diff --git a/packages/twenty-docs/l/ar/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/ar/developers/extend/apps/config/roles.mdx index 11879785db..0354dda4f6 100644 --- a/packages/twenty-docs/l/ar/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/ar/developers/extend/apps/config/roles.mdx @@ -50,6 +50,113 @@ export default defineRole({ }); ``` +## أمن على مستوى الصف + +تحدّد أذونات الكائن والحقل *أي الكائنات والحقول* يمكن لدورٍ معيّن التفاعل معها. **محددات الأذونات على مستوى الصف** تتعمّق أكثر وتحدّد *أي السجلات* يمكن لدورٍ معيّن رؤيتها والتصرّف فيها — على سبيل المثال، دور للخدمة الذاتية حيث يرى كل مستخدم خارجي سجلاته الخاصة فقط. + +عرِّف المحددات باستخدام `rowLevelPermissionPredicates` على الدور. مثل باقي ملف manifest، يحمل كل محدِّد `universalIdentifier` خاصًا به، ويشير إلى كائن وحقل باستخدام `universalIdentifier` الخاصّ بهما، و`operand`، وحقل workspaceMember (اختياري) تُحقن قيمته وقت الاستعلام — بحيث يمكنك التعبير عن: "علاقة مالك السجل **هي** عضو مساحة العمل الحالي": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +نظرًا إلى أنّ المحددات (predicates) تُشحَن داخل ملف manifest، فإنّه يتم إنشاؤها وتحديثها وإزالتها مع الدور نفسه في كل عملية تثبيت وترقية — ولا توجد خطوة ما بعد التثبيت منفصلة تحتاج إلى مزامنتها. + +### دمج المحددات مع المجموعات + +افتراضيًا، يتم دمج محددات الدور باستخدام `AND`. لدمج بعضها باستخدام `OR` (أو لتداخل المنطق)، قم بتعريف إدخال `rowLevelPermissionPredicateGroups` وأشِر كل محدد إليه من خلال `predicateGroupUniversalIdentifier`. يُتيح هذا الدور للشريك رؤية فرصة (Opportunity) إذا كان إمّا **مالكها** أو **جهة الاتصال** لها: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +الملاحظات: + +* امنح كل محدد وكل مجموعة قيمة `universalIdentifier` ثابتة (أي uuid) — فهي المفتاح الذي يعرّف الكيان عبر الترقيات، كما أنّ المحددات تشير إلى المجموعات من خلاله. +* يمكن للمحددات الإشارة إلى الكائنات والحقول التي يملكها تطبيقك أو إلى كائنات Twenty القياسية. +* يتم تطبيق الأمان على مستوى الصف (row-level security) لمساحات العمل في الخطط التي تتضمنه؛ بينما تستمر مزامنة المحددات في الخطط الأخرى ولكن دون تطبيقها فعليًا. + ## الدور الافتراضي للوظيفة عند إنشاء هيكل لتطبيق جديد، ينشئ CLI ملف دور افتراضي مُصرَّحًا به باستخدام `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/cs/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/cs/developers/extend/apps/config/roles.mdx index 4b835413f5..4a2d5e6422 100644 --- a/packages/twenty-docs/l/cs/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/cs/developers/extend/apps/config/roles.mdx @@ -50,6 +50,113 @@ export default defineRole({ }); ``` +## Zabezpečení na úrovni řádků + +Oprávnění objektů a polí určují, *kterých objektů a polí* se může role dotýkat. **Predikáty oprávnění na úrovni řádků** jdou dále a určují, *které záznamy* může role vidět a s nimi pracovat — například samoobslužná role, kde každý externí uživatel vidí pouze své vlastní záznamy. + +Predikáty deklarujte na roli pomocí `rowLevelPermissionPredicates`. Stejně jako zbytek manifestu nese každý predikát svůj vlastní `universalIdentifier` a odkazuje na objekt a pole podle jejich `universalIdentifier`, dále na `operand` a (volitelně) na pole workspaceMember, jehož hodnota je vložena v době dotazu — takže můžete vyjádřit „vztah vlastníka záznamu **je** aktuálním členem pracovního prostoru“: + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Protože predikáty jsou součástí manifestu, vytvářejí se, aktualizují a odstraňují společně s rolí při každé instalaci a aktualizaci — není potřeba žádný samostatný post‑instalační krok, který by je udržoval v synchronizaci. + +### Kombinování predikátů se skupinami + +Ve výchozím nastavení se predikáty role kombinují pomocí `AND`. Aby bylo možné některé z nich kombinovat pomocí `OR` (nebo vnořovat logiku), deklarujte položku `rowLevelPermissionPredicateGroups` a každý predikát na ni odkažte prostřednictvím `predicateGroupUniversalIdentifier`. Tato