBeUndefined();
+
+    const payload = response.body.data?.getSigningKeys;
+
+    expect(payload).toBeDefined();
+    expect(payload.verifyWindowDays).toBe(7);
+    expect(Array.isArray(payload.signingKeys)).toBe(true);
+    expect(payload.signingKeys.length).toBeGreaterThan(0);
+
+    const currentKeys = payload.signingKeys.filter(
+      (signingKey: { isCurrent: boolean }) => signingKey.isCurrent === true,
+    );
+
+    expect(currentKeys).toHaveLength(1);
+    expect(currentKeys[0].revokedAt).toBeNull();
+    expect(typeof currentKeys[0].publicKey).toBe('string');
+    expect(typeof payload.legacyVerifyCountInWindow).toBe('number');
+  });
+
+  it('revokes a non-current signing key, keeps the current key active, and rejects tokens signed with the revoked kid', async () => {
+    const seededRow = await global.testDataSource.query(
+      `SELECT "id" FROM core."signingKey" WHERE "isCurrent" = true LIMIT 1`,
+    );
+    const seededCurrentKid: string = seededRow[0].id;
+
+    const obsoleteKid = randomUUID();
+
+    await global.testDataSource.query(
+      `INSERT INTO core."signingKey" ("id", "publicKey", "privateKey", "isCurrent")
+       VALUES ($1, $2, NULL, false)`,
+      [obsoleteKid, PREVIOUS_PUBLIC_KEY_PEM],
+    );
+
+    const tokenSignedByObsoleteKey = jwt.sign(
+      buildAccessTokenPayload(sharedAccessPayload),
+      PREVIOUS_PRIVATE_KEY_PEM,
+      { algorithm: 'ES256', keyid: obsoleteKid, expiresIn: '5m' },
+    );
+
+    const { data: userBeforeRevoke, errors: userBeforeRevokeErrors } =
+      await getCurrentUser({
+        accessToken: tokenSignedByObsoleteKey,
+        expectToFail: false,
+      });
+
+    expect(userBeforeRevokeErrors).toBeUndefined();
+    expect(userBeforeRevoke?.currentUser?.id).toBe(sharedAccessPayload.userId);
+
+    const response = await makeAdminPanelAPIRequest({
+      query: REVOKE_SIGNING_KEY,
+      variables: { id: obsoleteKid },
+    });
+
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data?.revokeSigningKey?.id).toBe(obsoleteKid);
+    expect(response.body.data?.revokeSigningKey?.isCurrent).toBe(false);
+    expect(response.body.data?.revokeSigningKey?.revokedAt).not.toBeNull();
+
+    const stillCurrentRows = await global.testDataSource.query(
+      `SELECT "id", "isCurrent", "revokedAt" FROM core."signingKey"
+       WHERE "id" = $1`,
+      [seededCurrentKid],
+    );
+
+    expect(stillCurrentRows[0].isCurrent).toBe(true);
+    expect(stillCurrentRows[0].revokedAt).toBeNull();
+
+    const { data: userAfterRevoke, errors: userAfterRevokeErrors } =
+      await getCurrentUser({
+        accessToken: tokenSignedByObsoleteKey,
+        expectToFail: true,
+      });
+
+    expect(userAfterRevoke?.currentUser).toBeFalsy();
+    expect(userAfterRevokeErrors).toBeDefined();
+
+    await global.testDataSource.query(
+      `DELETE FROM core."signingKey" WHERE "id" = $1`,
+      [obsoleteKid],
+    );
+  });
+
+  it('revokes the current signing key and the next sign mints a new current key', async () => {
+    const before = await global.testDataSource.query(
+      `SELECT "id" FROM core."signingKey" WHERE "isCurrent" = true LIMIT 1`,
+    );
+    const previousCurrentKid: string = before[0].id;
+
+    const response = await makeAdminPanelAPIRequest({
+      query: REVOKE_SIGNING_KEY,
+      variables: { id: previousCurrentKid },
+    });
+
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data?.revokeSigningKey?.isCurrent).toBe(false);
+    expect(response.body.data?.revokeSigningKey?.revokedAt).not.toBeNull();
+
+    const uniqueEmail = `signing-key-revoke-${randomUUID()}@example.com`;
+
+    const { data: signUpData } = await signUp({
+      input: { email: uniqueEmail, password: 'Test123!@#' },
+      expectToFail: false,
+    });
+
+    const workspaceAgnosticToken =
+      signUpData.signUp.tokens.accessOrWorkspaceAgnosticToken.token;
+
+    await global.testDataSource.query(
+      'UPDATE core."user" SET "isEmailVerified" = true WHERE email = $1',
+      [uniqueEmail],
+    );
