i18n - docs translations (#21923)
Created by Github action <!-- This is an auto-generated description by cubic. --> <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21923?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a> <!-- End of auto-generated description by cubic. --> Co-authored-by: github-actions <github-actions@twenty.com>
This commit is contained in:
github-actions[bot]
committed by
GitHub
GitHub
parent
fa6d1394af
commit
82f6597dc3
@@ -50,6 +50,113 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## أمن على مستوى الصف
|
||||
|
||||
تحدّد أذونات الكائن والحقل *أي الكائنات والحقول* يمكن لدورٍ معيّن التفاعل معها. **محددات الأذونات على مستوى الصف** تتعمّق أكثر وتحدّد *أي السجلات* يمكن لدورٍ معيّن رؤيتها والتصرّف فيها — على سبيل المثال، دور للخدمة الذاتية حيث يرى كل مستخدم خارجي سجلاته الخاصة فقط.
|
||||
|
||||
عرِّف المحددات باستخدام `rowLevelPermissionPredicates` على الدور. مثل باقي ملف manifest، يحمل كل محدِّد `universalIdentifier` خاصًا به، ويشير إلى كائن وحقل باستخدام `universalIdentifier` الخاصّ بهما، و`operand`، وحقل workspaceMember (اختياري) تُحقن قيمته وقت الاستعلام — بحيث يمكنك التعبير عن: "علاقة مالك السجل **هي** عضو مساحة العمل الحالي":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
نظرًا إلى أنّ المحددات (predicates) تُشحَن داخل ملف manifest، فإنّه يتم إنشاؤها وتحديثها وإزالتها مع الدور نفسه في كل عملية تثبيت وترقية — ولا توجد خطوة ما بعد التثبيت منفصلة تحتاج إلى مزامنتها.
|
||||
|
||||
### دمج المحددات مع المجموعات
|
||||
|
||||
افتراضيًا، يتم دمج محددات الدور باستخدام `AND`. لدمج بعضها باستخدام `OR` (أو لتداخل المنطق)، قم بتعريف إدخال `rowLevelPermissionPredicateGroups` وأشِر كل محدد إليه من خلال `predicateGroupUniversalIdentifier`. يُتيح هذا الدور للشريك رؤية فرصة (Opportunity) إذا كان إمّا **مالكها** أو **جهة الاتصال** لها:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
الملاحظات:
|
||||
|
||||
* امنح كل محدد وكل مجموعة قيمة `universalIdentifier` ثابتة (أي uuid) — فهي المفتاح الذي يعرّف الكيان عبر الترقيات، كما أنّ المحددات تشير إلى المجموعات من خلاله.
|
||||
* يمكن للمحددات الإشارة إلى الكائنات والحقول التي يملكها تطبيقك أو إلى كائنات Twenty القياسية.
|
||||
* يتم تطبيق الأمان على مستوى الصف (row-level security) لمساحات العمل في الخطط التي تتضمنه؛ بينما تستمر مزامنة المحددات في الخطط الأخرى ولكن دون تطبيقها فعليًا.
|
||||
|
||||
## الدور الافتراضي للوظيفة
|
||||
|
||||
عند إنشاء هيكل لتطبيق جديد، ينشئ CLI ملف دور افتراضي مُصرَّحًا به باستخدام `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,113 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Zabezpečení na úrovni řádků
|
||||
|
||||
Oprávnění objektů a polí určují, *kterých objektů a polí* se může role dotýkat. **Predikáty oprávnění na úrovni řádků** jdou dále a určují, *které záznamy* může role vidět a s nimi pracovat — například samoobslužná role, kde každý externí uživatel vidí pouze své vlastní záznamy.
|
||||
|
||||
Predikáty deklarujte na roli pomocí `rowLevelPermissionPredicates`. Stejně jako zbytek manifestu nese každý predikát svůj vlastní `universalIdentifier` a odkazuje na objekt a pole podle jejich `universalIdentifier`, dále na `operand` a (volitelně) na pole workspaceMember, jehož hodnota je vložena v době dotazu — takže můžete vyjádřit „vztah vlastníka záznamu **je** aktuálním členem pracovního prostoru“:
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Protože predikáty jsou součástí manifestu, vytvářejí se, aktualizují a odstraňují společně s rolí při každé instalaci a aktualizaci — není potřeba žádný samostatný post‑instalační krok, který by je udržoval v synchronizaci.