role umožňuje partnerovi zobrazit obchodní příležitost, kterou buď vlastní, nebo u ní vystupuje jako kontaktní osoba: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Poznámky: + +* Každému predikátu a skupině dejte stabilní `universalIdentifier` (libovolný uuid) — podle něj se entita identifikuje při aktualizacích a predikáty podle něj odkazují na skupiny. +* Predikáty mohou odkazovat na objekty a pole vlastněné vaší aplikací nebo na standardní objekty Twenty. +* Zabezpečení na úrovni řádků je vynucováno pro pracovní prostory v tarifech, které ho zahrnují; predikáty se i na ostatních tarifech stále synchronizují, pouze nejsou vynucovány. + ## Výchozí role funkce Když vygenerujete novou aplikaci, CLI vytvoří výchozí soubor role deklarovaný pomocí `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/de/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/de/developers/extend/apps/config/roles.mdx index 27783ce09b..939e9ac9b5 100644 --- a/packages/twenty-docs/l/de/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/de/developers/extend/apps/config/roles.mdx @@ -50,6 +50,118 @@ export default defineRole({ }); ``` +## Zeilenbasierte Sicherheit + +Objekt- und Feldberechtigungen legen fest, *auf welche Objekte und Felder* eine Rolle zugreifen kann. **Zeilenbasierte +Berechtigungsprädikate** gehen noch weiter und legen fest, *welche Datensätze* eine Rolle sehen und bearbeiten kann — zum +Beispiel eine Self-Service-Rolle, bei der jeder externe Benutzer nur seine eigenen Datensätze sieht. + +Deklarieren Sie Prädikate mit `rowLevelPermissionPredicates` für die Rolle. Wie beim Rest des Manifests hat +jedes Prädikat einen eigenen `universalIdentifier` und referenziert ein Objekt und ein Feld über deren +`universalIdentifier`; außerdem besitzt es einen `operand` und (optional) ein workspaceMember-Feld, dessen Wert zur Abfragezeit injiziert wird — sodass Sie ausdrücken können: "Die Eigentümerbeziehung des Datensatzes **ist** das aktuelle workspaceMember": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Da Prädikate im Manifest ausgeliefert werden, werden sie zusammen mit der Rolle bei jeder Installation und jedem Upgrade erstellt, aktualisiert und entfernt – es ist kein separater Post-Installationsschritt erforderlich, um sie zu synchronisieren. + +### Kombinieren von Prädikaten mit Gruppen + +Standardmäßig werden die Prädikate einer Rolle mit `AND` verknüpft. Um einige von ihnen mit `OR` zu verknüpfen (oder um Logik zu verschachteln), deklarieren Sie einen Eintrag `rowLevelPermissionPredicateGroups` und verweisen Sie von jedem Prädikat aus über `predicateGroupUniversalIdentifier` darauf. Diese Rolle ermöglicht es einem Partner, eine Opportunity zu sehen, deren er entweder **Eigentümer** +oder der **Ansprechpartner** ist: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notizen: + +* Geben Sie jedem Prädikat und jeder Gruppe einen stabilen `universalIdentifier` (beliebige uuid) – er identifiziert die Entität über Upgrades hinweg eindeutig, und Prädikate verweisen über ihn auf Gruppen. +* Prädikate können auf Objekte und Felder verweisen, die Ihrer App gehören, oder auf Standardobjekte von Twenty. +* Zeilenbasierte Sicherheit wird für Workspaces in Tarifen durchgesetzt, die sie enthalten; die Prädikate werden auch in anderen Tarifen weiterhin synchronisiert, sie werden dort einfach nicht durchgesetzt. + ## Die Standard-Funktionsrolle Wenn Sie eine neue App erzeugen, erstellt die CLI eine Datei für die Standardrolle, die mit `defineApplicationRole()` deklariert ist: diff --git a/packages/twenty-docs/l/es/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/es/developers/extend/apps/config/roles.mdx index eda6e97a72..50ac7410cd 100644 --- a/packages/twenty-docs/l/es/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/es/developers/extend/apps/config/roles.mdx @@ -50,6 +50,113 @@ export default