+
+    const { data: workspaceData } = await signUpInNewWorkspace({
+      accessToken: workspaceAgnosticToken,
+      expectToFail: false,
+    });
+
+    const subdomainUrl =
+      workspaceData.signUpInNewWorkspace.workspace.workspaceUrls.subdomainUrl;
+    const loginToken = workspaceData.signUpInNewWorkspace.loginToken.token;
+
+    const { data: tokensData } = await getAuthTokensFromLoginToken({
+      loginToken,
+      origin: subdomainUrl,
+      expectToFail: false,
+    });
+
+    const accessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+    const decoded = decodeJwtCompleteOrThrow(accessToken);
+
+    expect(decoded.header.alg).toBe('ES256');
+    expect(decoded.header.kid).not.toBe(previousCurrentKid);
+
+    const { errors } = await getCurrentUser({
+      accessToken,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+
+    try {
+      await deleteUser({ accessToken, expectToFail: false });
+    } catch {
+      /* */
+    }
+  });
+});

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/jwt-asymmetric-signing.integration-spec.ts

@@ -0,0 +1,336 @@
+import { randomUUID } from 'crypto';
+
+import { isNonEmptyString } from '@sniptt/guards';
+import * as jwt from 'jsonwebtoken';
+import { decodeJwtCompleteOrThrow } from 'test/integration/graphql/utils/decode-jwt-complete-or-throw.util';
+import { deleteUser } from 'test/integration/graphql/utils/delete-user.util';
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { findManyApplications } from 'test/integration/graphql/utils/find-many-applications.util';
+import { generateApiKeyToken } from 'test/integration/graphql/utils/generate-api-key-token.util';
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { renewApplicationToken } from 'test/integration/graphql/utils/renew-application-token.util';
+import { renewToken } from 'test/integration/graphql/utils/renew-token.util';
+import { signUp } from 'test/integration/graphql/utils/sign-up.util';
+import { signUpInNewWorkspace } from 'test/integration/graphql/utils/sign-up-in-new-workspace.util';
+import { generateApplicationToken } from 'test/integration/metadata/suites/application/utils/generate-application-token.util';
+
+import { type AccessTokenJwtPayload } from 'src/engine/core-modules/auth/types/access-token-jwt-payload.type';
+import { type ApplicationAccessTokenJwtPayload } from 'src/engine/core-modules/auth/types/application-access-token-jwt-payload.type';
+import { JwtTokenTypeEnum } from 'src/engine/core-modules/auth/types/jwt-token-type.enum';
+import { API_KEY_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/api-key-data-seeds.constant';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+import {
+  PREVIOUS_KID,
+  PREVIOUS_PRIVATE_KEY_PEM,
+  PREVIOUS_PUBLIC_KEY_PEM,
+  REVOKED_KID,
+} from './jwt-key-rotation.fixture';
+
+const buildAccessTokenPayload = (payload: AccessTokenJwtPayload) => ({
+  sub: payload.sub,
+  userId: payload.userId,
+  workspaceId: payload.workspaceId,
+  workspaceMemberId: payload.workspaceMemberId,
+  userWorkspaceId: payload.userWorkspaceId,
+  authProvider: payload.authProvider,
+  isImpersonating: false,
+  type: JwtTokenTypeEnum.ACCESS,
+});
+
+describe('JWT Asymmetric Signing - new ES256 + kid implementation (integration)', () => {
+  let sharedAccessToken: string;
+  let sharedRefreshToken: string;
+  let sharedAccessPayload: AccessTokenJwtPayload;
+  let currentKid: string;
+
+  beforeAll(async () => {
+    const uniqueEmail = `jwt-asymmetric-${randomUUID()}@example.com`;
+
+    const { data: signUpData } = await signUp({
+      input: { email: uniqueEmail, password: 'Test123!@#' },
+      expectToFail: false,
+    });
+
+    const workspaceAgnosticToken =
+      signUpData.signUp.tokens.accessOrWorkspaceAgnosticToken.token;
+
+    await global.testDataSource.query(
+      'UPDATE core."user" SET "isEmailVerified" = true WHERE email = $1',
+      [uniqueEmail],
+    );
+
+    const { data: workspaceData } = await signUpInNewWorkspace({
+      accessToken: workspaceAgnosticToken,
