houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enforce server route app configuration requirements (#22091)

Browse Source 
## Summary
This PR enforces that applications exposing server route logic functions
must be claimed (have an owner workspace) and installed on that owner
workspace to be considered "configured". This ensures server route
resolvers have a valid workspace context to execute in.

## Key Changes
- **ApplicationRegistrationVariableService**: Enhanced
`isConfiguredBatch()` to check server route configuration in addition to
required variables
- Added `ApplicationEntity` repository injection to track app
installations
- Implemented `isServerRouteConfigured()` private method that validates:
- If app exposes server route logic functions, it must have an owner
workspace
- If it has an owner workspace, it must be installed on that workspace
  - Added comprehensive test suite covering all configuration scenarios

- **ServerRouteTriggerService**: Removed feature flag check
(`IS_SERVER_LOGIC_FUNCTION_ENABLED`)
  - Deleted `TwentyConfigService` dependency
  - Removed feature disabled exception handling
- Server route triggers are now always enabled (gated by app
configuration instead)

- **Configuration**: Removed `IS_SERVER_LOGIC_FUNCTION_ENABLED` config
variable from `ConfigVariables`

- **Exception handling**: Removed `FEATURE_DISABLED` exception code from
`ServerRouteTriggerExceptionCode`

- **UI & Documentation**: Updated messaging and docs to reflect that
server route apps require claiming and installation on owner workspace

## Implementation Details
- Server route configuration is checked alongside required variable
validation in `isConfiguredBatch()`
- Uses efficient batch queries with `Promise.all()` to fetch variables,
registrations, and installations in parallel
- Installs are tracked via a Set of `${registrationId}:${workspaceId}`
keys for O(1) lookup
- Apps without server route functions are unaffected by this change