defineRole({ }); ``` +## Seguridad a nivel de fila + +Los permisos de objetos y campos determinan *a qué objetos y campos* puede acceder o modificar un rol. **Los predicados de permisos a nivel de fila** van más allá y deciden *qué registros* puede ver y sobre los que puede actuar un rol; por ejemplo, un rol de autoservicio en el que cada usuario externo ve solo sus propios registros. + +Declara los predicados con `rowLevelPermissionPredicates` en el rol. Como el resto del manifiesto, cada predicado tiene su propio `universalIdentifier` y hace referencia a un objeto y a un campo mediante su `universalIdentifier`, a un `operand` y, de forma opcional, a un campo `workspaceMember` cuyo valor se inyecta en tiempo de consulta, de modo que puedas expresar: "la relación de propietario del registro **es** el miembro actual del espacio de trabajo": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Debido a que los predicados se envían en el manifiesto, se crean, actualizan y eliminan junto con el rol en cada instalación y actualización; no hay ningún paso posterior a la instalación independiente que mantener sincronizado. + +### Combinar predicados con grupos + +De forma predeterminada, los predicados de un rol se combinan con `AND`. Para combinar algunos de ellos con `OR` (o para anidar lógica), declara una entrada `rowLevelPermissionPredicateGroups` y haz que cada predicado apunte a ella mediante `predicateGroupUniversalIdentifier`. Este rol permite que un socio vea una Oportunidad de la que **es propietario** o de la que es el **punto de contacto**: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notas: + +* Asigna a cada predicado y grupo un `universalIdentifier` estable (cualquier uuid): sirve como clave de la entidad a través de las actualizaciones, y los predicados hacen referencia a los grupos mediante él. +* Los predicados pueden hacer referencia a objetos y campos que sean propiedad de tu aplicación o de los objetos estándar de Twenty. +* La seguridad a nivel de fila se aplica para los espacios de trabajo en planes que la incluyen; los predicados siguen sincronizándose en otros planes, simplemente no se aplican. + ## El rol de función predeterminado Cuando generas una nueva aplicación, la CLI crea un archivo de rol predeterminado declarado con `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/fr/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/fr/developers/extend/apps/config/roles.mdx index 13435c9d7b..81c81997ff 100644 --- a/packages/twenty-docs/l/fr/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/fr/developers/extend/apps/config/roles.mdx @@ -50,6 +50,113 @@ export default defineRole({ }); ``` +## Sécurité au niveau des lignes + +Les autorisations d’objet et de champ déterminent à *quels objets et champs* un rôle peut accéder. Les **prédicats d’autorisation au niveau des lignes** vont plus loin et déterminent *quels enregistrements* un rôle peut voir et sur lesquels il peut agir — par exemple, un rôle en libre-service où chaque utilisateur externe ne voit que ses propres enregistrements. + +Déclarez les prédicats avec `rowLevelPermissionPredicates` sur le rôle. Comme le reste du manifeste, chaque prédicat porte son propre `universalIdentifier` et fait référence à un objet et à un champ par leur `universalIdentifier`, un `operand` et (facultativement) un champ workspaceMember dont la valeur est injectée au moment de la requête — vous pouvez ainsi exprimer : "la relation de propriétaire de l’enregistrement **est** le membre de l’espace de travail actuel" : + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Comme les prédicats sont livrés dans le manifeste, ils sont créés, mis à jour et supprimés en même temps que le rôle à chaque installation et mise à niveau — il n’y a aucune étape distincte après l’installation à garder synchronisée. + +### Combiner des prédicats avec des groupes + +Par défaut, les prédicats d’un rôle sont combinés avec `AND`. Pour en combiner certains avec `OR` (ou pour imbriquer la logique), déclarez une entrée `rowLevelPermissionPredicateGroups` et faites pointer chaque prédicat vers celle-ci via `predicateGroupUniversalIdentifier`. Ce rôle permet à un partenaire de voir une opportunité qu’il **possède** ou pour laquelle il est le **point de contact** : + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notes : + +* Donnez à chaque prédicat et groupe un `universalIdentifier` stable (n’importe quel uuid) — il sert de clé à l’entité lors des mises à niveau, et les prédicats référencent les groupes via celui-ci. +* Les prédicats peuvent référencer des objets et des champs appartenant à votre application ou aux objets standard de Twenty. +* La sécurité au niveau des lignes est appliquée pour les espaces de travail sur les offres qui l’incluent ; les prédicats sont tout de même synchronisés sur les autres offres, ils ne sont simplement pas appliqués. + ## Le rôle de fonction par défaut Lorsque vous générez une nouvelle application, la CLI crée un fichier de rôle par défaut déclaré avec `defineApplicationRole()` : diff --git a/packages/twenty-docs/l/it/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/it/developers/extend/apps/config/roles.mdx index 57269c2344..6d7d3cedb1 100644 --- a/packages/twenty-docs/l/it/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/it/developers/extend/apps/config/roles.mdx @@ -50,6 +50,119 @@ export default defineRole({ }); ``` +## Sicurezza a livello di riga + +Le autorizzazioni sugli oggetti e sui campi determinano *quali oggetti e campi* un ruolo può gestire. **I predicati di autorizzazione +a livello di riga** vanno oltre e determinano *quali record* un ruolo può vedere e su cui può agire — per +esempio, un ruolo self-service in cui ogni utente esterno vede solo i propri record. + +Dichiara i predicati con `rowLevelPermissionPredicates` sul ruolo. Come il resto del manifest, +ogni predicato ha il proprio `universalIdentifier` e fa riferimento a un oggetto e a un campo tramite il loro +`universalIdentifier`, un `operand` e (facoltativamente) un campo workspaceMember il cui valore viene iniettato +al momento della query — così puoi esprimere "la relazione di proprietario del record **è** l'attuale membro dello spazio di lavoro": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Poiché i predicati vengono distribuiti nel manifest, vengono creati, aggiornati e rimossi insieme al ruolo a ogni installazione e aggiornamento — non è necessario alcun passaggio post-installazione separato per mantenerli sincronizzati. + +### Combinare i predicati con i gruppi + +Per impostazione predefinita, i predicati di un ruolo sono combinati con `AND`. Per combinarne alcuni con `OR` (o per annidare la logica), dichiara una voce `rowLevelPermissionPredicateGroups` e collega ogni predicato ad essa tramite `predicateGroupUniversalIdentifier`. Questo ruolo consente a un partner di vedere un'Opportunità di cui **è proprietario** +o per cui è il **punto di contatto**: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Note: + +* Assegna a ogni predicato e gruppo un `universalIdentifier` stabile (qualsiasi uuid) — identifica l'entità attraverso gli aggiornamenti e i predicati fanno riferimento ai gruppi tramite esso. +* I predicati possono fare riferimento a oggetti e campi di proprietà della tua app o degli oggetti standard di Twenty. +* La sicurezza a livello di riga è applicata per gli spazi di lavoro sui piani che la includono; i predicati vengono comunque sincronizzati sugli altri piani, semplicemente non vengono applicati. + ## Ruolo funzione predefinito Quando esegui lo scaffolding di una nuova app, la CLI crea un file di ruolo predefinito dichiarato con `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/ko/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/ko/developers/extend/apps/config/roles.mdx index 78bedaf010..37c212f18e 100644 --- a/packages/twenty-docs/l/ko/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/ko/developers/extend/apps/config/roles.mdx @@ -50,6 +50,116 @@ export default defineRole({ }); ``` +## 행 수준 보안 + +오브젝트 및 필드 권한은 역할이 *어떤 오브젝트와 필드* 를 다룰 수 있는지를 결정합니다. **행 수준 +권한 프레디킷** 은 더 나아가 역할이 *어떤 레코드* 를 보고 작업할 수 있는지를 결정합니다. 