+      expectToFail: false,
+    });
+
+    const subdomainUrl =
+      workspaceData.signUpInNewWorkspace.workspace.workspaceUrls.subdomainUrl;
+
+    const loginToken = workspaceData.signUpInNewWorkspace.loginToken.token;
+
+    const { data: tokensData } = await getAuthTokensFromLoginToken({
+      loginToken,
+      origin: subdomainUrl,
+      expectToFail: false,
+    });
+
+    sharedAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+    sharedRefreshToken =
+      tokensData.getAuthTokensFromLoginToken.tokens.refreshToken.token;
+    sharedAccessPayload = jwt.decode(
+      sharedAccessToken,
+    ) as AccessTokenJwtPayload;
+    currentKid = decodeJwtCompleteOrThrow(sharedAccessToken).header
+      .kid as string;
+  });
+
+  afterAll(async () => {
+    if (isNonEmptyString(sharedAccessToken)) {
+      try {
+        await deleteUser({
+          accessToken: sharedAccessToken,
+          expectToFail: false,
+        });
+      } catch {
+        /* */
+      }
+    }
+
+    await global.testDataSource.query(
+      `DELETE FROM core."signingKey" WHERE "id" = ANY($1::uuid[])`,
+      [[PREVIOUS_KID, REVOKED_KID]],
+    );
+  });
+
+  it('auto-generates an ES256 signing key on first boot and signs ACCESS tokens with kid + isCurrent row', async () => {
+    const decoded = decodeJwtCompleteOrThrow(sharedAccessToken);
+
+    expect(decoded.header.alg).toBe('ES256');
+    expect(isNonEmptyString(decoded.header.kid)).toBe(true);
+
+    const rows = await global.testDataSource.query(
+      `SELECT "id", "publicKey", "privateKey", "isCurrent", "revokedAt"
+       FROM core."signingKey" WHERE "id" = $1`,
+      [currentKid],
+    );
+
+    expect(rows).toHaveLength(1);
+    expect(rows[0].isCurrent).toBe(true);
+    expect(rows[0].revokedAt).toBeNull();
+    expect(isNonEmptyString(rows[0].publicKey)).toBe(true);
+    expect(isNonEmptyString(rows[0].privateKey)).toBe(true);
+    expect(rows[0].publicKey).toMatch(
+      /^-----BEGIN PUBLIC KEY-----[\s\S]+-----END PUBLIC KEY-----\s*$/,
+    );
+
+    const { data, errors } = await getCurrentUser({
+      accessToken: sharedAccessToken,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.currentUser).toBeDefined();
+  });
+
+  it('verifies a token signed by a previously rotated-out kid (privateKey null, public key still present)', async () => {
+    await global.testDataSource.query(
+      `INSERT INTO core."signingKey" ("id", "publicKey", "privateKey", "isCurrent")
+       VALUES ($1, $2, NULL, false)
+       ON CONFLICT ("id") DO NOTHING`,
+      [PREVIOUS_KID, PREVIOUS_PUBLIC_KEY_PEM],
+    );
+
+    const tokenSignedByPreviousKey = jwt.sign(
+      buildAccessTokenPayload(sharedAccessPayload),
+      PREVIOUS_PRIVATE_KEY_PEM,
+      { algorithm: 'ES256', keyid: PREVIOUS_KID, expiresIn: '5m' },
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(tokenSignedByPreviousKey);
+
+    expect(decoded.header.alg).toBe('ES256');
+    expect(decoded.header.kid).toBe(PREVIOUS_KID);
+    expect(decoded.header.kid).not.toBe(currentKid);
+
+    const { data, errors } = await getCurrentUser({
+      accessToken: tokenSignedByPreviousKey,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.currentUser?.id).toBe(sharedAccessPayload.userId);
+  });
+
+  it('rejects a token signed by a revoked kid (publicKey present, revokedAt set)', async () => {
+    await global.testDataSource.query(
+      `INSERT INTO core."signingKey" ("id", "publicKey", "privateKey", "isCurrent", "revokedAt")
+       VALUES ($1, $2, NULL, false, NOW())
+       ON CONFLICT ("id") DO UPDATE SET "revokedAt" = NOW(), "isCurrent" = false`,
+      [REVOKED_KID, PREVIOUS_PUBLIC_KEY_PEM],
+    );
+
+    const tokenSignedByRevokedKey = jwt.sign(
+      buildAccessTokenPayload(sharedAccessPayload),
+      PREVIOUS_PRIVATE_KEY_PEM,
+      { algorithm: 'ES256', keyid: REVOKED_KID, expiresIn: '5m' },
+    );
+
+    const { data, errors } = await getCurrentUser({
+      accessToken: tokenSignedByRevokedKey,
+      expectToFail: true,
