Enable roles on api keys (#13334)

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/graphql-query-runner.module.ts

@@ -20,6 +20,7 @@ import { GraphqlQueryUpdateManyResolverService } from 'src/engine/api/graphql/gr
 import { GraphqlQueryUpdateOneResolverService } from 'src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-update-one-resolver.service';
 import { WorkspaceQueryHookModule } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.module';
 import { WorkspaceQueryRunnerModule } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-runner.module';
+import { ApiKeyModule } from 'src/engine/core-modules/api-key/api-key.module';
 import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 import { RoleTargetsEntity } from 'src/engine/metadata-modules/role/role-targets.entity';
 import { UserRoleModule } from 'src/engine/metadata-modules/user-role/user-role.module';
@@ -48,6 +49,7 @@ const graphqlQueryResolvers = [
     PermissionsModule,
     TypeOrmModule.forFeature([RoleTargetsEntity], 'core'),
     UserRoleModule,
+    ApiKeyModule,
   ],
   providers: [
     ProcessNestedRelationsHelper,

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/interfaces/base-resolver-service.ts

@@ -1,7 +1,6 @@
 import { Inject, Injectable } from '@nestjs/common';
 
 import graphqlFields from 'graphql-fields';
-import { PermissionsOnAllObjectRecords } from 'twenty-shared/constants';
 import { capitalize, isDefined } from 'twenty-shared/utils';
 import { ObjectLiteral } from 'typeorm';
 
@@ -23,7 +22,7 @@ import { QueryResultGettersFactory } from 'src/engine/api/graphql/workspace-quer
 import { QueryRunnerArgsFactory } from 'src/engine/api/graphql/workspace-query-runner/factories/query-runner-args.factory';
 import { workspaceQueryRunnerGraphqlApiExceptionHandler } from 'src/engine/api/graphql/workspace-query-runner/utils/workspace-query-runner-graphql-api-exception-handler.util';
 import { WorkspaceQueryHookService } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.service';
-import { RESOLVER_METHOD_NAMES } from 'src/engine/api/graphql/workspace-resolver-builder/constants/resolver-method-names';
+import { ApiKeyRoleService } from 'src/engine/core-modules/api-key/api-key-role.service';
 import { FeatureFlagKey } from 'src/engine/core-modules/feature-flag/enums/feature-flag-key.enum';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
 import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@@ -47,6 +46,7 @@ export type GraphqlQueryResolverExecutionArgs<Input extends ResolverArgs> = {
   graphqlQuerySelectedFieldsResult: GraphqlQuerySelectedFieldsResult;
   isExecutedByApiKey: boolean;
   roleId?: string;
+  shouldBypassPermissionChecks: boolean;
 };
 
 @Injectable()
@@ -72,6 +72,8 @@ export abstract class GraphqlQueryBaseResolverService<
   protected readonly permissionsService: PermissionsService;
   @Inject()
   protected readonly userRoleService: UserRoleService;
+  @Inject()
+  protected readonly apiKeyRoleService: ApiKeyRoleService;
 
   public async execute(
     args: Input,
@@ -113,13 +115,46 @@ export abstract class GraphqlQueryBaseResolverService<
         ResolverArgsType[capitalize(operationName)],
       )) as Input;
 
-      const roleId = await this.userRoleService.getRoleIdForUserWorkspace({
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-      });
+      let roleId: string | undefined;
+      let shouldBypassPermissionChecks = false;
 
-      const executedByApiKey = isDefined(authContext.apiKey);
-      const shouldBypassPermissionChecks = executedByApiKey;
+      if (isDefined(authContext.apiKey)) {
+        const isApiKeyRolesEnabled =
+          featureFlagsMap[FeatureFlagKey.IS_API_KEY_ROLES_ENABLED];
+
+        if (!isApiKeyRolesEnabled) {
+          shouldBypassPermissionChecks = true;
+        } else {
+          roleId = await this.apiKeyRoleService.getRoleIdForApiKey(
+            authContext.apiKey.id,
+            workspace.id,
+          );
+        }
+      }
+
+      if (isDefined(authContext.userWorkspaceId)) {
+        roleId = await this.userRoleService.getRoleIdForUserWorkspace({
+          userWorkspaceId: authContext.userWorkspaceId,
+          workspaceId: workspace.id,
+        });
+
+        if (!roleId) {
+          throw new PermissionsException(
+            PermissionsExceptionMessage.NO_ROLE_FOUND_FOR_USER_WORKSPACE,
+            PermissionsExceptionCode.NO_ROLE_FOUND_FOR_USER_WORKSPACE,
+          );
+        }
+      }
+
+      if (
+        !isDefined(authContext.apiKey) &&
+        !isDefined(authContext.userWorkspaceId)
+      ) {
+        throw new PermissionsException(
+          PermissionsExceptionMessage.NO_AUTHENTICATION_CONTEXT,
+          PermissionsExceptionCode.NO_AUTHENTICATION_CONTEXT,
+        );
+      }
 
