feat: move admin panel to dedicated /admin-panel GraphQL endpoint (#19852)

## Summary Splits admin-panel resolvers off the shared `/metadata` GraphQL endpoint onto a dedicated `/admin-panel` endpoint. The backend plumbing mirrors the existing `metadata` / `core` pattern (new scope, decorator, module, factory), and admin types now live in their own `generated-admin/graphql.ts` on the frontend — dropping 877 lines of admin noise from `generated-metadata`. ## Why - **Smaller attack surface on `/metadata`** — every authenticated user hits that endpoint; admin ops don't belong there. - **Independent complexity limits and monitoring** per endpoint. - **Cleaner module boundaries** — admin is a cross-cutting concern that doesn't match the "shared-schema configuration" meaning of `/metadata`. - **Deploy / blast-radius isolation** — a broken admin query can't affect `/metadata`. Runtime behavior, auth, and authorization are unchanged — this is a relocation, not a re-permissioning. All existing guards (`WorkspaceAuthGuard`, `UserAuthGuard`, `SettingsPermissionGuard(SECURITY)` at class level; `AdminPanelGuard` / `ServerLevelImpersonateGuard` at method level) remain on `AdminPanelResolver`. ## What changed ### Backend - `@AdminResolver()` decorator with scope `'admin'`, naming parallels `CoreResolver` / `MetadataResolver`. - `AdminPanelGraphQLApiModule` + `adminPanelModuleFactory` registered at `/admin-panel`, same Yoga hook set as the metadata factory (Sentry tracing, error handler, introspection-disabling in prod, complexity validation). - Middleware chain on `/admin-panel` is identical to `/metadata`. - `@nestjs/graphql` patch extended: `resolverSchemaScope?: 'core' | 'metadata' | 'admin'`. - `AdminPanelResolver` class decorator swapped from `@MetadataResolver()` to `@AdminResolver()` — no other changes. ### Frontend - `codegen-admin.cjs` → `src/generated-admin/graphql.ts` (982 lines). - `codegen-metadata.cjs` excludes admin paths; metadata file shrinks by 877 lines. - `ApolloAdminProvider` / `useApolloAdminClient` follow the existing `ApolloCoreProvider` / `useApolloCoreClient` pattern, wired inside `AppRouterProviders` alongside the core provider. - 37 admin consumer files migrated: imports switched to `~/generated-admin/graphql` and `client: useApolloAdminClient()` is passed to `useQuery` / `useMutation`. - Three files intentionally kept on `generated-metadata` because they consume non-admin Documents: `useHandleImpersonate.ts`, `SettingsAdminApplicationRegistrationDangerZone.tsx`, `SettingsAdminApplicationRegistrationGeneralToggles.tsx`. ### CI - `ci-server.yaml` runs all three `graphql:generate` configurations and diff-checks all three generated dirs. ## Authorization (unchanged, but audited while reviewing) Every one of the 38 methods on `AdminPanelResolver` has a method-level guard: - `AdminPanelGuard` (32 methods) — requires `canAccessFullAdminPanel === true` - `ServerLevelImpersonateGuard` (6 methods: user/workspace lookup + chat thread views) — requires `canImpersonate === true` On top of the class-level guards above. No resolver method is accessible without these flags + `SECURITY` permission in the workspace. ## Test plan - [ ] Dev server boots; `/graphql`, `/metadata`, `/admin-panel` all mapped as separate GraphQL routes (confirmed locally during development). - [ ] `nx typecheck twenty-server` passes. - [ ] `nx typecheck twenty-front` passes. - [ ] `nx lint:diff-with-main twenty-server` and `twenty-front` both clean. - [ ] Manual smoke test: log in with a user who has `canAccessFullAdminPanel=true`, open the admin panel at `/settings/admin-panel`, verify each tab loads (General, Health, Config variables, AI, Apps, Workspace details, User details, chat threads). - [ ] Manual smoke test: log in with a user who has `canImpersonate=false` and `canAccessFullAdminPanel=false`, hit `/admin-panel` directly with a raw GraphQL request, confirm permission error on every operation. - [ ] Production deploy note: reverse proxy / ingress must route the new `/admin-panel` path to the Nest server. If the proxy has an explicit allowlist, infra change required before cutover. ## Follow-ups (out of scope here) - Consider cutting over the three `SettingsAdminApplicationRegistration*` components to admin-scope versions of the app-registration operations so the admin page is fully on the admin endpoint. - The `renderGraphiQL` double-assignment in `admin-panel.module-factory.ts` is copied from `metadata.module-factory.ts` — worth cleaning up in both.