+    });
+
+    expect(data?.currentUser).toBeFalsy();
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+
+  it('rejects a token whose kid was never registered without leaking a 500', async () => {
+    const unknownKid = '00000000-0000-4000-8000-000000000099';
+
+    const tokenSignedByOrphanKey = jwt.sign(
+      buildAccessTokenPayload(sharedAccessPayload),
+      PREVIOUS_PRIVATE_KEY_PEM,
+      { algorithm: 'ES256', keyid: unknownKid, expiresIn: '5m' },
+    );
+
+    const { data, errors } = await getCurrentUser({
+      accessToken: tokenSignedByOrphanKey,
+      expectToFail: true,
+    });
+
+    expect(data?.currentUser).toBeFalsy();
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+
+  it('round-trips a new ES256 REFRESH token through renewToken', async () => {
+    const response = await renewToken(sharedRefreshToken);
+
+    expect(response.body.errors).toBeUndefined();
+    expect(
+      isNonEmptyString(
+        response.body.data?.renewToken.tokens.accessOrWorkspaceAgnosticToken
+          .token,
+      ),
+    ).toBe(true);
+    expect(
+      isNonEmptyString(
+        response.body.data?.renewToken.tokens.refreshToken.token,
+      ),
+    ).toBe(true);
+  });
+});
+
+describe('JWT Asymmetric Signing - seeded-workspace tokens (integration)', () => {
+  const seededApiKeyId = API_KEY_DATA_SEED_IDS.ID_1;
+  const seededWorkspaceId = SEED_APPLE_WORKSPACE_ID;
+  let seededCurrentKid: string;
+  let seededApplicationId: string;
+
+  beforeAll(async () => {
+    const [{ id: currentKidRow }] = await global.testDataSource.query(
+      `SELECT "id" FROM core."signingKey" WHERE "isCurrent" = true LIMIT 1`,
+    );
+
+    seededCurrentKid = currentKidRow;
+
+    const { data: applicationsData } = await findManyApplications({
+      expectToFail: false,
+    });
+
+    const firstApplication = applicationsData.findManyApplications[0];
+
+    expect(firstApplication).toBeDefined();
+
+    seededApplicationId = firstApplication.id;
+  });
+
+  it('signs new API_KEY tokens with ES256 + kid and authenticates against the GraphQL API', async () => {
+    const response = await generateApiKeyToken({
+      apiKeyId: seededApiKeyId,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+    });
+
+    expect(response.body.errors).toBeUndefined();
+
+    const apiKeyToken: string =
+      response.body.data?.generateApiKeyToken.token ?? '';
+
+    expect(isNonEmptyString(apiKeyToken)).toBe(true);
+
+    const decoded = decodeJwtCompleteOrThrow(apiKeyToken);
+
+    expect(decoded.header.alg).toBe('ES256');
+    expect(decoded.header.kid).toBe(seededCurrentKid);
+
+    const { data, errors } = await findManyApplications({
+      accessToken: apiKeyToken,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.findManyApplications).toBeDefined();
+  });
+
+  it('signs new APPLICATION_ACCESS + APPLICATION_REFRESH tokens with ES256 + kid via generateApplicationToken', async () => {
+    const { data, errors } = await generateApplicationToken({
+      applicationId: seededApplicationId,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+
+    const { applicationAccessToken, applicationRefreshToken } =
+      data.generateApplicationToken;
+
+    const decodedAccess = decodeJwtCompleteOrThrow(
+      applicationAccessToken.token,
+    );
+    const decodedRefresh = decodeJwtCompleteOrThrow(
+      applicationRefreshToken.token,
+    );
+
+    expect(decodedAccess.header.alg).toBe('ES256');
+    expect(decodedAccess.header.kid).toBe(seededCurrentKid);
+    expect(decodedRefresh.header.alg).toBe('ES256');
+    expect(decodedRefresh.header.kid).toBe(seededCurrentKid);
+
+    const accessPayload = jwt.decode(
+      applicationAccessToken.token,
+    ) as ApplicationAccessTokenJwtPayload;
+
+    expect(accessPayload.type).toBe(JwtTokenTypeEnum.APPLICATION_ACCESS);
+    expect(accessPayload.workspaceId).toBe(seededWorkspaceId);
+    expect(accessPayload.applicationId).toBe(seededApplicationId);
+  });
+
