Add WorkspaceAuthContextMiddleware (#17487)

## Context Introduces a middleware that automatically sets the workspace auth context in AsyncLocalStorage for HTTP requests, making it available throughout the request lifecycle without explicit parameter passing. The motivation behind this change is to reduce boilerplate and simplify the developer experience when working with workspace data in HTTP request handlers. The Problem (Before) Every HTTP request handler that needed to access workspace data had to: - Extract auth-related info from decorators (@AuthWorkspace(), @AuthUserWorkspaceId(), etc.) in controller/resolver and pass down to services - Build or pass the authContext explicitly (sometimes with type assertion which was flaky) Then call executeInWorkspaceContext(authContext, async () => { ... }) ## Changes - Add WorkspaceAuthContextMiddleware that extracts auth context from the request and stores it in AsyncLocalStorage - Register middleware for GraphQL, metadata, and REST routes (runs after hydration middlewares) - Simplify executeInWorkspaceContext signature: fn is now the first parameter, authContext is optional second - If authContext is not provided, it's automatically retrieved from the storage (set by middleware) - Update all callers (~120 files) to use the new parameter order - Fixes a bug in search where system auth context was used, bypassing RLS feature.
2026-01-27 18:24:51 +01:00
parent dd98146c99
commit 2daebc6d0f
151 changed files with 3743 additions and 4002 deletions
@@ -36,132 +36,129 @@ export class BlocklistItemDeleteMessagesJob {

    const authContext = buildSystemAuthContext(workspaceId);

-    await this.globalWorkspaceOrmManager.executeInWorkspaceContext(
-      authContext,
-      async () => {
-        const blocklistItemIds = data.events.map(
-          (eventPayload) => eventPayload.recordId,
+    await this.globalWorkspaceOrmManager.executeInWorkspaceContext(async () => {
+      const blocklistItemIds = data.events.map(
+        (eventPayload) => eventPayload.recordId,
+      );
+
+      const blocklistRepository =
+        await this.globalWorkspaceOrmManager.getRepository<BlocklistWorkspaceEntity>(
+          workspaceId,
+          'blocklist',
        );

-        const blocklistRepository =
-          await this.globalWorkspaceOrmManager.getRepository<BlocklistWorkspaceEntity>(
-            workspaceId,
-            'blocklist',
-          );
+      const blocklist = await blocklistRepository.find({
+        where: {
+          id: Any(blocklistItemIds),
+        },
+      });

-        const blocklist = await blocklistRepository.find({
-          where: {
-            id: Any(blocklistItemIds),
+      const handlesToDeleteByWorkspaceMemberIdMap = blocklist.reduce(
+        (acc, blocklistItem) => {
+          const { handle, workspaceMemberId } = blocklistItem;
+
+          if (!acc.has(workspaceMemberId)) {
+            acc.set(workspaceMemberId, []);
+          }
+
+          if (!isDefined(handle)) {
+            return acc;
+          }
+
+          acc.get(workspaceMemberId)?.push(handle);
+
+          return acc;
+        },
+        new Map<string, string[]>(),
+      );
+
+      const messageChannelRepository =
+        await this.globalWorkspaceOrmManager.getRepository<MessageChannelWorkspaceEntity>(
+          workspaceId,
+          'messageChannel',
+        );
+
+      const messageChannelMessageAssociationRepository =
+        await this.globalWorkspaceOrmManager.getRepository<MessageChannelMessageAssociationWorkspaceEntity>(
+          workspaceId,
+          'messageChannelMessageAssociation',
+        );
+
+      for (const workspaceMemberId of handlesToDeleteByWorkspaceMemberIdMap.keys()) {
+        const handles =
+          handlesToDeleteByWorkspaceMemberIdMap.get(workspaceMemberId);
+
+        if (!handles) {
+          continue;
+        }
+
+        const rolesToDelete = [
+          MessageParticipantRole.FROM,
+          MessageParticipantRole.TO,
+        ] as const;
+
+        const messageChannels = await messageChannelRepository.find({
+          select: {
+            id: true,
+            handle: true,
+            connectedAccount: {
+              handleAliases: true,
+            },
          },
+          where: {
+            connectedAccount: {
+              accountOwnerId: workspaceMemberId,
+            },
+          },
+          relations: ['connectedAccount'],
        });

-        const handlesToDeleteByWorkspaceMemberIdMap = blocklist.reduce(
-          (acc, blocklistItem) => {
-            const { handle, workspaceMemberId } = blocklistItem;
+        for (const messageChannel of messageChannels) {
+          const messageChannelHandles = [messageChannel.handle];

-            if (!acc.has(workspaceMemberId)) {
-              acc.set(workspaceMemberId, []);
-            }
+          if (messageChannel.connectedAccount.handleAliases) {
+            messageChannelHandles.push(
+              ...messageChannel.connectedAccount.handleAliases.split(','),
+            );
+          }

-            if (!isDefined(handle)) {
-              return acc;
-            }
+          const handleConditions = handles.map((handle) => {
+            const isHandleDomain = handle.startsWith('@');

-            acc.get(workspaceMemberId)?.push(handle);
+            return isHandleDomain
+              ? {
+                  handle: And(
+                    Or(ILike(`%${handle}`), ILike(`%.${handle.slice(1)}`)),
+                    Not(In(messageChannelHandles)),
+                  ),
+                  role: In(rolesToDelete),
+                }
+              : { handle, role: In(rolesToDelete) };
+          });

-            return acc;
-          },
-          new Map<string, string[]>(),
-        );
+          const messageChannelMessageAssociationsToDelete =
+            await messageChannelMessageAssociationRepository.find({
+              where: {
+                messageChannelId: messageChannel.id,
+                message: {
+                  messageParticipants: handleConditions,
+                },
+              },
+            });

-        const messageChannelRepository =
-          await this.globalWorkspaceOrmManager.getRepository<MessageChannelWorkspaceEntity>(
-            workspaceId,
-            'messageChannel',
-          );
-
-        const messageChannelMessageAssociationRepository =
-          await this.globalWorkspaceOrmManager.getRepository<MessageChannelMessageAssociationWorkspaceEntity>(
-            workspaceId,
-            'messageChannelMessageAssociation',
-          );
-
-        for (const workspaceMemberId of handlesToDeleteByWorkspaceMemberIdMap.keys()) {
-          const handles =
-            handlesToDeleteByWorkspaceMemberIdMap.get(workspaceMemberId);
-
-          if (!handles) {
+          if (messageChannelMessageAssociationsToDelete.length === 0) {
            continue;
          }

-          const rolesToDelete = [
-            MessageParticipantRole.FROM,
-            MessageParticipantRole.TO,
-          ] as const;
-
-          const messageChannels = await messageChannelRepository.find({
-            select: {
-              id: true,
-              handle: true,
-              connectedAccount: {
-                handleAliases: true,
-              },
-            },
-            where: {
-              connectedAccount: {
-                accountOwnerId: workspaceMemberId,
-              },
-            },
-            relations: ['connectedAccount'],
-          });
-
-          for (const messageChannel of messageChannels) {
-            const messageChannelHandles = [messageChannel.handle];
-
-            if (messageChannel.connectedAccount.handleAliases) {
-              messageChannelHandles.push(
-                ...messageChannel.connectedAccount.handleAliases.split(','),
-              );
-            }
-
-            const handleConditions = handles.map((handle) => {
-              const isHandleDomain = handle.startsWith('@');
-
-              return isHandleDomain
-                ? {
-                    handle: And(
-                      Or(ILike(`%${handle}`), ILike(`%.${handle.slice(1)}`)),
-                      Not(In(messageChannelHandles)),
-                    ),
-                    role: In(rolesToDelete),
-                  }
-                : { handle, role: In(rolesToDelete) };
-            });
-
-            const messageChannelMessageAssociationsToDelete =
-              await messageChannelMessageAssociationRepository.find({
-                where: {
-                  messageChannelId: messageChannel.id,
-                  message: {
-                    messageParticipants: handleConditions,
-                  },
-                },
-              });
-
-            if (messageChannelMessageAssociationsToDelete.length === 0) {
-              continue;
-            }
-
-            await messageChannelMessageAssociationRepository.delete(
-              messageChannelMessageAssociationsToDelete.map(({ id }) => id),
-            );
-          }
+          await messageChannelMessageAssociationRepository.delete(
+            messageChannelMessageAssociationsToDelete.map(({ id }) => id),
+          );
        }
+      }

-        await this.threadCleanerService.cleanOrphanMessagesAndThreads(
-          workspaceId,
-        );
-      },
-    );
+      await this.threadCleanerService.cleanOrphanMessagesAndThreads(
+        workspaceId,
+      );
+    }, authContext);
  }
 }
@@ -36,37 +36,32 @@ export class BlocklistReimportMessagesJob {

    const authContext = buildSystemAuthContext(workspaceId);

-    await this.globalWorkspaceOrmManager.executeInWorkspaceContext(
-      authContext,
-      async () => {
-        const messageChannelRepository =
-          await this.globalWorkspaceOrmManager.getRepository<MessageChannelWorkspaceEntity>(
-            workspaceId,
-            'messageChannel',
-          );
+    await this.globalWorkspaceOrmManager.executeInWorkspaceContext(async () => {
+      const messageChannelRepository =
+        await this.globalWorkspaceOrmManager.getRepository<MessageChannelWorkspaceEntity>(
+          workspaceId,
+          'messageChannel',
+        );

-        for (const eventPayload of data.events) {
-          const workspaceMemberId =
-            eventPayload.properties.before.workspaceMemberId;
+      for (const eventPayload of data.events) {
+        const workspaceMemberId =
+          eventPayload.properties.before.workspaceMemberId;

-          const messageChannels = await messageChannelRepository.find({
-            select: ['id'],
-            where: {
-              connectedAccount: {
-                accountOwnerId: workspaceMemberId,
-              },
-              syncStage: Not(
-                MessageChannelSyncStage.MESSAGE_LIST_FETCH_PENDING,
-              ),
+        const messageChannels = await messageChannelRepository.find({
+          select: ['id'],
+          where: {
+            connectedAccount: {
+              accountOwnerId: workspaceMemberId,
            },
-          });
+            syncStage: Not(MessageChannelSyncStage.MESSAGE_LIST_FETCH_PENDING),
+          },
+        });

-          await this.messagingChannelSyncStatusService.resetAndMarkAsMessagesListFetchPending(
-            messageChannels.map((messageChannel) => messageChannel.id),
-            workspaceId,
-          );
-        }
-      },
-    );
+        await this.messagingChannelSyncStatusService.resetAndMarkAsMessagesListFetchPending(
+          messageChannels.map((messageChannel) => messageChannel.id),
+          workspaceId,
+        );
+      }
+    }, authContext);
  }
 }