https://claude.ai/code/session_01Ub3K25p2q4XE1LW1LGJbkG

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/22091?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
This commit is contained in:
martmull
2026-06-24 18:20:05 +02:00
committed by GitHub
parent 9574476395
commit b5958fb331
9 changed files with 61 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-docs/developers/extend/apps/logic/logic-functions.mdx
+4
View File
@@ -262,6 +262,10 @@ POST https://your-twenty-server.com/webhooks/server/:resolverLogicFunctionUniver
The identifier is the resolver's `universalIdentifier` from your manifest. Register that URL with the provider.
<Note>
**The application must be claimed and installed on its owner workspace.** Because the resolver runs in the **owner workspace** (the workspace that owns the application registration), a server route trigger only works once the application has been *claimed* — i.e. it has an owner workspace — **and** that application is **installed on the owner workspace**. Until both are true the resolver has nowhere to run, so the route cannot be dispatched. An application that exposes a `serverRouteTriggerSettings` logic function therefore cannot be listed in the marketplace until it is claimed and installed on its owner workspace.
</Note>
**Resolver contract.** The SDK's `LogicFunctionConfig` type enforces this at compile time: as soon as you set `serverRouteTriggerSettings`, your handler is constrained to return `{ workspaceId: string; targetLogicFunctionUniversalIdentifier: string; payload?: object }` (or a `Promise` of it). The `workspaceId` must be a workspace where the target function is installed, otherwise the request is rejected with `404`.
| Field | Type | Notes |
packages/twenty-front/src/pages/settings/applications/tabs/SettingsApplicationRegistrationGeneralTab.tsx
+1 -1
View File
@@ -24,7 +24,7 @@ export const SettingsApplicationRegistrationGeneralTab = ({
{!registration.isConfigured && fromAdmin && (
<InlineBanner
color="danger"
message={t`This app has required server variables that are not configured. Users won't be able to install it until all required variables are set.`}
message={t`This app is not fully configured. Users won't be able to install it until all required server variables are set, and — for apps exposing a server route — until the app is claimed and installed on its owner workspace.`}
button={{
title: t`Configure`,
onClick: () => navigate('#config'),
packages/twenty-server/src/engine/core-modules/application/application-registration-variable/application-registration-variable.module.ts
+2
View File
@@ -4,6 +4,7 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { ApplicationRegistrationVariableEntity } from 'src/engine/core-modules/application/application-registration-variable/application-registration-variable.entity';
import { ApplicationRegistrationVariableService } from 'src/engine/core-modules/application/application-registration-variable/application-registration-variable.service';
import { ApplicationRegistrationEntity } from 'src/engine/core-modules/application/application-registration/application-registration.entity';
import { ApplicationEntity } from 'src/engine/core-modules/application/application.entity';
import { SecretEncryptionModule } from 'src/engine/core-modules/secret-encryption/secret-encryption.module';
@Module({
@@ -11,6 +12,7 @@ import { SecretEncryptionModule } from 'src/engine/core-modules/secret-encryptio
TypeOrmModule.forFeature([
ApplicationRegistrationVariableEntity,
ApplicationRegistrationEntity,
ApplicationEntity,
]),
SecretEncryptionModule,
],
packages/twenty-server/src/engine/core-modules/application/application-registration-variable/application-registration-variable.service.ts
+54 -23
View File
@@ -7,6 +7,7 @@ import { In, Not, type Repository } from 'typeorm';
import { ApplicationRegistrationVariableEntity } from 'src/engine/core-modules/application/application-registration-variable/application-registration-variable.entity';
import { ApplicationRegistrationEntity } from 'src/engine/core-modules/application/application-registration/application-registration.entity';
import { ApplicationEntity } from 'src/engine/core-modules/application/application.entity';
import {
ApplicationRegistrationException,
ApplicationRegistrationExceptionCode,
@@ -23,6 +24,8 @@ export class ApplicationRegistrationVariableService {
private readonly variableRepository: Repository<ApplicationRegistrationVariableEntity>,
@InjectRepository(ApplicationRegistrationEntity)
private readonly applicationRegistrationRepository: Repository<ApplicationRegistrationEntity>,
@InjectRepository(ApplicationEntity)
private readonly applicationRepository: Repository<ApplicationEntity>,
private readonly encryptionService: SecretEncryptionService,
) {}
@@ -161,43 +164,71 @@ export class ApplicationRegistrationVariableService {
async isConfiguredBatch(
applicationRegistrationIds: string[],
): Promise<Map<string, boolean>> {
const variables = await this.variableRepository.find({
where: { applicationRegistrationId: In(applicationRegistrationIds) },
});
const variablesByRegistrationId = new Map<
string,
ApplicationRegistrationVariableEntity[]
>();
for (const variable of variables) {
const existing =
variablesByRegistrationId.get(variable.applicationRegistrationId) ?? [];
existing.push(variable);
variablesByRegistrationId.set(
variable.applicationRegistrationId,
existing,
);
}
const [variables, registrations, installedApps] = await Promise.all([
this.variableRepository.find({
where: { applicationRegistrationId: In(applicationRegistrationIds) },
}),
this.applicationRegistrationRepository.find({
where: { id: In(applicationRegistrationIds) },
select: { id: true, manifest: true, ownerWorkspaceId: true },
}),
this.applicationRepository.find({
where: { applicationRegistrationId: In(applicationRegistrationIds) },
select: { applicationRegistrationId: true, workspaceId: true },
}),
]);
const result = new Map<string, boolean>();
for (const id of applicationRegistrationIds) {
const registrationVariables = variablesByRegistrationId.get(id) ?? [];
const requiredVariables = registrationVariables.filter(
(v) => v.isRequired,
const registration = registrations.find(
(registration) => registration.id === id,
);
const areVariablesConfigured = variables
.filter(
(variable) =>