예를 들어, 각 외부 사용자가 자신의 레코드만 볼 수 있는 셀프 서비스 역할 같은 경우입니다. + +역할에 `rowLevelPermissionPredicates` 로 프레디킷을 선언합니다. 매니페스트의 나머지와 마찬가지로, +각 프레디킷은 자체 `universalIdentifier` 를 가지고, 오브젝트와 필드를 각각의 +`universalIdentifier`, `operand`, 그리고 (선택적으로) 쿼리 시점에 값이 주입되는 workspaceMember 필드를 통해 참조합니다. 이렇게 하면 "레코드의 owner relation **is** 현재 workspace member이다"를 표현할 수 있습니다: + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +프레디킷은 매니페스트에 함께 포함되어 배포되므로, 모든 설치와 업그레이드 시 역할과 함께 생성·업데이트·제거됩니다. 동기화를 유지하기 위한 별도의 설치 후 단계는 필요하지 않습니다. + +### 프레디킷을 그룹과 결합하기 + +기본적으로 역할의 프레디킷은 `AND`로 결합됩니다. 일부를 `OR`로 결합하거나(또는 논리를 중첩하려면) `rowLevelPermissionPredicateGroups` 항목을 선언하고 각 프레디킷이 `predicateGroupUniversalIdentifier`를 통해 해당 그룹을 가리키도록 설정합니다. 이 역할은 파트너가 자신이 **소유한** 또는 **담당자**인 기회(Opportunity)를 볼 수 있도록 허용합니다: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +노트: + +* 모든 프레디킷과 그룹에 안정적인 `universalIdentifier`(임의의 uuid)를 부여하세요. 이는 업그레이드 전반에 걸쳐 엔티티의 키로 사용되며, 프레디킷은 이를 통해 그룹을 참조합니다. +* 프레디킷은 앱에서 소유한 오브젝트와 필드뿐만 아니라 Twenty의 표준 오브젝트가 소유한 오브젝트와 필드를 참조할 수 있습니다. +* 행 수준 보안은 이를 포함한 플랜의 워크스페이스에 대해 적용됩니다. 다른 플랜에서도 프레디킷은 계속 동기화되지만, 적용되지는 않습니다. + ## 기본 함수 역할 새 앱을 스캐폴딩하면, CLI가 `defineApplicationRole()`로 선언된 기본 역할 파일을 생성합니다: diff --git a/packages/twenty-docs/l/pt/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/pt/developers/extend/apps/config/roles.mdx index fb6dd1f4aa..173a1129e6 100644 --- a/packages/twenty-docs/l/pt/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/pt/developers/extend/apps/config/roles.mdx @@ -50,6 +50,119 @@ export default defineRole({ }); ``` +## Segurança ao nível da linha + +As permissões de objeto e de campo determinam *quais objetos e campos* uma função pode acessar. **Predicados de permissão ao nível da linha** vão além e determinam *quais registros* uma função pode ver e atuar sobre — por exemplo, uma função de autoatendimento em que cada usuário externo vê apenas seus próprios registros. + +Declare predicados com `rowLevelPermissionPredicates` na função. Como o restante do manifesto, cada predicado carrega seu próprio `universalIdentifier` e faz referência a um objeto e a um campo por seus respectivos `universalIdentifier`, a um `operand` e, opcionalmente, a um campo de workspaceMember cujo valor é injetado no momento da consulta — assim, você pode expressar: "a relação de proprietário do registro **é** o membro de workspace atual": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Como os predicados são enviados no manifesto, eles são criados, atualizados e removidos junto com a +função em cada instalação e atualização — não há uma etapa pós-instalação separada para manter em sincronia. + +### Combinando predicados com grupos + +Por padrão, os predicados de uma função são combinados com `AND`. Para combinar alguns deles com `OR` (ou para +aninhar a lógica), declare uma entrada `rowLevelPermissionPredicateGroups` e faça cada predicado apontar para ela por meio de +`predicateGroupUniversalIdentifier`. Essa função permite que um parceiro veja uma Oportunidade da qual ele **é proprietário** +ou pela qual **é o ponto de contato**: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notas: + +* Dê a cada predicado e grupo um `universalIdentifier` estável (qualquer uuid) — ele identifica a entidade + entre atualizações, e os predicados referenciam os grupos por meio dele. +* Os predicados podem referenciar objetos e campos pertencentes ao seu app ou aos objetos padrão da Twenty. +* A segurança ao nível da linha é aplicada para os workspaces em planos que a incluem; os predicados ainda são sincronizados + em outros planos; eles simplesmente não são aplicados. + ## Papel de função padrão Ao criar um novo app com o scaffold, a CLI cria um arquivo de papel padrão declarado com `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/ro/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/ro/developers/extend/apps/config/roles.mdx index 1ccf6ead01..0032c048b0 100644 --- a/packages/twenty-docs/l/ro/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/ro/developers/extend/apps/config/roles.mdx @@ -50,6 +50,124 @@ export default defineRole({ }); ``` +## Securitate la nivel de rând + +Permisiunile pentru obiecte și câmpuri decid *ce obiecte și câmpuri* poate accesa un rol. **Predicate de +permisiuni la nivel de rând** merg mai departe și decid *ce înregistrări* poate vedea și asupra cărora poate acționa un rol — de +exemplu, un rol de tip autoservire în care fiecare utilizator extern își vede doar propriile înregistrări. + +Declară predicate cu `rowLevelPermissionPredicates` în rol. La fel ca restul manifestului, +fiecare predicat are propriul `universalIdentifier` și face referire la un obiect și un câmp prin +`universalIdentifier`, un `operand` și (opțional) un câmp workspaceMember a cărui valoare este injectată +în momentul interogării — astfel încât poți exprima „relația de proprietar a înregistrării **este** membrul curent al spațiului de lucru”: + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Deoarece predicatele sunt livrate în manifest, ele sunt create, actualizate și eliminate împreună cu +rolul la fiecare instalare și actualizare — nu există un pas separat post-instalare pentru a le menține sincronizate. + +### Combinarea predicatelor cu grupuri + +În mod implicit, predicatele unui rol sunt combinate cu `AND`. Pentru a combina unele dintre ele cu `OR` (sau pentru a +imbrica logica), declară o intrare `rowLevelPermissionPredicateGroups` și asociază fiecare predicat la aceasta prin +`predicateGroupUniversalIdentifier`. Acest rol permite unui partener să vadă o oportunitate pe care fie o **deține**, +fie pentru care este **punctul de contact**: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notițe: + +* Oferă fiecărui predicat și fiecărui grup un `universalIdentifier` stabil (orice uuid) — acesta este cheia entității + de-a lungul actualizărilor, iar predicatele fac referire la grupuri prin el. +* Predicatele pot face referire la obiecte și câmpuri deținute de aplicația ta sau de obiectele standard ale Twenty. +* Securitatea la nivel de rând este aplicată pentru spațiile de lucru din planurile care o includ; predicatele se sincronizează în continuare + pe alte planuri, doar că nu sunt aplicate. + ## Rolul implicit pentru funcții Când generați o aplicație nouă, CLI creează un fișier de rol implicit declarat cu `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/ru/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/ru/developers/extend/apps/config/roles.mdx index 9fdb7635ee..62dad55b7b 100644 --- a/packages/twenty-docs/l/ru/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/ru/developers/extend/apps/config/roles.mdx @@ -50,6 +50,117 @@ export default defineRole({ }); ``` +## Безопасность на уровне строк + +Разрешения на объекты и поля определяют, *к каким объектам и полям* у роли есть доступ. **Предикаты прав доступа на уровне строк** заходят дальше и определяют, *какие записи* роль может видеть и с которыми может работать — например, для роли самообслуживания, где каждый внешний пользователь видит только свои собственные записи. + +Объявляйте предикаты с помощью `rowLevelPermissionPredicates` в роли. Как и остальная часть манифеста, каждый предикат имеет свой собственный `universalIdentifier` и ссылается на объект и поле по их `universalIdentifier`, `operand`, а также (необязательно) поле workspaceMember, значение которого