|
||||
|
||||
### Kombinování predikátů se skupinami
|
||||
|
||||
Ve výchozím nastavení se predikáty role kombinují pomocí `AND`. Aby bylo možné některé z nich kombinovat pomocí `OR` (nebo vnořovat logiku), deklarujte položku `rowLevelPermissionPredicateGroups` a každý predikát na ni odkažte prostřednictvím `predicateGroupUniversalIdentifier`. Tato role umožňuje partnerovi zobrazit obchodní příležitost, kterou buď vlastní, nebo u ní vystupuje jako kontaktní osoba:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Poznámky:
|
||||
|
||||
* Každému predikátu a skupině dejte stabilní `universalIdentifier` (libovolný uuid) — podle něj se entita identifikuje při aktualizacích a predikáty podle něj odkazují na skupiny.
|
||||
* Predikáty mohou odkazovat na objekty a pole vlastněné vaší aplikací nebo na standardní objekty Twenty.
|
||||
* Zabezpečení na úrovni řádků je vynucováno pro pracovní prostory v tarifech, které ho zahrnují; predikáty se i na ostatních tarifech stále synchronizují, pouze nejsou vynucovány.
|
||||
|
||||
## Výchozí role funkce
|
||||
|
||||
Když vygenerujete novou aplikaci, CLI vytvoří výchozí soubor role deklarovaný pomocí `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,118 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Zeilenbasierte Sicherheit
|
||||
|
||||
Objekt- und Feldberechtigungen legen fest, *auf welche Objekte und Felder* eine Rolle zugreifen kann. **Zeilenbasierte
|
||||
Berechtigungsprädikate** gehen noch weiter und legen fest, *welche Datensätze* eine Rolle sehen und bearbeiten kann — zum
|
||||
Beispiel eine Self-Service-Rolle, bei der jeder externe Benutzer nur seine eigenen Datensätze sieht.
|
||||
|
||||
Deklarieren Sie Prädikate mit `rowLevelPermissionPredicates` für die Rolle. Wie beim Rest des Manifests hat
|
||||
jedes Prädikat einen eigenen `universalIdentifier` und referenziert ein Objekt und ein Feld über deren
|
||||
`universalIdentifier`; außerdem besitzt es einen `operand` und (optional) ein workspaceMember-Feld, dessen Wert zur Abfragezeit injiziert wird — sodass Sie ausdrücken können: "Die Eigentümerbeziehung des Datensatzes **ist** das aktuelle workspaceMember":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Da Prädikate im Manifest ausgeliefert werden, werden sie zusammen mit der Rolle bei jeder Installation und jedem Upgrade erstellt, aktualisiert und entfernt – es ist kein separater Post-Installationsschritt erforderlich, um sie zu synchronisieren.
|
||||
|
||||
### Kombinieren von Prädikaten mit Gruppen
|
||||
|
||||
Standardmäßig werden die Prädikate einer Rolle mit `AND` verknüpft. Um einige von ihnen mit `OR` zu verknüpfen (oder um Logik zu verschachteln), deklarieren Sie einen Eintrag `rowLevelPermissionPredicateGroups` und verweisen Sie von jedem Prädikat aus über `predicateGroupUniversalIdentifier` darauf. Diese Rolle ermöglicht es einem Partner, eine Opportunity zu sehen, deren er entweder **Eigentümer**
|
||||
oder der **Ansprechpartner** ist:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notizen:
|
||||
|
||||
* Geben Sie jedem Prädikat und jeder Gruppe einen stabilen `universalIdentifier` (beliebige uuid) – er identifiziert die Entität über Upgrades hinweg eindeutig, und Prädikate verweisen über ihn auf Gruppen.
|
||||
* Prädikate können auf Objekte und Felder verweisen, die Ihrer App gehören, oder auf Standardobjekte von Twenty.
