feat(workflow): use authContext in CRUD services for Common API migration (#16857)

## Summary This PR migrates workflow CRUD operations to properly use the Common API layer's authentication context, addressing the issues from the reverted PR #15875. The original PR was reverted because the Common API required passing either a User or an API Key for authentication, which was problematic for workflows. Since then, the "Application" concept was introduced in the Common API layer, allowing for token injection in serverless functions. This PR leverages the "Twenty Standard Application" concept for non-manual workflow triggers, providing a clean authentication path without the issues of user impersonation. ## Changes ### Core Infrastructure - **RecordCrudExecutionContext**: Replace `workspaceId` with full `authContext` - **WorkflowExecutionContext**: Add `authContext` field to carry authentication info - **ToolGeneratorContext/ToolSpecification**: Add optional `authContext` support for tool generation ### Authentication Flow - **WorkflowExecutionContextService**: Build appropriate auth context based on trigger type: - **Manual triggers**: Use user's workspace auth context with their role permissions - **Non-manual triggers**: Use Twenty Standard Application auth context (bypasses permission checks or uses default serverless function role) - **ApplicationService**: Add `findTwentyStandardApplicationOrThrow` method to retrieve the system application - **UserWorkspaceService**: Make relations configurable in `getUserWorkspaceForUserOrThrow` to load only what's needed ### CRUD Services Migration All 5 record CRUD services now receive `authContext` instead of `workspaceId`: - `CreateRecordService` - `UpdateRecordService` - `DeleteRecordService` - `FindRecordsService` - `UpsertRecordService` ### Workflow Actions All record CRUD workflow actions pass `executionContext.authContext` to the services: - `CreateRecordWorkflowAction` - `UpdateRecordWorkflowAction` - `DeleteRecordWorkflowAction` - `FindRecordsWorkflowAction` - `UpsertRecordWorkflowAction` ### AI Agent Integration - AI agent workflow action passes auth context to agent executor - Tool provider and MCP protocol service support auth context propagation ## Benefits - ✅ Proper authentication for workflow CRUD operations via Common API - ✅ Non-manual triggers use system application context (no user impersonation issues) - ✅ Manual triggers preserve user permissions correctly - ✅ Foundation for better permission handling in automated workflows - ✅ Cleaner separation between user-initiated and system-initiated operations ## Related - Reverted PR: #15875
2025-12-30 21:36:15 +01:00
parent 62e496f65d
commit 009e7e05f2
26 changed files with 218 additions and 143 deletions
@@ -1,10 +1,14 @@
 import { Injectable } from '@nestjs/common';

-import { isDefined } from 'twenty-shared/utils';
 import { FieldActorSource } from 'twenty-shared/types';
+import { isDefined } from 'twenty-shared/utils';

+import { type WorkspaceAuthContext } from 'src/engine/api/common/interfaces/workspace-auth-context.interface';
+
+import { ApplicationService } from 'src/engine/core-modules/application/application.service';
 import { UserWorkspaceService } from 'src/engine/core-modules/user-workspace/user-workspace.service';
 import { UserRoleService } from 'src/engine/metadata-modules/user-role/user-role.service';
+import { type WorkflowRunWorkspaceEntity } from 'src/modules/workflow/common/standard-objects/workflow-run.workspace-entity';
 import { type WorkflowExecutionContext } from 'src/modules/workflow/workflow-executor/types/workflow-execution-context.type';
 import { WorkflowRunWorkspaceService as WorkflowRunService } from 'src/modules/workflow/workflow-runner/workflow-run/workflow-run.workspace-service';

@@ -15,6 +19,7 @@ export class WorkflowExecutionContextService {
    private readonly workflowRunService: WorkflowRunService,
    private readonly userWorkspaceService: UserWorkspaceService,
    private readonly userRoleService: UserRoleService,
+    private readonly applicationService: ApplicationService,
  ) {}

  async getExecutionContext(runInfo: {
@@ -30,35 +35,84 @@ export class WorkflowExecutionContextService {
      workflowRun.createdBy.source === FieldActorSource.MANUAL &&
      isDefined(workflowRun.createdBy.workspaceMemberId);

-    let roleId: string | undefined;
-
    if (isActingOnBehalfOfUser) {
-      const workspaceMember =
-        await this.userWorkspaceService.getWorkspaceMemberOrThrow({
-          workspaceMemberId: workflowRun.createdBy.workspaceMemberId!,
-          workspaceId: runInfo.workspaceId,
-        });
-
-      const userWorkspace =
-        await this.userWorkspaceService.getUserWorkspaceForUserOrThrow({
-          userId: workspaceMember.userId,
-          workspaceId: runInfo.workspaceId,
-        });
-
-      roleId = await this.userRoleService.getRoleIdForUserWorkspace({
-        userWorkspaceId: userWorkspace.id,
-        workspaceId: runInfo.workspaceId,
-      });
+      return this.buildUserExecutionContext(workflowRun, runInfo.workspaceId);
    }

-    const rolePermissionConfig = roleId
-      ? { unionOf: [roleId] }
-      : { shouldBypassPermissionChecks: true as const };
+    return this.buildApplicationExecutionContext(
+      workflowRun,
+      runInfo.workspaceId,
+    );
+  }
+
+  private async buildUserExecutionContext(
+    workflowRun: WorkflowRunWorkspaceEntity,
+    workspaceId: string,
+  ): Promise<WorkflowExecutionContext> {
+    const workspaceMember =
+      await this.userWorkspaceService.getWorkspaceMemberOrThrow({
+        workspaceMemberId: workflowRun.createdBy.workspaceMemberId!,
+        workspaceId,
+      });
+
+    const userWorkspace =
+      await this.userWorkspaceService.getUserWorkspaceForUserOrThrow({
+        userId: workspaceMember.userId,
+        workspaceId,
+        relations: ['workspace', 'user'],
+      });
+
+    const roleId = await this.userRoleService.getRoleIdForUserWorkspace({
+      userWorkspaceId: userWorkspace.id,
+      workspaceId,
+    });
+
+    const authContext = {
+      user: userWorkspace.user,
+      apiKey: null,
+      application: null,
+      workspace: userWorkspace.workspace,
+      workspaceMemberId: workspaceMember.id,
+      userWorkspaceId: userWorkspace.id,
+    } as WorkspaceAuthContext;

    return {
-      isActingOnBehalfOfUser,
+      isActingOnBehalfOfUser: true,
+      initiator: workflowRun.createdBy,
+      rolePermissionConfig: { unionOf: [roleId] },
+      authContext,
+    };
+  }
+
+  private async buildApplicationExecutionContext(
+    workflowRun: WorkflowRunWorkspaceEntity,
+    workspaceId: string,
+  ): Promise<WorkflowExecutionContext> {
+    const { application, workspace } =
+      await this.applicationService.findTwentyStandardApplicationOrThrow(
+        workspaceId,
+      );
+
+    const rolePermissionConfig = isDefined(
+      application.defaultServerlessFunctionRoleId,
+    )
+      ? { unionOf: [application.defaultServerlessFunctionRoleId] }
+      : { shouldBypassPermissionChecks: true as const };
+
+    const authContext = {
+      user: null,
+      apiKey: null,
+      application,
+      workspace,
+      workspaceMemberId: undefined,
+      userWorkspaceId: undefined,
+    } as WorkspaceAuthContext;
+
+    return {
+      isActingOnBehalfOfUser: false,
      initiator: workflowRun.createdBy,
      rolePermissionConfig,
+      authContext,
    };
  }
 }
@@ -1,9 +1,12 @@
 import { type ActorMetadata } from 'twenty-shared/types';

+import { type WorkspaceAuthContext } from 'src/engine/api/common/interfaces/workspace-auth-context.interface';
+
 import { type RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';

 export type WorkflowExecutionContext = {
  isActingOnBehalfOfUser: boolean;
  initiator: ActorMetadata;
  rolePermissionConfig: RolePermissionConfig;
+  authContext: WorkspaceAuthContext;
 };
@@ -1,6 +1,7 @@
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';

+import { ApplicationModule } from 'src/engine/core-modules/application/application.module';
 import { UserWorkspaceModule } from 'src/engine/core-modules/user-workspace/user-workspace.module';
 import { AiAgentExecutionModule } from 'src/engine/metadata-modules/ai/ai-agent-execution/ai-agent-execution.module';
 import { AgentEntity } from 'src/engine/metadata-modules/ai/ai-agent/entities/agent.entity';
@@ -13,6 +14,7 @@ import { AiAgentWorkflowAction } from './ai-agent.workflow-action';

@Module({
  imports: [
+    ApplicationModule,
    AiAgentExecutionModule,
    AiBillingModule,
    TypeOrmModule.forFeature([AgentEntity]),
@@ -2,7 +2,7 @@ import { Injectable } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';

 import { resolveInput } from 'twenty-shared/utils';
-import { Repository } from 'typeorm';
+import { type Repository } from 'typeorm';

 import { type WorkflowAction } from 'src/modules/workflow/workflow-executor/interfaces/workflow-action.interface';