       const repository = workspaceDataSource.getRepository(
         objectMetadataItemWithFieldMaps.nameSingular,
@@ -148,8 +183,9 @@ export abstract class GraphqlQueryBaseResolverService<
         repository,
         graphqlQueryParser,
         graphqlQuerySelectedFieldsResult,
-        isExecutedByApiKey: executedByApiKey,
+        isExecutedByApiKey: isDefined(authContext.apiKey),
         roleId,
+        shouldBypassPermissionChecks,
       };
 
       const results = await this.resolve(
@@ -202,7 +238,7 @@ export abstract class GraphqlQueryBaseResolverService<
           userWorkspaceId: authContext.userWorkspaceId,
           setting: permissionRequired,
           workspaceId: workspace.id,
-          isExecutedByApiKey: isDefined(authContext.apiKey),
+          apiKeyId: authContext.apiKey?.id,
         });
 
       if (!userHasPermission) {
@@ -214,35 +250,6 @@ export abstract class GraphqlQueryBaseResolverService<
     }
   }
 
-  private getRequiredPermissionForMethod(
-    operationName: WorkspaceResolverBuilderMethodNames,
-  ) {
-    switch (operationName) {
-      case RESOLVER_METHOD_NAMES.FIND_MANY:
-      case RESOLVER_METHOD_NAMES.FIND_ONE:
-      case RESOLVER_METHOD_NAMES.FIND_DUPLICATES:
-        return PermissionsOnAllObjectRecords.READ_ALL_OBJECT_RECORDS;
-      case RESOLVER_METHOD_NAMES.CREATE_MANY:
-      case RESOLVER_METHOD_NAMES.CREATE_ONE:
-      case RESOLVER_METHOD_NAMES.UPDATE_MANY:
-      case RESOLVER_METHOD_NAMES.UPDATE_ONE:
-        return PermissionsOnAllObjectRecords.UPDATE_ALL_OBJECT_RECORDS;
-      case RESOLVER_METHOD_NAMES.DELETE_MANY:
-      case RESOLVER_METHOD_NAMES.DELETE_ONE:
-      case RESOLVER_METHOD_NAMES.RESTORE_MANY:
-      case RESOLVER_METHOD_NAMES.RESTORE_ONE:
-        return PermissionsOnAllObjectRecords.SOFT_DELETE_ALL_OBJECT_RECORDS;
-      case RESOLVER_METHOD_NAMES.DESTROY_MANY:
-      case RESOLVER_METHOD_NAMES.DESTROY_ONE:
-        return PermissionsOnAllObjectRecords.DESTROY_ALL_OBJECT_RECORDS;
-      default:
-        throw new PermissionsException(
-          PermissionsExceptionMessage.UNKNOWN_OPERATION_NAME,
-          PermissionsExceptionCode.UNKNOWN_OPERATION_NAME,
-        );
-    }
-  }
-
   protected abstract resolve(
     executionArgs: GraphqlQueryResolverExecutionArgs<Input>,
     featureFlagsMap: Record<FeatureFlagKey, boolean>,

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-create-many-resolver.service.ts

@@ -47,16 +47,13 @@ export class GraphqlQueryCreateManyResolverService extends GraphqlQueryBaseResol
       objectMetadataItemWithFieldMaps,
     );
 
-    const shouldBypassPermissionChecks = executionArgs.isExecutedByApiKey;
-
-    await this.processNestedRelationsIfNeeded(
+    await this.processNestedRelationsIfNeeded({
       executionArgs,
-      upsertedRecords,
+      records: upsertedRecords,
       objectMetadataItemWithFieldMaps,
       objectMetadataMaps,
-      shouldBypassPermissionChecks,
       roleId,
-    );
+    });
 
     return this.formatRecordsForResponse(
       upsertedRecords,
@@ -383,14 +380,19 @@ export class GraphqlQueryCreateManyResolverService extends GraphqlQueryBaseResol
     return upsertedRecords as ObjectRecord[];
   }
 