|
||||
* Zeilenbasierte Sicherheit wird für Workspaces in Tarifen durchgesetzt, die sie enthalten; die Prädikate werden auch in anderen Tarifen weiterhin synchronisiert, sie werden dort einfach nicht durchgesetzt.
|
||||
|
||||
## Die Standard-Funktionsrolle
|
||||
|
||||
Wenn Sie eine neue App erzeugen, erstellt die CLI eine Datei für die Standardrolle, die mit `defineApplicationRole()` deklariert ist:
|
||||
|
||||
@@ -50,6 +50,113 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Seguridad a nivel de fila
|
||||
|
||||
Los permisos de objetos y campos determinan *a qué objetos y campos* puede acceder o modificar un rol. **Los predicados de permisos a nivel de fila** van más allá y deciden *qué registros* puede ver y sobre los que puede actuar un rol; por ejemplo, un rol de autoservicio en el que cada usuario externo ve solo sus propios registros.
|
||||
|
||||
Declara los predicados con `rowLevelPermissionPredicates` en el rol. Como el resto del manifiesto, cada predicado tiene su propio `universalIdentifier` y hace referencia a un objeto y a un campo mediante su `universalIdentifier`, a un `operand` y, de forma opcional, a un campo `workspaceMember` cuyo valor se inyecta en tiempo de consulta, de modo que puedas expresar: "la relación de propietario del registro **es** el miembro actual del espacio de trabajo":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Debido a que los predicados se envían en el manifiesto, se crean, actualizan y eliminan junto con el rol en cada instalación y actualización; no hay ningún paso posterior a la instalación independiente que mantener sincronizado.
|
||||
|
||||
### Combinar predicados con grupos
|
||||
|
||||
De forma predeterminada, los predicados de un rol se combinan con `AND`. Para combinar algunos de ellos con `OR` (o para anidar lógica), declara una entrada `rowLevelPermissionPredicateGroups` y haz que cada predicado apunte a ella mediante `predicateGroupUniversalIdentifier`. Este rol permite que un socio vea una Oportunidad de la que **es propietario** o de la que es el **punto de contacto**:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notas:
|
||||
|
||||
* Asigna a cada predicado y grupo un `universalIdentifier` estable (cualquier uuid): sirve como clave de la entidad a través de las actualizaciones, y los predicados hacen referencia a los grupos mediante él.
|
||||
* Los predicados pueden hacer referencia a objetos y campos que sean propiedad de tu aplicación o de los objetos estándar de Twenty.
|
||||
* La seguridad a nivel de fila se aplica para los espacios de trabajo en planes que la incluyen; los predicados siguen sincronizándose en otros planes, simplemente no se aplican.
|
||||
|
||||
## El rol de función predeterminado
|
||||
|
||||
Cuando generas una nueva aplicación, la CLI crea un archivo de rol predeterminado declarado con `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,113 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Sécurité au niveau des lignes
|
||||
|
||||
Les autorisations d’objet et de champ déterminent à *quels objets et champs* un rôle peut accéder. Les **prédicats d’autorisation au niveau des lignes** vont plus loin et déterminent *quels enregistrements* un rôle peut voir et sur lesquels il peut agir — par exemple, un rôle en libre-service où chaque utilisateur externe ne voit que ses propres enregistrements.
|
||||
|
||||
Déclarez les prédicats avec `rowLevelPermissionPredicates` sur le rôle. Comme le reste du manifeste, chaque prédicat porte son propre `universalIdentifier` et fait référence à un objet et à un champ par leur `universalIdentifier`, un `operand` et (facultativement) un champ workspaceMember dont la valeur est injectée au moment de la requête — vous pouvez ainsi exprimer : "la relation de propriétaire de l’enregistrement **est** le membre de l’espace de travail actuel" :
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Comme les prédicats sont livrés dans le manifeste, ils sont créés, mis à jour et supprimés en même temps que le rôle à chaque installation et mise à niveau — il n’y a aucune étape distincte après l’installation à garder synchronisée.