@@ -86,6 +86,7 @@ export class AiAgentWorkflowAction implements WorkflowAction {
            ? executionContext.initiator
            : undefined,
          rolePermissionConfig: executionContext.rolePermissionConfig,
+          authContext: executionContext.authContext,
        },
      );

@@ -69,7 +69,7 @@ export class CreateRecordWorkflowAction implements WorkflowAction {
    const toolOutput = await this.createRecordService.execute({
      objectName: workflowActionInput.objectName,
      objectRecord: workflowActionInput.objectRecord,
-      workspaceId,
+      authContext: executionContext.authContext,
      createdBy,
      rolePermissionConfig: executionContext.rolePermissionConfig,
    });
@@ -61,15 +61,13 @@ export class DeleteRecordWorkflowAction implements WorkflowAction {
      );
    }

-    const { workspaceId } = runInfo;
-
    const executionContext =
      await this.workflowExecutionContextService.getExecutionContext(runInfo);

    const toolOutput = await this.deleteRecordService.execute({
      objectName: workflowActionInput.objectName,
      objectRecordId: workflowActionInput.objectRecordId,
-      workspaceId,
+      authContext: executionContext.authContext,
      rolePermissionConfig: executionContext.rolePermissionConfig,
      soft: true,
    });
@@ -1,8 +1,8 @@
 import { Injectable } from '@nestjs/common';

 import {
-  FieldMetadataComplexOption,
-  FieldMetadataDefaultOption,
+  type FieldMetadataComplexOption,
+  type FieldMetadataDefaultOption,
 } from 'twenty-shared/types';
 import {
  computeRecordGqlOperationFilter,
@@ -112,7 +112,7 @@ export class FindRecordsWorkflowAction implements WorkflowAction {
      filter: gqlOperationFilter,
      orderBy: workflowActionInput.orderBy?.gqlOperationOrderBy,
      limit: workflowActionInput.limit,
-      workspaceId,
+      authContext: executionContext.authContext,
      rolePermissionConfig: executionContext.rolePermissionConfig,
    });

@@ -1,5 +1,6 @@
 import { Module } from '@nestjs/common';

+import { ApplicationModule } from 'src/engine/core-modules/application/application.module';
 import { RecordCrudModule } from 'src/engine/core-modules/record-crud/record-crud.module';
 import { UserWorkspaceModule } from 'src/engine/core-modules/user-workspace/user-workspace.module';
 import { UserRoleModule } from 'src/engine/metadata-modules/user-role/user-role.module';
@@ -14,6 +15,7 @@ import { WorkflowRunModule } from 'src/modules/workflow/workflow-runner/workflow

@Module({
  imports: [
+    ApplicationModule,
    RecordCrudModule,
    WorkflowRunModule,
    UserWorkspaceModule,
@@ -94,7 +94,7 @@ export class UpdateRecordWorkflowAction implements WorkflowAction {
      objectRecordId: workflowActionInput.objectRecordId,
      objectRecord: workflowActionInput.objectRecord,
      fieldsToUpdate: workflowActionInput.fieldsToUpdate,
-      workspaceId,
+      authContext: executionContext.authContext,
      updatedBy,
      rolePermissionConfig: executionContext.rolePermissionConfig,
    });
@@ -18,7 +18,7 @@ import { type WorkflowActionInput } from 'src/modules/workflow/workflow-executor
 import { type WorkflowActionOutput } from 'src/modules/workflow/workflow-executor/types/workflow-action-output.type';
 import { findStepOrThrow } from 'src/modules/workflow/workflow-executor/utils/find-step-or-throw.util';
 import { isWorkflowUpsertRecordAction } from 'src/modules/workflow/workflow-executor/workflow-actions/record-crud/guards/is-workflow-upsert-record-action.guard';
-import { WorkflowUpsertRecordActionInput } from 'src/modules/workflow/workflow-executor/workflow-actions/record-crud/types/workflow-record-crud-action-input.type';
+import { type WorkflowUpsertRecordActionInput } from 'src/modules/workflow/workflow-executor/workflow-actions/record-crud/types/workflow-record-crud-action-input.type';

@Injectable()
 export class UpsertRecordWorkflowAction implements WorkflowAction {
@@ -57,15 +57,13 @@ export class UpsertRecordWorkflowAction implements WorkflowAction {
      );
    }

-    const { workspaceId } = runInfo;
-
    const executionContext =
      await this.workflowExecutionContextService.getExecutionContext(runInfo);

    const toolOutput = await this.upsertRecordService.execute({
      objectName: workflowActionInput.objectName,
      objectRecord: workflowActionInput.objectRecord,
-      workspaceId,
+      authContext: executionContext.authContext,
      rolePermissionConfig: executionContext.rolePermissionConfig,
    });