-  private async processNestedRelationsIfNeeded(
-    executionArgs: GraphqlQueryResolverExecutionArgs<CreateManyResolverArgs>,
-    upsertedRecords: ObjectRecord[],
-    objectMetadataItemWithFieldMaps: ObjectMetadataItemWithFieldMaps,
-    objectMetadataMaps: ObjectMetadataMaps,
-    shouldBypassPermissionChecks: boolean,
-    roleId?: string,
-  ): Promise<void> {
+  private async processNestedRelationsIfNeeded({
+    executionArgs,
+    records,
+    objectMetadataItemWithFieldMaps,
+    objectMetadataMaps,
+    roleId,
+  }: {
+    executionArgs: GraphqlQueryResolverExecutionArgs<CreateManyResolverArgs>;
+    records: ObjectRecord[];
+    objectMetadataItemWithFieldMaps: ObjectMetadataItemWithFieldMaps;
+    objectMetadataMaps: ObjectMetadataMaps;
+    roleId?: string;
+  }): Promise<void> {
     if (!executionArgs.graphqlQuerySelectedFieldsResult.relations) {
       return;
     }
@@ -398,13 +400,13 @@ export class GraphqlQueryCreateManyResolverService extends GraphqlQueryBaseResol
     await this.processNestedRelationsHelper.processNestedRelations({
       objectMetadataMaps,
       parentObjectMetadataItem: objectMetadataItemWithFieldMaps,
-      parentObjectRecords: upsertedRecords,
+      parentObjectRecords: records,
       relations: executionArgs.graphqlQuerySelectedFieldsResult.relations,
       limit: QUERY_MAX_RECORDS,
       authContext: executionArgs.options.authContext,
       workspaceDataSource: executionArgs.workspaceDataSource,
       roleId,
-      shouldBypassPermissionChecks,
+      shouldBypassPermissionChecks: executionArgs.shouldBypassPermissionChecks,
       selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
     });
   }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-create-one-resolver.service.ts

@@ -82,7 +82,8 @@ export class GraphqlQueryCreateOneResolverService extends GraphqlQueryBaseResolv
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-delete-many-resolver.service.ts

@@ -66,7 +66,8 @@ export class GraphqlQueryDeleteManyResolverService extends GraphqlQueryBaseResol
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-delete-one-resolver.service.ts

@@ -67,7 +67,8 @@ export class GraphqlQueryDeleteOneResolverService extends GraphqlQueryBaseResolv
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-destroy-many-resolver.service.ts

@@ -64,7 +64,8 @@ export class GraphqlQueryDestroyManyResolverService extends GraphqlQueryBaseReso
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-destroy-one-resolver.service.ts

@@ -64,7 +64,8 @@ export class GraphqlQueryDestroyOneResolverService extends GraphqlQueryBaseResol
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-find-many-resolver.service.ts

@@ -156,7 +156,8 @@ export class GraphqlQueryFindManyResolverService extends GraphqlQueryBaseResolve
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-find-one-resolver.service.ts

@@ -83,7 +83,8 @@ export class GraphqlQueryFindOneResolverService extends GraphqlQueryBaseResolver
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-merge-many-resolver.service.ts

@@ -97,12 +97,12 @@ export class GraphqlQueryMergeManyResolverService extends GraphqlQueryBaseResolv
     );
 
     if (roleId) {
-      await this.processNestedRelations(
+      await this.processNestedRelations({
         executionArgs,
-        [updatedRecord],
+        updatedRecords: [updatedRecord],
         authContext,
         roleId,
-      );
+      });
     }
 
     return this.formatResponse(
@@ -357,12 +357,17 @@ export class GraphqlQueryMergeManyResolverService extends GraphqlQueryBaseResolv
     }
   }
 
-  private async processNestedRelations(
-    executionArgs: GraphqlQueryResolverExecutionArgs<MergeManyResolverArgs>,
-    updatedRecords: ObjectRecord[],
-    authContext: AuthContext,
-    roleId: string,
-  ): Promise<void> {
+  private async processNestedRelations({
+    executionArgs,
+    updatedRecords,
+    authContext,
+    roleId,
+  }: {
+    executionArgs: GraphqlQueryResolverExecutionArgs<MergeManyResolverArgs>;
+    updatedRecords: ObjectRecord[];
+    authContext: AuthContext;
+    roleId: string;
+  }): Promise<void> {
     const { objectMetadataMaps, objectMetadataItemWithFieldMaps } =
       executionArgs.options;
 
@@ -376,7 +381,8 @@ export class GraphqlQueryMergeManyResolverService extends GraphqlQueryBaseResolv
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-restore-many-resolver.service.ts

@@ -66,7 +66,8 @@ export class GraphqlQueryRestoreManyResolverService extends GraphqlQueryBaseReso
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-restore-one-resolver.service.ts

@@ -68,7 +68,8 @@ export class GraphqlQueryRestoreOneResolverService extends GraphqlQueryBaseResol
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-update-many-resolver.service.ts

@@ -67,7 +67,8 @@ export class GraphqlQueryUpdateManyResolverService extends GraphqlQueryBaseResol
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }

packages/twenty-server/src/engine/api/graphql/graphql-query-runner/resolvers/graphql-query-update-one-resolver.service.ts

@@ -68,7 +68,8 @@ export class GraphqlQueryUpdateOneResolverService extends GraphqlQueryBaseResolv
         authContext,
         workspaceDataSource: executionArgs.workspaceDataSource,
         roleId,
-        shouldBypassPermissionChecks: executionArgs.isExecutedByApiKey,
+        shouldBypassPermissionChecks:
+          executionArgs.shouldBypassPermissionChecks,
         selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
       });
     }