|
||||
|
||||
### Combiner des prédicats avec des groupes
|
||||
|
||||
Par défaut, les prédicats d’un rôle sont combinés avec `AND`. Pour en combiner certains avec `OR` (ou pour imbriquer la logique), déclarez une entrée `rowLevelPermissionPredicateGroups` et faites pointer chaque prédicat vers celle-ci via `predicateGroupUniversalIdentifier`. Ce rôle permet à un partenaire de voir une opportunité qu’il **possède** ou pour laquelle il est le **point de contact** :
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notes :
|
||||
|
||||
* Donnez à chaque prédicat et groupe un `universalIdentifier` stable (n’importe quel uuid) — il sert de clé à l’entité lors des mises à niveau, et les prédicats référencent les groupes via celui-ci.
|
||||
* Les prédicats peuvent référencer des objets et des champs appartenant à votre application ou aux objets standard de Twenty.
|
||||
* La sécurité au niveau des lignes est appliquée pour les espaces de travail sur les offres qui l’incluent ; les prédicats sont tout de même synchronisés sur les autres offres, ils ne sont simplement pas appliqués.
|
||||
|
||||
## Le rôle de fonction par défaut
|
||||
|
||||
Lorsque vous générez une nouvelle application, la CLI crée un fichier de rôle par défaut déclaré avec `defineApplicationRole()` :
|
||||
|
||||
@@ -50,6 +50,119 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Sicurezza a livello di riga
|
||||
|
||||
Le autorizzazioni sugli oggetti e sui campi determinano *quali oggetti e campi* un ruolo può gestire. **I predicati di autorizzazione
|
||||
a livello di riga** vanno oltre e determinano *quali record* un ruolo può vedere e su cui può agire — per
|
||||
esempio, un ruolo self-service in cui ogni utente esterno vede solo i propri record.
|
||||
|
||||
Dichiara i predicati con `rowLevelPermissionPredicates` sul ruolo. Come il resto del manifest,
|
||||
ogni predicato ha il proprio `universalIdentifier` e fa riferimento a un oggetto e a un campo tramite il loro
|
||||
`universalIdentifier`, un `operand` e (facoltativamente) un campo workspaceMember il cui valore viene iniettato
|
||||
al momento della query — così puoi esprimere "la relazione di proprietario del record **è** l'attuale membro dello spazio di lavoro":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Poiché i predicati vengono distribuiti nel manifest, vengono creati, aggiornati e rimossi insieme al ruolo a ogni installazione e aggiornamento — non è necessario alcun passaggio post-installazione separato per mantenerli sincronizzati.
|
||||
|
||||
### Combinare i predicati con i gruppi
|
||||
|
||||
Per impostazione predefinita, i predicati di un ruolo sono combinati con `AND`. Per combinarne alcuni con `OR` (o per annidare la logica), dichiara una voce `rowLevelPermissionPredicateGroups` e collega ogni predicato ad essa tramite `predicateGroupUniversalIdentifier`. Questo ruolo consente a un partner di vedere un'Opportunità di cui **è proprietario**
|
||||
o per cui è il **punto di contatto**:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Note:
|
||||
|
||||
* Assegna a ogni predicato e gruppo un `universalIdentifier` stabile (qualsiasi uuid) — identifica l'entità attraverso gli aggiornamenti e i predicati fanno riferimento ai gruppi tramite esso.
|
||||
* I predicati possono fare riferimento a oggetti e campi di proprietà della tua app o degli oggetti standard di Twenty.
|
||||
* La sicurezza a livello di riga è applicata per gli spazi di lavoro sui piani che la includono; i predicati vengono comunque sincronizzati sugli altri piani, semplicemente non vengono applicati.
|
||||
|
||||
## Ruolo funzione predefinito
|
||||
|
||||
Quando esegui lo scaffolding di una nuova app, la CLI crea un file di ruolo predefinito dichiarato con `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,116 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## 행 수준 보안
|
||||
|
||||
오브젝트 및 필드 권한은 역할이 *어떤 오브젝트와 필드* 를 다룰 수 있는지를 결정합니다. **행 수준
|
||||
권한 프레디킷** 은 더 나아가 역할이 *어떤 레코드* 를 보고 작업할 수 있는지를 결정합니다. 예를 들어, 각 외부 사용자가 자신의 레코드만 볼 수 있는 셀프 서비스 역할 같은 경우입니다.