2026-04-19 20:55:10 +02:00
parent 90661cc821
commit 75848ff8ea
70 changed files with 1857 additions and 3844 deletions
@@ -0,0 +1,40 @@
+import { Module } from '@nestjs/common';
+import { GraphQLModule } from '@nestjs/graphql';
+
+import { YogaDriver, type YogaDriverConfig } from '@graphql-yoga/nestjs';
+
+import { adminPanelModuleFactory } from 'src/engine/api/graphql/admin-panel.module-factory';
+import { GraphQLConfigModule } from 'src/engine/api/graphql/graphql-config/graphql-config.module';
+import { AdminPanelModule } from 'src/engine/core-modules/admin-panel/admin-panel.module';
+import { ExceptionHandlerService } from 'src/engine/core-modules/exception-handler/exception-handler.service';
+import { I18nModule } from 'src/engine/core-modules/i18n/i18n.module';
+import { I18nService } from 'src/engine/core-modules/i18n/i18n.service';
+import { MetricsModule } from 'src/engine/core-modules/metrics/metrics.module';
+import { MetricsService } from 'src/engine/core-modules/metrics/metrics.service';
+import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
+import { DataloaderModule } from 'src/engine/dataloaders/dataloader.module';
+import { DataloaderService } from 'src/engine/dataloaders/dataloader.service';
+
+@Module({
+  imports: [
+    GraphQLModule.forRootAsync<YogaDriverConfig>({
+      driver: YogaDriver,
+      useFactory: adminPanelModuleFactory,
+      imports: [
+        GraphQLConfigModule,
+        DataloaderModule,
+        MetricsModule,
+        I18nModule,
+      ],
+      inject: [
+        TwentyConfigService,
+        ExceptionHandlerService,
+        DataloaderService,
+        MetricsService,
+        I18nService,
+      ],
+    }),
+    AdminPanelModule,
+  ],
+})
+export class AdminPanelGraphQLApiModule {}
@@ -0,0 +1,66 @@
+import { type YogaDriverConfig } from '@graphql-yoga/nestjs';
+import * as Sentry from '@sentry/node';
+import GraphQLJSON from 'graphql-type-json';
+
+import { NodeEnvironment } from 'src/engine/core-modules/twenty-config/interfaces/node-environment.interface';
+
+import { AdminPanelGraphQLApiModule } from 'src/engine/api/graphql/admin-panel-graphql-api.module';
+import { type ExceptionHandlerService } from 'src/engine/core-modules/exception-handler/exception-handler.service';
+import { useSentryTracing } from 'src/engine/core-modules/exception-handler/hooks/use-sentry-tracing';
+import { useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers } from 'src/engine/core-modules/graphql/hooks/use-disable-introspection-and-suggestions-for-unauthenticated-users.hook';
+import { useGraphQLErrorHandlerHook } from 'src/engine/core-modules/graphql/hooks/use-graphql-error-handler.hook';
+import { useValidateGraphqlQueryComplexity } from 'src/engine/core-modules/graphql/hooks/use-validate-graphql-query-complexity.hook';
+import { type I18nService } from 'src/engine/core-modules/i18n/i18n.service';
+import { type MetricsService } from 'src/engine/core-modules/metrics/metrics.service';
+import { type TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
+import { type DataloaderService } from 'src/engine/dataloaders/dataloader.service';
+import { renderApolloPlayground } from 'src/engine/utils/render-apollo-playground.util';
+
+export const adminPanelModuleFactory = async (
+  twentyConfigService: TwentyConfigService,
+  exceptionHandlerService: ExceptionHandlerService,
+  dataloaderService: DataloaderService,
+  metricsService: MetricsService,
+  i18nService: I18nService,
+): Promise<YogaDriverConfig> => {
+  const config: YogaDriverConfig = {
+    autoSchemaFile: true,
+    include: [AdminPanelGraphQLApiModule],
+    resolverSchemaScope: 'admin',
+    buildSchemaOptions: {},
+    renderGraphiQL() {
+      return renderApolloPlayground({ path: 'admin-panel' });
+    },
+    resolvers: { JSON: GraphQLJSON },
+    plugins: [
+      ...(Sentry.isInitialized() ? [useSentryTracing()] : []),
+      useGraphQLErrorHandlerHook({
+        metricsService: metricsService,
+        exceptionHandlerService,
+        i18nService,
+        twentyConfigService,
+      }),
+      useDisableIntrospectionAndSuggestionsForUnauthenticatedUsers(
+        twentyConfigService.get('NODE_ENV') === NodeEnvironment.PRODUCTION,
+      ),
+      useValidateGraphqlQueryComplexity({
+        maximumAllowedFields: twentyConfigService.get('GRAPHQL_MAX_FIELDS'),
+        maximumAllowedRootResolvers: 10,
+        maximumAllowedNestedFields: 10,
+        checkDuplicateRootResolvers: true,
+      }),
+    ],
+    path: '/admin-panel',
+    context: () => ({
+      loaders: dataloaderService.createLoaders(),
+    }),
+  };
+
+  if (twentyConfigService.get('NODE_ENV') === NodeEnvironment.DEVELOPMENT) {
+    config.renderGraphiQL = () => {
+      return renderApolloPlayground({ path: 'admin-panel' });
+    };
+  }
+
+  return config;
+};
@@ -0,0 +1,11 @@
+import { applyDecorators, SetMetadata } from '@nestjs/common';
+import { Resolver } from '@nestjs/graphql';
+
+import { RESOLVER_SCHEMA_SCOPE_KEY } from 'src/engine/api/graphql/graphql-config/constants/resolver-schema-scope-key.constant';
+import { type ResolverSchemaScope } from 'src/engine/api/graphql/graphql-config/types/resolver-schema-scope.type';
+
+export const AdminResolver = (typeFunc?: () => unknown) =>
+  applyDecorators(
+    typeFunc ? Resolver(typeFunc) : Resolver(),
+    SetMetadata(RESOLVER_SCHEMA_SCOPE_KEY, 'admin' as ResolverSchemaScope),
+  );
@@ -1 +1 @@
-export type ResolverSchemaScope = 'core' | 'metadata';
+export type ResolverSchemaScope = 'core' | 'metadata' | 'admin';