Db.asSystem uses a plain QSession, so OAuth2 hosts fail ConfigSync with JWTDecodeException ("The token is null") #16

New Issue

2026-10-14T17:09:47Z

KofTwentyTwo commented

2026-10-14 17:09:47 +00:00

(Migrated from github.com)

internal/Db.systemSession builds an anonymous new QSession() { hasPermission -> true } (present in RC.2 through RC.4 and on develop). When a host uses OAuth2AuthenticationModule, ActionHelper.validateSession calls isSessionValid. That method only short-circuits for QSystemUserSession; for any other session it JWT-decodes the access token of the session UUID, which is null here:

JWTDecodeException: The token is null.
  at OAuth2AuthenticationModule.isSessionValid(OAuth2AuthenticationModule.java:402)
  at ActionHelper.validateSession / QueryAction.execute
  at objectstorage.internal.Db.query -> Db.first -> ConfigSync.upsertConnection
  at Db.asSystem -> ConfigSync.sync -> ConfigSync.ensureSynced -> SystemStorage.bucket

Effect in kof22. On every system-context bucket lookup (for example, each Backups qbit read and write), ConfigSync logs WARN Could not sync the storage configuration to its tables, and the connection, bucket and capability rows are never upserted. The storage writes themselves still succeed.

Suggested fix. Build the session as QSystemUserSession, keeping the security keys systemSession adds today. Core's auth modules then accept it without decoding anything.

Found while verifying KofTwentyTwo/Website-Backend#135. QQQ 4.1.0-RC.6, qbit-object-storage 0.1.0-RC.2.

🤖 Generated with Claude Code

`internal/Db.systemSession` builds an anonymous `new QSession() { hasPermission -> true }` (present in RC.2 through RC.4 and on develop). When a host uses `OAuth2AuthenticationModule`, `ActionHelper.validateSession` calls `isSessionValid`. That method only short-circuits for `QSystemUserSession`; for any other session it JWT-decodes the access token of the session UUID, which is null here: ``` JWTDecodeException: The token is null. at OAuth2AuthenticationModule.isSessionValid(OAuth2AuthenticationModule.java:402) at ActionHelper.validateSession / QueryAction.execute at objectstorage.internal.Db.query -> Db.first -> ConfigSync.upsertConnection at Db.asSystem -> ConfigSync.sync -> ConfigSync.ensureSynced -> SystemStorage.bucket ``` **Effect in kof22.** On every system-context bucket lookup (for example, each Backups qbit read and write), `ConfigSync` logs `WARN Could not sync the storage configuration to its tables`, and the connection, bucket and capability rows are never upserted. The storage writes themselves still succeed. **Suggested fix.** Build the session as `QSystemUserSession`, keeping the security keys `systemSession` adds today. Core's auth modules then accept it without decoding anything. Found while verifying KofTwentyTwo/Website-Backend#135. QQQ 4.1.0-RC.6, qbit-object-storage 0.1.0-RC.2. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-object-storage#16