|
||||
|
||||
역할에 `rowLevelPermissionPredicates` 로 프레디킷을 선언합니다. 매니페스트의 나머지와 마찬가지로,
|
||||
각 프레디킷은 자체 `universalIdentifier` 를 가지고, 오브젝트와 필드를 각각의
|
||||
`universalIdentifier`, `operand`, 그리고 (선택적으로) 쿼리 시점에 값이 주입되는 workspaceMember 필드를 통해 참조합니다. 이렇게 하면 "레코드의 owner relation **is** 현재 workspace member이다"를 표현할 수 있습니다:
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
프레디킷은 매니페스트에 함께 포함되어 배포되므로, 모든 설치와 업그레이드 시 역할과 함께 생성·업데이트·제거됩니다. 동기화를 유지하기 위한 별도의 설치 후 단계는 필요하지 않습니다.
|
||||
|
||||
### 프레디킷을 그룹과 결합하기
|
||||
|
||||
기본적으로 역할의 프레디킷은 `AND`로 결합됩니다. 일부를 `OR`로 결합하거나(또는 논리를 중첩하려면) `rowLevelPermissionPredicateGroups` 항목을 선언하고 각 프레디킷이 `predicateGroupUniversalIdentifier`를 통해 해당 그룹을 가리키도록 설정합니다. 이 역할은 파트너가 자신이 **소유한** 또는 **담당자**인 기회(Opportunity)를 볼 수 있도록 허용합니다:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
노트:
|
||||
|
||||
* 모든 프레디킷과 그룹에 안정적인 `universalIdentifier`(임의의 uuid)를 부여하세요. 이는 업그레이드 전반에 걸쳐 엔티티의 키로 사용되며, 프레디킷은 이를 통해 그룹을 참조합니다.
|
||||
* 프레디킷은 앱에서 소유한 오브젝트와 필드뿐만 아니라 Twenty의 표준 오브젝트가 소유한 오브젝트와 필드를 참조할 수 있습니다.
|
||||
* 행 수준 보안은 이를 포함한 플랜의 워크스페이스에 대해 적용됩니다. 다른 플랜에서도 프레디킷은 계속 동기화되지만, 적용되지는 않습니다.
|
||||
|
||||
## 기본 함수 역할
|
||||
|
||||
새 앱을 스캐폴딩하면, CLI가 `defineApplicationRole()`로 선언된 기본 역할 파일을 생성합니다:
|
||||
|
||||
@@ -50,6 +50,119 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Segurança ao nível da linha
|
||||
|
||||
As permissões de objeto e de campo determinam *quais objetos e campos* uma função pode acessar. **Predicados de permissão ao nível da linha** vão além e determinam *quais registros* uma função pode ver e atuar sobre — por exemplo, uma função de autoatendimento em que cada usuário externo vê apenas seus próprios registros.
|
||||
|
||||
Declare predicados com `rowLevelPermissionPredicates` na função. Como o restante do manifesto, cada predicado carrega seu próprio `universalIdentifier` e faz referência a um objeto e a um campo por seus respectivos `universalIdentifier`, a um `operand` e, opcionalmente, a um campo de workspaceMember cujo valor é injetado no momento da consulta — assim, você pode expressar: "a relação de proprietário do registro **é** o membro de workspace atual":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Como os predicados são enviados no manifesto, eles são criados, atualizados e removidos junto com a
|
||||
função em cada instalação e atualização — não há uma etapa pós-instalação separada para manter em sincronia.
|
||||
|
||||
### Combinando predicados com grupos
|
||||
|
||||
Por padrão, os predicados de uma função são combinados com `AND`. Para combinar alguns deles com `OR` (ou para
|
||||
aninhar a lógica), declare uma entrada `rowLevelPermissionPredicateGroups` e faça cada predicado apontar para ela por meio de
|
||||
`predicateGroupUniversalIdentifier`. Essa função permite que um parceiro veja uma Oportunidade da qual ele **é proprietário**
|
||||
ou pela qual **é o ponto de contato**:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notas:
|
||||
|
||||
* Dê a cada predicado e grupo um `universalIdentifier` estável (qualquer uuid) — ele identifica a entidade
|
||||
entre atualizações, e os predicados referenciam os grupos por meio dele.
|
||||
* Os predicados podem referenciar objetos e campos pertencentes ao seu app ou aos objetos padrão da Twenty.
|
||||
* A segurança ao nível da linha é aplicada para os workspaces em planos que a incluem; os predicados ainda são sincronizados
|
||||
em outros planos; eles simplesmente não são aplicados.
|
||||
|
||||
## Papel de função padrão
|
||||
|
||||
Ao criar um novo app com o scaffold, a CLI cria um arquivo de papel padrão declarado com `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,124 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Securitate la nivel de rând
|
||||
|
||||
Permisiunile pentru obiecte și câmpuri decid *ce obiecte și câmpuri* poate accesa un rol. **Predicate de
|
||||
permisiuni la nivel de rând** merg mai departe și decid *ce înregistrări* poate vedea și asupra cărora poate acționa un rol — de
|
||||
exemplu, un rol de tip autoservire în care fiecare utilizator extern își vede doar propriile înregistrări.
|
||||
|
||||
Declară predicate cu `rowLevelPermissionPredicates` în rol. La fel ca restul manifestului,
|
||||
fiecare predicat are propriul `universalIdentifier` și face referire la un obiect și un câmp prin
|
||||
`universalIdentifier`, un `operand` și (opțional) un câmp workspaceMember a cărui valoare este injectată
|
||||
în momentul interogării — astfel încât poți exprima „relația de proprietar a înregistrării **este** membrul curent al spațiului de lucru”:
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Deoarece predicatele sunt livrate în manifest, ele sunt create, actualizate și eliminate împreună cu
|
||||
rolul la fiecare instalare și actualizare — nu există un pas separat post-instalare pentru a le menține sincronizate.
|
||||
|
||||
### Combinarea predicatelor cu grupuri
|
||||
|
||||
În mod implicit, predicatele unui rol sunt combinate cu `AND`. Pentru a combina unele dintre ele cu `OR` (sau pentru a
|
||||
imbrica logica), declară o intrare `rowLevelPermissionPredicateGroups` și asociază fiecare predicat la aceasta prin
|
||||
`predicateGroupUniversalIdentifier`. Acest rol permite unui partener să vadă o oportunitate pe care fie o **deține**,
|
||||
fie pentru care este **punctul de contact**:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notițe:
|
||||
|
||||
* Oferă fiecărui predicat și fiecărui grup un `universalIdentifier` stabil (orice uuid) — acesta este cheia entității
|
||||
de-a lungul actualizărilor, iar predicatele fac referire la grupuri prin el.
|
||||
* Predicatele pot face referire la obiecte și câmpuri deținute de aplicația ta sau de obiectele standard ale Twenty.
|
||||
* Securitatea la nivel de rând este aplicată pentru spațiile de lucru din planurile care o includ; predicatele se sincronizează în continuare
|
||||
pe alte planuri, doar că nu sunt aplicate.
|
||||
|
||||
## Rolul implicit pentru funcții
|
||||
|
||||
Când generați o aplicație nouă, CLI creează un fișier de rol implicit declarat cu `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,117 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Безопасность на уровне строк
|
||||
|
||||
Разрешения на объекты и поля определяют, *к каким объектам и полям* у роли есть доступ. **Предикаты прав доступа на уровне строк** заходят дальше и определяют, *какие записи* роль может видеть и с которыми может работать — например, для роли самообслуживания, где каждый внешний пользователь видит только свои собственные записи.
|
||||
|
||||
Объявляйте предикаты с помощью `rowLevelPermissionPredicates` в роли. Как и остальная часть манифеста, каждый предикат имеет свой собственный `universalIdentifier` и ссылается на объект и поле по их `universalIdentifier`, `operand`, а также (необязательно) поле workspaceMember, значение которого подставляется во время выполнения запроса — чтобы вы могли выразить: "отношение владельца записи **является** текущим участником рабочей области":
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Поскольку предикаты поставляются в манифесте, они создаются, обновляются и удаляются вместе с ролью при каждой установке и обновлении — не требуется отдельный шаг после установки для поддержания синхронизации.