подставляется во время выполнения запроса — чтобы вы могли выразить: "отношение владельца записи **является** текущим участником рабочей области": + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Поскольку предикаты поставляются в манифесте, они создаются, обновляются и удаляются вместе с ролью при каждой установке и обновлении — не требуется отдельный шаг после установки для поддержания синхронизации. + +### Комбинирование предикатов с группами + +По умолчанию предикаты роли комбинируются с помощью `AND`. Чтобы комбинировать некоторые из них с помощью `OR` (или +вкладывать логику), объявите запись `rowLevelPermissionPredicateGroups` и укажите на неё каждый предикат через +`predicateGroupUniversalIdentifier`. Эта роль позволяет партнёру видеть сделку, которая либо **принадлежит** ему, +либо по которой он является **контактным лицом**: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Заметки: + +* Присвойте каждому предикату и группе стабильный `universalIdentifier` (любой uuid) — он служит ключом сущности между обновлениями, а предикаты ссылаются на группы по нему. +* Предикаты могут ссылаться на объекты и поля, принадлежащие вашему приложению, или на стандартные объекты и поля Twenty. +* Безопасность на уровне строк (row-level security) применяется для рабочих пространств в тарифах, которые её включают; предикаты по-прежнему синхронизируются + в других тарифах, они просто не применяются. + ## Роль функции по умолчанию Когда вы создаёте новое приложение с помощью шаблона, CLI создаёт файл роли по умолчанию, объявленный с помощью `defineApplicationRole()`: diff --git a/packages/twenty-docs/l/tr/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/tr/developers/extend/apps/config/roles.mdx index 06d1f36263..b729b774a7 100644 --- a/packages/twenty-docs/l/tr/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/tr/developers/extend/apps/config/roles.mdx @@ -50,6 +50,119 @@ export default defineRole({ }); ``` +## Satır düzeyi güvenlik + +Nesne ve alan izinleri, bir rolün *hangi nesnelere ve alanlara* erişebileceğine karar verir. **Satır düzeyi +izin koşulları** daha da ileri gider ve bir rolün *hangi kayıtları* görebileceğini ve bunlar üzerinde işlem yapabileceğini belirler — örneğin, her harici kullanıcının yalnızca kendi kayıtlarını gördüğü self servis bir rol gibi. + +Rolde `rowLevelPermissionPredicates` ile koşulları tanımlayın. Manifestin geri kalanında olduğu gibi, +her koşul kendi `universalIdentifier` değerini taşır ve bir nesneyi ve bir alanı onların +`universalIdentifier` değerleriyle belirtir; ayrıca bir `operand` ve (isteğe bağlı olarak) sorgu zamanında değeri enjekte edilen bir workspaceMember alanı içerir — böylece "kaydın sahibi ilişkisinin **geçerli çalışma alanı üyesi olduğunu**" ifade edebilirsiniz: + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +Koşullar manifest ile birlikte geldiği için, her kurulum ve yükseltmede rolle birlikte oluşturulur, güncellenir ve kaldırılır — senkronu korumak için ayrı bir kurulum sonrası adım yoktur. + +### Koşulları gruplarla birleştirme + +Varsayılan olarak bir rolün koşulları `AND` ile birleştirilir. Bunların bazılarını `OR` ile birleştirmek (veya +mantığı iç içe yerleştirmek) için bir `rowLevelPermissionPredicateGroups` girdisi bildirin ve her koşulu buna +`predicateGroupUniversalIdentifier` aracılığıyla yönlendirin. Bu rol, bir iş ortağının ya **sahibi olduğu** ya da **irtibat kişisi** olduğu bir Opportunity'yi görmesine izin verir: + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +Notlar: + +* Her koşula ve gruba kararlı bir `universalIdentifier` (herhangi bir uuid) verin — bu, yükseltmeler boyunca varlığı + anahtarlamaya yarar ve koşullar gruplara bu anahtar üzerinden başvurur. +* Koşullar, uygulamanıza ait nesnelere ve alanlara veya Twenty'nin standart nesnelerine başvurabilir. +* Satır düzeyi güvenlik, bunu içeren planlardaki çalışma alanları için uygulanır; koşullar diğer planlarda da yine senkronize edilir, yalnızca uygulanmaz. + ## Varsayılan fonksiyon rolü Yeni bir uygulama iskeleti oluşturduğunuzda, CLI `defineApplicationRole()` ile bildirilen varsayılan bir rol dosyası oluşturur: diff --git a/packages/twenty-docs/l/zh/developers/extend/apps/config/roles.mdx b/packages/twenty-docs/l/zh/developers/extend/apps/config/roles.mdx index 17384006b5..d75ee990ec 100644 --- a/packages/twenty-docs/l/zh/developers/extend/apps/config/roles.mdx +++ b/packages/twenty-docs/l/zh/developers/extend/apps/config/roles.mdx @@ -50,6 +50,115 @@ export default defineRole({ }); ``` +## 行级安全 + +对象和字段权限决定某个角色可以访问_哪些对象和字段_。 **行级 +权限谓词**更进一步，决定某个角色可以查看和操作_哪些记录_——例如，一个自助式角色，其中每个外部用户只能看到自己的记录。 + +在角色上使用 `rowLevelPermissionPredicates` 来声明谓词。 与清单的其余部分类似， +每个谓词都有自己的 `universalIdentifier`，并引用一个对象和一个字段（通过它们的 `universalIdentifier`）、一个 `operand`，以及（可选的）在查询时注入其值的 workspaceMember 字段——这样你就可以表达：“记录的所有者关系**是**当前的工作区成员”： + +```ts src/roles/partner-role.ts +import { + defineRole, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +import { ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER } from '../fields/account-owner.field'; + +export default defineRole({ + universalIdentifier: 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343', + label: 'Partner', + description: 'External partner — sees only its own records', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + canReadObjectRecords: true, + canUpdateObjectRecords: true, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd0f0c1a2-3b4c-4d5e-8f60-111111111111', + objectUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.company.universalIdentifier, + fieldUniversalIdentifier: ACCOUNT_OWNER_FIELD_UNIVERSAL_IDENTIFIER, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier, + }, + ], +}); +``` + +由于谓词随清单一起提供，它们会在每次安装和升级时与该角色一起创建、更新和删除——不需要单独的安装后步骤来保持同步。 + +### 将谓词与组组合使用 + +默认情况下，角色的谓词通过 `AND` 进行组合。 要将其中一些谓词通过 `OR` 进行组合（或嵌套逻辑），请声明一个 `rowLevelPermissionPredicateGroups` 条目，并通过 `predicateGroupUniversalIdentifier` 将每个谓词指向该条目。 此角色允许合作伙伴查看其**拥有**或其是**联系人**的商机： + +```ts src/roles/partner-opportunities-role.ts +import { + defineRole, + RowLevelPermissionPredicateGroupLogicalOperator, + RowLevelPermissionPredicateOperand, + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS, +} from 'twenty-sdk/define'; + +const OPPORTUNITY = STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.opportunity; +const CURRENT_MEMBER = + STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS.workspaceMember.fields.id + .universalIdentifier; + +export default defineRole({ + universalIdentifier: 'b2a1c0d9-8e7f-4a6b-9c5d-222222222222', + label: 'Partner (opportunities)', + canBeAssignedToUsers: true, + objectPermissions: [ + { + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + canReadObjectRecords: true, + }, + ], + rowLevelPermissionPredicateGroups: [ + { + universalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR, + }, + ], + rowLevelPermissionPredicates: [ + { + universalIdentifier: 'd4c3b2a1-0e9f-4c8b-9e7d-444444444444', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: OPPORTUNITY.fields.owner.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + { + universalIdentifier: 'e5d4c3b2-1f0e-4d9c-8f8e-555555555555', + objectUniversalIdentifier: OPPORTUNITY.universalIdentifier, + fieldUniversalIdentifier: + OPPORTUNITY.fields.pointOfContact.universalIdentifier, + operand: RowLevelPermissionPredicateOperand.IS, + workspaceMemberFieldUniversalIdentifier: CURRENT_MEMBER, + predicateGroupUniversalIdentifier: 'c3b2a1d0-9f8e-4b7a-8d6c-333333333333', + }, + ], +}); +``` + +备注： + +* 为每个谓词和组分配一个稳定的 `universalIdentifier`（任意 uuid）——它在各次升级中作为实体的键，谓词通过它来引用组。 +* 谓词可以引用由你的应用拥有的对象和字段，或由 Twenty 的标准对象拥有的对象和字段。 +* 行级安全会在包含该功能的套餐中的工作区上强制执行；在其他套餐中谓词仍会同步，只是不会被强制执行。 + ## 默认函数角色 当你使用脚手架创建新应用时，CLI 会创建一个使用 `defineApplicationRole()` 声明的默认角色文件：