variable.applicationRegistrationId === id && variable.isRequired,
)
.every((variable) => variable.isFilled);
const isInstalledOnOwnerWorkspace = installedApps.some(
(app) =>
app.applicationRegistrationId === id &&
app.workspaceId === registration?.ownerWorkspaceId,
);
result.set(
id,
requiredVariables.every((v) => v.isFilled),
areVariablesConfigured &&
this.isServerRouteConfigured(
registration,
isInstalledOnOwnerWorkspace,
),
);
}
return result;
}
private isServerRouteConfigured(
registration: ApplicationRegistrationEntity | undefined,
isInstalledOnOwnerWorkspace: boolean,
): boolean {
const hasServerRouteFunction =
registration?.manifest?.logicFunctions?.some((logicFunction) =>
isDefined(logicFunction.serverRouteTriggerSettings),
) ?? false;
if (!hasServerRouteFunction) {
return true;
}
return (
isDefined(registration?.ownerWorkspaceId) && isInstalledOnOwnerWorkspace
);
}
private async findVariableOrThrow(
id: string,
): Promise<ApplicationRegistrationVariableEntity> {
packages/twenty-server/src/engine/core-modules/server-route-trigger/__tests__/server-route-trigger.service.spec.ts
-12
View File
@@ -9,7 +9,6 @@ import {
} from 'src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service';
import { ServerRouteTriggerExceptionCode } from 'src/engine/core-modules/server-route-trigger/exceptions/server-route-trigger.exception';
import { ServerRouteTriggerService } from 'src/engine/core-modules/server-route-trigger/server-route-trigger.service';
import { type TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { type LogicFunctionEntity } from 'src/engine/metadata-modules/logic-function/logic-function.entity';
import { LogicFunctionExecutionStatus } from 'src/engine/metadata-modules/logic-function/dtos/logic-function-execution-result.dto';
@@ -55,7 +54,6 @@ describe('ServerRouteTriggerService', () => {
let logicFunctionExecutorService: jest.Mocked<
Pick<LogicFunctionExecutorService, 'execute'>
>;
let twentyConfigService: jest.Mocked<Pick<TwentyConfigService, 'get'>>;
const handle = () =>
service.handle({
@@ -98,12 +96,10 @@ describe('ServerRouteTriggerService', () => {
// target returns the final response body
.mockResolvedValueOnce(buildExecuteResult({ ok: true })),
};
twentyConfigService = { get: jest.fn().mockReturnValue(true) };
service = new ServerRouteTriggerService(
logicFunctionRepository as unknown as Repository<LogicFunctionEntity>,
logicFunctionExecutorService as unknown as LogicFunctionExecutorService,
twentyConfigService as unknown as TwentyConfigService,
);
});
@@ -133,14 +129,6 @@ describe('ServerRouteTriggerService', () => {
);
});
it('refuses when the feature is disabled', async () => {
twentyConfigService.get.mockReturnValue(false);
await expect(handle()).rejects.toMatchObject({
code: ServerRouteTriggerExceptionCode.FEATURE_DISABLED,
});
});
it('throws LOGIC_FUNCTION_NOT_FOUND when no row matches the universalIdentifier', async () => {
logicFunctionRepository.find.mockResolvedValue([]);
packages/twenty-server/src/engine/core-modules/server-route-trigger/exceptions/server-route-trigger-rest-api-exception-filter.ts
-6
View File
@@ -30,12 +30,6 @@ export class ServerRouteTriggerRestApiExceptionFilter implements ExceptionFilter
response,
404,
);
case ServerRouteTriggerExceptionCode.FEATURE_DISABLED:
return this.httpExceptionHandlerService.handleError(
exception as CustomException,
response,
503,
);
case ServerRouteTriggerExceptionCode.RATE_LIMIT_EXCEEDED:
return this.httpExceptionHandlerService.handleError(
exception as CustomException,
packages/twenty-server/src/engine/core-modules/server-route-trigger/exceptions/server-route-trigger.exception.ts
-3
View File
@@ -5,7 +5,6 @@ import { assertUnreachable } from 'twenty-shared/utils';
import { CustomException } from 'src/utils/custom-exception';
export enum ServerRouteTriggerExceptionCode {
FEATURE_DISABLED = 'FEATURE_DISABLED',
LOGIC_FUNCTION_NOT_FOUND = 'LOGIC_FUNCTION_NOT_FOUND',
RATE_LIMIT_EXCEEDED = 'RATE_LIMIT_EXCEEDED',
SERVER_ROUTE_USER_UNCAUGHT_ERROR = 'SERVER_ROUTE_USER_UNCAUGHT_ERROR',
@@ -17,8 +16,6 @@ const getServerRouteTriggerExceptionUserFriendlyMessage = (
code: ServerRouteTriggerExceptionCode,
) => {
switch (code) {
case ServerRouteTriggerExceptionCode.FEATURE_DISABLED:
return msg`Server logic functions are disabled on this instance.`;
case ServerRouteTriggerExceptionCode.LOGIC_FUNCTION_NOT_FOUND:
return msg`Server logic function not found.`;
case ServerRouteTriggerExceptionCode.RATE_LIMIT_EXCEEDED:
packages/twenty-server/src/engine/core-modules/server-route-trigger/server-route-trigger.service.ts
-9
View File
@@ -20,7 +20,6 @@ import {
ServerRouteTriggerException,
ServerRouteTriggerExceptionCode,
} from 'src/engine/core-modules/server-route-trigger/exceptions/server-route-trigger.exception';
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { LogicFunctionEntity } from 'src/engine/metadata-modules/logic-function/logic-function.entity';
type ResolverResult = {
@@ -37,7 +36,6 @@ export class ServerRouteTriggerService {
@InjectRepository(LogicFunctionEntity)
private readonly logicFunctionRepository: Repository<LogicFunctionEntity>,
private readonly logicFunctionExecutorService: LogicFunctionExecutorService,
private readonly twentyConfigService: TwentyConfigService,
) {}
async handle({
@@ -47,13 +45,6 @@ export class ServerRouteTriggerService {
request: Request;
resolverLogicFunctionUniversalIdentifier: string;
}): Promise<RouteTriggerResponse> {
if (!this.twentyConfigService.get('IS_SERVER_LOGIC_FUNCTION_ENABLED')) {
throw new ServerRouteTriggerException(
'Server logic functions are disabled on this instance',
ServerRouteTriggerExceptionCode.FEATURE_DISABLED,
);
}
const resolver = await this.findResolver({
logicFunctionUniversalIdentifier:
resolverLogicFunctionUniversalIdentifier,
packages/twenty-server/src/engine/core-modules/twenty-config/config-variables.ts
-8
View File
@@ -695,14 +695,6 @@ export class ConfigVariables {
@IsAWSRegion()
LOGIC_FUNCTION_LAMBDA_LAYER_BUCKET_REGION?: AwsRegion;
@ConfigVariablesMetadata({
group: ConfigVariablesGroup.LOGIC_FUNCTION_CONFIG,
description: 'Enable instance-level (server) logic functions',
type: ConfigVariableType.BOOLEAN,
})
@IsOptional()
IS_SERVER_LOGIC_FUNCTION_ENABLED = false;
@ConfigVariablesMetadata({
group: ConfigVariablesGroup.CODE_INTERPRETER_CONFIG,
description: