From 388e49a8cfe6c5a100d78479af90a3b7c8291942 Mon Sep 17 00:00:00 2001 From: Etienne <45695613+etiennejouan@users.noreply.github.com> Date: Thu, 2 Oct 2025 18:35:58 +0200 Subject: [PATCH] fix impersonation guard on admin panel user lookup (#14845) Mistakenly remove ImpersonateGuard on userLookupAdminPanel resolver ([cf here](https://github.com/twentyhq/twenty/pull/14360/files#diff-01404fa6bc9b1350a87050b747889b299dc2deda50a62fe9b99327be3250bf96R49)) + Add AdminPanelGuard Re-create the previous ImpersonateGuard and add it to the resolver + Remove the AdminPanelGuard --- .../core-modules/admin-panel/admin-panel.resolver.ts | 3 ++- ...d.spec.ts => impersonate-permission-guard.spec.ts} | 0 .../engine/guards/server-level-impersonate.guard.ts | 11 +++++++++++ 3 files changed, 13 insertions(+), 1 deletion(-) rename packages/twenty-server/src/engine/guards/__tests__/{impersonate-guard.spec.ts => impersonate-permission-guard.spec.ts} (100%) create mode 100644 packages/twenty-server/src/engine/guards/server-level-impersonate.guard.ts diff --git a/packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts b/packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts index 76b9a6d449..3206f0f1a6 100644 --- a/packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts +++ b/packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts @@ -25,6 +25,7 @@ import { type ConfigVariables } from 'src/engine/core-modules/twenty-config/conf import { ConfigVariableGraphqlApiExceptionFilter } from 'src/engine/core-modules/twenty-config/filters/config-variable-graphql-api-exception.filter'; import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service'; import { AdminPanelGuard } from 'src/engine/guards/admin-panel-guard'; +import { ServerLevelImpersonateGuard } from 'src/engine/guards/server-level-impersonate.guard'; import { UserAuthGuard } from 'src/engine/guards/user-auth.guard'; import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard'; @@ -46,7 +47,7 @@ export class AdminPanelResolver { private readonly twentyConfigService: TwentyConfigService, ) {} - @UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard) + @UseGuards(WorkspaceAuthGuard, UserAuthGuard, ServerLevelImpersonateGuard) @Mutation(() => UserLookup) async userLookupAdminPanel( @Args() userLookupInput: UserLookupInput, diff --git a/packages/twenty-server/src/engine/guards/__tests__/impersonate-guard.spec.ts b/packages/twenty-server/src/engine/guards/__tests__/impersonate-permission-guard.spec.ts similarity index 100% rename from packages/twenty-server/src/engine/guards/__tests__/impersonate-guard.spec.ts rename to packages/twenty-server/src/engine/guards/__tests__/impersonate-permission-guard.spec.ts diff --git a/packages/twenty-server/src/engine/guards/server-level-impersonate.guard.ts b/packages/twenty-server/src/engine/guards/server-level-impersonate.guard.ts new file mode 100644 index 0000000000..872a035b55 --- /dev/null +++ b/packages/twenty-server/src/engine/guards/server-level-impersonate.guard.ts @@ -0,0 +1,11 @@ +import { type CanActivate, type ExecutionContext } from '@nestjs/common'; +import { GqlExecutionContext } from '@nestjs/graphql'; + +export class ServerLevelImpersonateGuard implements CanActivate { + canActivate(context: ExecutionContext): boolean | Promise { + const ctx = GqlExecutionContext.create(context); + const request = ctx.getContext().req; + + return request.user.canImpersonate === true; + } +}