|
||||
|
||||
### Комбинирование предикатов с группами
|
||||
|
||||
По умолчанию предикаты роли комбинируются с помощью `AND`. Чтобы комбинировать некоторые из них с помощью `OR` (или
|
||||
вкладывать логику), объявите запись `rowLevelPermissionPredicateGroups` и укажите на неё каждый предикат через
|
||||
`predicateGroupUniversalIdentifier`. Эта роль позволяет партнёру видеть сделку, которая либо **принадлежит** ему,
|
||||
либо по которой он является **контактным лицом**:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Заметки:
|
||||
|
||||
* Присвойте каждому предикату и группе стабильный `universalIdentifier` (любой uuid) — он служит ключом сущности между обновлениями, а предикаты ссылаются на группы по нему.
|
||||
* Предикаты могут ссылаться на объекты и поля, принадлежащие вашему приложению, или на стандартные объекты и поля Twenty.
|
||||
* Безопасность на уровне строк (row-level security) применяется для рабочих пространств в тарифах, которые её включают; предикаты по-прежнему синхронизируются
|
||||
в других тарифах, они просто не применяются.
|
||||
|
||||
## Роль функции по умолчанию
|
||||
|
||||
Когда вы создаёте новое приложение с помощью шаблона, CLI создаёт файл роли по умолчанию, объявленный с помощью `defineApplicationRole()`:
|
||||
|
||||
@@ -50,6 +50,119 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## Satır düzeyi güvenlik
|
||||
|
||||
Nesne ve alan izinleri, bir rolün *hangi nesnelere ve alanlara* erişebileceğine karar verir. **Satır düzeyi
|
||||
izin koşulları** daha da ileri gider ve bir rolün *hangi kayıtları* görebileceğini ve bunlar üzerinde işlem yapabileceğini belirler — örneğin, her harici kullanıcının yalnızca kendi kayıtlarını gördüğü self servis bir rol gibi.
|
||||
|
||||
Rolde `rowLevelPermissionPredicates` ile koşulları tanımlayın. Manifestin geri kalanında olduğu gibi,
|
||||
her koşul kendi `universalIdentifier` değerini taşır ve bir nesneyi ve bir alanı onların
|
||||
`universalIdentifier` değerleriyle belirtir; ayrıca bir `operand` ve (isteğe bağlı olarak) sorgu zamanında değeri enjekte edilen bir workspaceMember alanı içerir — böylece "kaydın sahibi ilişkisinin **geçerli çalışma alanı üyesi olduğunu**" ifade edebilirsiniz:
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Koşullar manifest ile birlikte geldiği için, her kurulum ve yükseltmede rolle birlikte oluşturulur, güncellenir ve kaldırılır — senkronu korumak için ayrı bir kurulum sonrası adım yoktur.
|
||||
|
||||
### Koşulları gruplarla birleştirme
|
||||
|
||||
Varsayılan olarak bir rolün koşulları `AND` ile birleştirilir. Bunların bazılarını `OR` ile birleştirmek (veya
|
||||
mantığı iç içe yerleştirmek) için bir `rowLevelPermissionPredicateGroups` girdisi bildirin ve her koşulu buna
|
||||
`predicateGroupUniversalIdentifier` aracılığıyla yönlendirin. Bu rol, bir iş ortağının ya **sahibi olduğu** ya da **irtibat kişisi** olduğu bir Opportunity'yi görmesine izin verir:
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
Notlar:
|
||||
|
||||
* Her koşula ve gruba kararlı bir `universalIdentifier` (herhangi bir uuid) verin — bu, yükseltmeler boyunca varlığı
|
||||
anahtarlamaya yarar ve koşullar gruplara bu anahtar üzerinden başvurur.
|
||||
* Koşullar, uygulamanıza ait nesnelere ve alanlara veya Twenty'nin standart nesnelerine başvurabilir.
|
||||
* Satır düzeyi güvenlik, bunu içeren planlardaki çalışma alanları için uygulanır; koşullar diğer planlarda da yine senkronize edilir, yalnızca uygulanmaz.