+  it('round-trips a new ES256 APPLICATION_REFRESH token through renewApplicationToken', async () => {
+    const { data } = await generateApplicationToken({
+      applicationId: seededApplicationId,
+      expectToFail: false,
+    });
+
+    const response = await renewApplicationToken({
+      applicationRefreshToken:
+        data.generateApplicationToken.applicationRefreshToken.token,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+    });
+
+    expect(response.body.errors).toBeUndefined();
+
+    const renewed = response.body.data?.renewApplicationToken;
+
+    expect(isNonEmptyString(renewed?.applicationAccessToken.token)).toBe(true);
+    expect(isNonEmptyString(renewed?.applicationRefreshToken.token)).toBe(true);
+
+    expect(
+      decodeJwtCompleteOrThrow(renewed.applicationAccessToken.token).header.alg,
+    ).toBe('ES256');
+  });
+});

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/jwt-key-rotation.fixture.ts

@@ -0,0 +1,13 @@
+export const PREVIOUS_PRIVATE_KEY_PEM = `-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgc39GS4ubhdkNWp7L
+b8sC0ROUVBGNO8DvltFB9yHCDLWhRANCAASnreXZnMdvXRwuymcxYO0puFCnIQ9n
+xySPRmivfklUKwm00ZMXX3AxStxeqp0vr6qOu54JpPdRFfdeYp5E53OF
+-----END PRIVATE KEY-----`;
+
+export const PREVIOUS_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEp63l2ZzHb10cLspnMWDtKbhQpyEP
+Z8ckj0Zor35JVCsJtNGTF19wMUrcXqqdL6+qjrueCaT3URX3XmKeROdzhQ==
+-----END PUBLIC KEY-----`;
+
+export const PREVIOUS_KID = '00000000-0000-4000-8000-000000000001';
+export const REVOKED_KID = '00000000-0000-4000-8000-000000000002';

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/jwt-legacy-hs256-fallback.integration-spec.ts

@@ -0,0 +1,323 @@
+import { randomUUID } from 'crypto';
+
+import { isNonEmptyString } from '@sniptt/guards';
+import * as jwt from 'jsonwebtoken';
+import { decodeJwtCompleteOrThrow } from 'test/integration/graphql/utils/decode-jwt-complete-or-throw.util';
+import { deleteUser } from 'test/integration/graphql/utils/delete-user.util';
+import { findManyApplications } from 'test/integration/graphql/utils/find-many-applications.util';
+import { forgeLegacyHs256Token } from 'test/integration/graphql/utils/forge-legacy-hs256-token.util';
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { renewApplicationToken } from 'test/integration/graphql/utils/renew-application-token.util';
+import { renewToken } from 'test/integration/graphql/utils/renew-token.util';
+import { signUp } from 'test/integration/graphql/utils/sign-up.util';
+import { signUpInNewWorkspace } from 'test/integration/graphql/utils/sign-up-in-new-workspace.util';
+
+import { type AccessTokenJwtPayload } from 'src/engine/core-modules/auth/types/access-token-jwt-payload.type';
+import { type ApplicationRefreshTokenJwtPayload } from 'src/engine/core-modules/auth/types/application-refresh-token-jwt-payload.type';
+import { JwtTokenTypeEnum } from 'src/engine/core-modules/auth/types/jwt-token-type.enum';
+import { type LoginTokenJwtPayload } from 'src/engine/core-modules/auth/types/login-token-jwt-payload.type';
+import { type RefreshTokenJwtPayload } from 'src/engine/core-modules/auth/types/refresh-token-jwt-payload.type';
+import { type WorkspaceAgnosticTokenJwtPayload } from 'src/engine/core-modules/auth/types/workspace-agnostic-token-jwt-payload.type';
+import { AuthProviderEnum } from 'src/engine/core-modules/workspace/types/workspace.type';
+import { API_KEY_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/api-key-data-seeds.constant';
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const buildAccessTokenPayload = (payload: AccessTokenJwtPayload) => ({
+  sub: payload.sub,
+  userId: payload.userId,
+  workspaceId: payload.workspaceId,
+  workspaceMemberId: payload.workspaceMemberId,
+  userWorkspaceId: payload.userWorkspaceId,
+  authProvider: payload.authProvider,
+  isImpersonating: false,
+  type: JwtTokenTypeEnum.ACCESS,
+});
+
+describe('JWT Legacy HS256 no-kid fallback (integration)', () => {
+  let sharedAccessToken: string;
+  let sharedAccessPayload: AccessTokenJwtPayload;
+  let sharedRefreshPayload: RefreshTokenJwtPayload;
+  let sharedLoginPayload: LoginTokenJwtPayload;
+  let sharedWorkspaceAgnosticPayload: WorkspaceAgnosticTokenJwtPayload;
+  let sharedSubdomainUrl: string;
+
+  beforeAll(async () => {
+    const uniqueEmail = `jwt-legacy-${randomUUID()}@example.com`;
+
+    const { data: signUpData } = await signUp({
+      input: { email: uniqueEmail, password: 'Test123!@#' },
+      expectToFail: false,
+    });
+
+    const workspaceAgnosticToken =
+      signUpData.signUp.tokens.accessOrWorkspaceAgnosticToken.token;
+
+    sharedWorkspaceAgnosticPayload = jwt.decode(
+      workspaceAgnosticToken,
+    ) as WorkspaceAgnosticTokenJwtPayload;
+
+    await global.testDataSource.query(
+      'UPDATE core."user" SET "isEmailVerified" = true WHERE email = $1',
+      [uniqueEmail],
+    );
+
+    const { data: workspaceData } = await signUpInNewWorkspace({
+      accessToken: workspaceAgnosticToken,
+      expectToFail: false,
+    });
+
+    sharedSubdomainUrl =
+      workspaceData.signUpInNewWorkspace.workspace.workspaceUrls.subdomainUrl;
+
+    const loginToken = workspaceData.signUpInNewWorkspace.loginToken.token;
+
+    sharedLoginPayload = jwt.decode(loginToken) as LoginTokenJwtPayload;
+
+    const { data: tokensData } = await getAuthTokensFromLoginToken({
+      loginToken,
+      origin: sharedSubdomainUrl,
+      expectToFail: false,
+    });
+
+    sharedAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+    sharedAccessPayload = jwt.decode(
+      sharedAccessToken,
+    ) as AccessTokenJwtPayload;
+    sharedRefreshPayload = jwt.decode(
+      tokensData.getAuthTokensFromLoginToken.tokens.refreshToken.token,
+    ) as RefreshTokenJwtPayload;
+  });
+
+  afterAll(async () => {
+    if (isNonEmptyString(sharedAccessToken)) {
+      try {
+        await deleteUser({
+          accessToken: sharedAccessToken,
+          expectToFail: false,
+        });
+      } catch {
+        /* */
+      }
+    }
+  });
+
+  it('verifies a hand-crafted no-kid HS256 ACCESS token via the legacy fallback', async () => {
+    const legacyHs256Token = forgeLegacyHs256Token(
+      buildAccessTokenPayload(sharedAccessPayload),
+      sharedAccessPayload.workspaceId,
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(legacyHs256Token);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const { data, errors } = await getCurrentUser({
+      accessToken: legacyHs256Token,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.currentUser?.id).toBe(sharedAccessPayload.userId);
+  });
+
+  it('verifies a hand-crafted no-kid HS256 LOGIN token via the legacy fallback (round-trip through getAuthTokensFromLoginToken)', async () => {
+    const forgedLoginPayload: LoginTokenJwtPayload = {
+      sub: sharedLoginPayload.sub,
+      type: JwtTokenTypeEnum.LOGIN,
+      workspaceId: sharedLoginPayload.workspaceId,
+      authProvider:
+        sharedLoginPayload.authProvider ?? AuthProviderEnum.Password,
+    };
+
+    const forgedToken = forgeLegacyHs256Token(
+      forgedLoginPayload,
+      sharedLoginPayload.workspaceId,
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(forgedToken);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const { data, errors } = await getAuthTokensFromLoginToken({
+      loginToken: forgedToken,
+      origin: sharedSubdomainUrl,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(
+      isNonEmptyString(
+        data?.getAuthTokensFromLoginToken.tokens.accessOrWorkspaceAgnosticToken
+          .token,
+      ),
+    ).toBe(true);
+  });
+
+  it('verifies a hand-crafted no-kid HS256 WORKSPACE_AGNOSTIC token via the legacy fallback (round-trip through signUpInNewWorkspace)', async () => {
+    const forgedAgnosticPayload: WorkspaceAgnosticTokenJwtPayload = {
+      sub: sharedWorkspaceAgnosticPayload.sub,
+      userId: sharedWorkspaceAgnosticPayload.userId,
+      type: JwtTokenTypeEnum.WORKSPACE_AGNOSTIC,
+      authProvider:
+        sharedWorkspaceAgnosticPayload.authProvider ??
+        AuthProviderEnum.Password,
+    };
+
+    const forgedToken = forgeLegacyHs256Token(
+      forgedAgnosticPayload,
+      sharedWorkspaceAgnosticPayload.userId,
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(forgedToken);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const { data, errors } = await signUpInNewWorkspace({
+      accessToken: forgedToken,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(isNonEmptyString(data?.signUpInNewWorkspace.workspace.id)).toBe(
+      true,
+    );
+  });
+
+  it('verifies a hand-crafted no-kid HS256 REFRESH token via the legacy fallback (round-trip through renewToken)', async () => {
+    expect(isNonEmptyString(sharedRefreshPayload.jti)).toBe(true);
+
+    const forgedRefreshPayload = {
+      sub: sharedRefreshPayload.sub,
+      type: JwtTokenTypeEnum.REFRESH,
+      userId: sharedRefreshPayload.userId,
+      workspaceId: sharedRefreshPayload.workspaceId,
+      authProvider:
+        sharedRefreshPayload.authProvider ?? AuthProviderEnum.Password,
+      targetedTokenType:
+        sharedRefreshPayload.targetedTokenType ?? JwtTokenTypeEnum.ACCESS,
+    };
+
+    const forgedToken = forgeLegacyHs256Token(
+      forgedRefreshPayload,
+      sharedRefreshPayload.workspaceId ?? sharedRefreshPayload.userId,
+      { expiresIn: '5m', jwtid: sharedRefreshPayload.jti },
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(forgedToken);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const response = await renewToken(forgedToken);
+
+    expect(response.body.errors).toBeUndefined();
+    expect(
+      isNonEmptyString(
+        response.body.data?.renewToken.tokens.accessOrWorkspaceAgnosticToken
+          .token,
+      ),
+    ).toBe(true);
+  });
+});
+
+describe('JWT Legacy HS256 no-kid fallback - seeded-workspace tokens (integration)', () => {
+  const seededApiKeyId = API_KEY_DATA_SEED_IDS.ID_1;
+  const seededWorkspaceId = SEED_APPLE_WORKSPACE_ID;
+  let seededApplicationId: string;
+
+  beforeAll(async () => {
+    const { data: applicationsData } = await findManyApplications({
+      expectToFail: false,
+    });
+
+    const firstApplication = applicationsData.findManyApplications[0];
+
+    expect(firstApplication).toBeDefined();
+
+    seededApplicationId = firstApplication.id;
+  });
+
+  it('verifies the seeded legacy HS256 no-kid API_KEY token via the legacy fallback', async () => {
+    const decoded = decodeJwtCompleteOrThrow(API_KEY_ACCESS_TOKEN);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const { data, errors } = await findManyApplications({
+      accessToken: API_KEY_ACCESS_TOKEN,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.findManyApplications).toBeDefined();
+  });
+
+  it('verifies a hand-crafted no-kid HS256 API_KEY token via the legacy fallback', async () => {
+    const forgedPayload = {
+      sub: seededWorkspaceId,
+      type: JwtTokenTypeEnum.API_KEY,
+      workspaceId: seededWorkspaceId,
+    };
+
+    const forgedToken = forgeLegacyHs256Token(
+      forgedPayload,
+      seededWorkspaceId,
+      {
+        expiresIn: '5m',
+        jwtid: seededApiKeyId,
+      },
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(forgedToken);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const { data, errors } = await findManyApplications({
+      accessToken: forgedToken,
+      expectToFail: false,
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data?.findManyApplications).toBeDefined();
+  });
+
+  it('verifies a hand-crafted no-kid HS256 APPLICATION_REFRESH token via the legacy fallback (round-trip through renewApplicationToken)', async () => {
+    const forgedPayload: ApplicationRefreshTokenJwtPayload = {
+      sub: seededApplicationId,
+      type: JwtTokenTypeEnum.APPLICATION_REFRESH,
+      workspaceId: seededWorkspaceId,
+      applicationId: seededApplicationId,
+    };
+
+    const forgedToken = forgeLegacyHs256Token(
+      forgedPayload as unknown as Record<string, unknown> & {
+        type: JwtTokenTypeEnum;
+      },
+      seededWorkspaceId,
+    );
+
+    const decoded = decodeJwtCompleteOrThrow(forgedToken);
+
+    expect(decoded.header.alg).toBe('HS256');
+    expect(decoded.header.kid).toBeUndefined();
+
+    const response = await renewApplicationToken({
+      applicationRefreshToken: forgedToken,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+    });
+
+    expect(response.body.errors).toBeUndefined();
+
+    const renewed = response.body.data?.renewApplicationToken;
+
+    expect(isNonEmptyString(renewed?.applicationAccessToken.token)).toBe(true);
+    expect(isNonEmptyString(renewed?.applicationRefreshToken.token)).toBe(true);
+  });
+});

packages/twenty-server/test/integration/graphql/suites/auth/jwt-key-rotation/rotate-signing-keys-cron-job.integration-spec.ts

@@ -0,0 +1,105 @@
+/* @license Enterprise */
+
+import { isNonEmptyString } from '@sniptt/guards';
+import { decodeJwtCompleteOrThrow } from 'test/integration/graphql/utils/decode-jwt-complete-or-throw.util';
+import { findManyApplications } from 'test/integration/graphql/utils/find-many-applications.util';
+import { generateApiKeyToken } from 'test/integration/graphql/utils/generate-api-key-token.util';
+import { deleteConfigVariable } from 'test/integration/twenty-config/utils/delete-config-variable.util';
+import { updateConfigVariable } from 'test/integration/twenty-config/utils/update-config-variable.util';
+import { expectEventually } from 'test/integration/utils/expect-eventually.util';
+
+import { RotateSigningKeysCronJob } from 'src/engine/core-modules/jwt/crons/jobs/rotate-signing-keys.cron.job';
+import { MessageQueue } from 'src/engine/core-modules/message-queue/message-queue.constants';
+import { type MessageQueueService } from 'src/engine/core-modules/message-queue/services/message-queue.service';
+import { getQueueToken } from 'src/engine/core-modules/message-queue/utils/get-queue-token.util';
+import { API_KEY_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/api-key-data-seeds.constant';
+
+const SIGNING_KEY_ROTATION_DAYS_KEY = 'SIGNING_KEY_ROTATION_DAYS';
+
+describe('RotateSigningKeysCronJob (integration)', () => {
+  const seededApiKeyId = API_KEY_DATA_SEED_IDS.ID_1;
+  let cronQueue: MessageQueueService;
+
+  beforeAll(() => {
+    cronQueue = global.app.get<MessageQueueService>(
+      getQueueToken(MessageQueue.cronQueue),
+    );
+  });
+
+  afterAll(async () => {
+    await deleteConfigVariable({
+      input: { key: SIGNING_KEY_ROTATION_DAYS_KEY },
+    }).catch(() => {});
+  });
+
+  it('rotates the current JWT signing key when the cron command runs and keeps verifying tokens signed by the previous key', async () => {
+    const initialTokenResponse = await generateApiKeyToken({
+      apiKeyId: seededApiKeyId,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+    });
+
+    expect(initialTokenResponse.body.errors).toBeUndefined();
+
+    const initialApiKeyToken: string =
+      initialTokenResponse.body.data?.generateApiKeyToken.token ?? '';
+
+    expect(isNonEmptyString(initialApiKeyToken)).toBe(true);
+
+    const initialKid = decodeJwtCompleteOrThrow(initialApiKeyToken).header
+      .kid as string;
+
+    expect(isNonEmptyString(initialKid)).toBe(true);
+
+    const initialAuthCall = await findManyApplications({
+      accessToken: initialApiKeyToken,
+      expectToFail: false,
+    });
+
+    expect(initialAuthCall.errors).toBeUndefined();
+    expect(initialAuthCall.data?.findManyApplications).toBeDefined();
+
+    await updateConfigVariable({
+      input: { key: SIGNING_KEY_ROTATION_DAYS_KEY, value: 0 },
+    });
+
+    await cronQueue.add(RotateSigningKeysCronJob.name, {});
+
+    let rotatedApiKeyToken = '';
+
+    await expectEventually(async () => {
+      const rotatedTokenResponse = await generateApiKeyToken({
+        apiKeyId: seededApiKeyId,
+        accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+      });
+
+      expect(rotatedTokenResponse.body.errors).toBeUndefined();
+
+      rotatedApiKeyToken =
+        rotatedTokenResponse.body.data?.generateApiKeyToken.token ?? '';
+
+      expect(isNonEmptyString(rotatedApiKeyToken)).toBe(true);
+
+      const rotatedKid = decodeJwtCompleteOrThrow(rotatedApiKeyToken).header
+        .kid as string;
+
+      expect(isNonEmptyString(rotatedKid)).toBe(true);
+      expect(rotatedKid).not.toBe(initialKid);
+    });
+
+    const callWithPreviousToken = await findManyApplications({
+      accessToken: initialApiKeyToken,
+      expectToFail: false,
+    });
+
+    expect(callWithPreviousToken.errors).toBeUndefined();
+    expect(callWithPreviousToken.data?.findManyApplications).toBeDefined();
+
+    const callWithRotatedToken = await findManyApplications({
+      accessToken: rotatedApiKeyToken,
+      expectToFail: false,
+    });
+
+    expect(callWithRotatedToken.errors).toBeUndefined();
+    expect(callWithRotatedToken.data?.findManyApplications).toBeDefined();
+  });
+});