|
||||
|
||||
## Varsayılan fonksiyon rolü
|
||||
|
||||
Yeni bir uygulama iskeleti oluşturduğunuzda, CLI `defineApplicationRole()` ile bildirilen varsayılan bir rol dosyası oluşturur:
|
||||
|
||||
@@ -50,6 +50,115 @@ export default defineRole({
|
||||
});
|
||||
```
|
||||
|
||||
## 行级安全
|
||||
|
||||
对象和字段权限决定某个角色可以访问_哪些对象和字段_。 **行级
|
||||
权限谓词**更进一步，决定某个角色可以查看和操作_哪些记录_——例如，一个自助式角色，其中每个外部用户只能看到自己的记录。
|
||||
|
||||
在角色上使用 `rowLevelPermissionPredicates` 来声明谓词。 与清单的其余部分类似，
|
||||
每个谓词都有自己的 `universalIdentifier`，并引用一个对象和一个字段（通过它们的 `universalIdentifier`）、一个 `operand`，以及（可选的）在查询时注入其值的 workspaceMember 字段——这样你就可以表达：“记录的所有者关系**是**当前的工作区成员”：
|
||||
|
||||
```ts src/roles/partner-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field';
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343',
|
||||
label: 'Partner',
|
||||
description: 'External partner — sees only its own records',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
canUpdateObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111',
|
||||
objectUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier,
|
||||
fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier:
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier,
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
由于谓词随清单一起提供，它们会在每次安装和升级时与该角色一起创建、更新和删除——不需要单独的安装后步骤来保持同步。
|
||||
|
||||
### 将谓词与组组合使用
|
||||
|
||||
默认情况下，角色的谓词通过 `AND` 进行组合。 要将其中一些谓词通过 `OR` 进行组合（或嵌套逻辑），请声明一个 `rowLevelPermissionPredicateGroups` 条目，并通过 `predicateGroupUniversalIdentifier` 将每个谓词指向该条目。 此角色允许合作伙伴查看其**拥有**或其是**联系人**的商机：
|
||||
|
||||
```ts src/roles/partner-opportunities-role.ts
|
||||
import {
|
||||
defineRole,
|
||||
RowLevelPermissionPredicateGroupLogicalOperator,
|
||||
RowLevelPermissionPredicateOperand,
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS,
|
||||
} from 'twenty-sdk/define';
|
||||
|
||||
const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity;
|
||||
const CURRENT_MEMBER =
|
||||
STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id
|
||||
.universalIdentifier;
|
||||
|
||||
export default defineRole({
|
||||
universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222',
|
||||
label: 'Partner (opportunities)',
|
||||
canBeAssignedToUsers: true,
|
||||
objectPermissions: [
|
||||
{
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
canReadObjectRecords: true,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicateGroups: [
|
||||
{
|
||||
universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
|
||||
},
|
||||
],
|
||||
rowLevelPermissionPredicates: [
|
||||
{
|
||||
universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
{
|
||||
universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555',
|
||||
objectUniversalIdentifier: OPPORTUNITY.universalIdentifier,
|
||||
fieldUniversalIdentifier:
|
||||
OPPORTUNITY.fields.pointOfContact.universalIdentifier,
|
||||
operand: RowLevelPermissionPredicateOperand.IS,
|
||||
workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER,
|
||||
predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333',
|
||||
},
|
||||
],
|
||||
});
|
||||
```
|
||||
|
||||
备注：
|
||||
|
||||
* 为每个谓词和组分配一个稳定的 `universalIdentifier`（任意 uuid）——它在各次升级中作为实体的键，谓词通过它来引用组。
|
||||
* 谓词可以引用由你的应用拥有的对象和字段，或由 Twenty 的标准对象拥有的对象和字段。
|
||||
* 行级安全会在包含该功能的套餐中的工作区上强制执行；在其他套餐中谓词仍会同步，只是不会被强制执行。
|
||||
|
||||
## 默认函数角色
|
||||
|
||||
当你使用脚手架创建新应用时，CLI 会创建一个使用 `defineApplicationRole()` 声明的默认角色文件：
|
||||
|
||||
Reference in New Issue
Block a user