From cdaa8f1d9daef0095b4e53397129ae6d2679842f Mon Sep 17 00:00:00 2001 From: Marie <51697796+ijreilly@users.noreply.github.com> Date: Tue, 3 Feb 2026 11:40:21 +0100 Subject: [PATCH] Allow twenty standard app to access messaging items (#17659) --- .../calendar-event-find-many.post-query.hook.ts | 16 +++++++++++++--- .../calendar-event-find-one.post-query.hook.ts | 16 +++++++++++++--- .../message/message-find-many.post-query.hook.ts | 16 +++++++++++++--- .../message/message-find-one.post-query.hook.ts | 16 +++++++++++++--- 4 files changed, 52 insertions(+), 12 deletions(-) diff --git a/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-many.post-query.hook.ts b/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-many.post-query.hook.ts index be8c5e8f28..b1418753df 100644 --- a/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-many.post-query.hook.ts +++ b/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-many.post-query.hook.ts @@ -6,6 +6,7 @@ import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runne import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type'; import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type'; import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util'; +import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications'; import { ApplyCalendarEventsVisibilityRestrictionsService } from 'src/modules/calendar/common/query-hooks/calendar-event/services/apply-calendar-events-visibility-restrictions.service'; import { type CalendarEventWorkspaceEntity } from 'src/modules/calendar/common/standard-objects/calendar-event.workspace-entity'; @@ -25,10 +26,19 @@ export class CalendarEventFindManyPostQueryHook _objectName: string, payload: CalendarEventWorkspaceEntity[], ): Promise { - const { user, apiKey } = authContext; + const { user, apiKey, application } = authContext; - if (!isDefined(user) && !isDefined(apiKey)) { - throw new ForbiddenError('User is required'); + const isTwentyStandardApplication = + isDefined(application) && + application.universalIdentifier === + TWENTY_STANDARD_APPLICATION.universalIdentifier; + + if ( + !isDefined(user) && + !isDefined(apiKey) && + !isTwentyStandardApplication + ) { + throw new ForbiddenError('Authentication is required'); } const workspace = authContext.workspace; diff --git a/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-one.post-query.hook.ts b/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-one.post-query.hook.ts index d6bc8e16cb..5dfcac0a9f 100644 --- a/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-one.post-query.hook.ts +++ b/packages/twenty-server/src/modules/calendar/common/query-hooks/calendar-event/calendar-event-find-one.post-query.hook.ts @@ -6,6 +6,7 @@ import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runne import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type'; import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type'; import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util'; +import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications'; import { ApplyCalendarEventsVisibilityRestrictionsService } from 'src/modules/calendar/common/query-hooks/calendar-event/services/apply-calendar-events-visibility-restrictions.service'; import { type CalendarEventWorkspaceEntity } from 'src/modules/calendar/common/standard-objects/calendar-event.workspace-entity'; @@ -25,10 +26,19 @@ export class CalendarEventFindOnePostQueryHook _objectName: string, payload: CalendarEventWorkspaceEntity[], ): Promise { - const { user, apiKey } = authContext; + const { user, apiKey, application } = authContext; - if (!isDefined(user) && !isDefined(apiKey)) { - throw new ForbiddenError('User is required'); + const isTwentyStandardApplication = + isDefined(application) && + application.universalIdentifier === + TWENTY_STANDARD_APPLICATION.universalIdentifier; + + if ( + !isDefined(user) && + !isDefined(apiKey) && + !isTwentyStandardApplication + ) { + throw new ForbiddenError('Authentication is required'); } const workspace = authContext.workspace; diff --git a/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-many.post-query.hook.ts b/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-many.post-query.hook.ts index 294a4ba02f..14f4ec7cc8 100644 --- a/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-many.post-query.hook.ts +++ b/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-many.post-query.hook.ts @@ -6,6 +6,7 @@ import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runne import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type'; import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type'; import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util'; +import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications'; import { ApplyMessagesVisibilityRestrictionsService } from 'src/modules/messaging/common/query-hooks/message/apply-messages-visibility-restrictions.service'; import { type MessageWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message.workspace-entity'; @@ -25,10 +26,19 @@ export class MessageFindManyPostQueryHook _objectName: string, payload: MessageWorkspaceEntity[], ): Promise { - const { user, apiKey } = authContext; + const { user, apiKey, application } = authContext; - if (!isDefined(user) && !isDefined(apiKey)) { - throw new ForbiddenError('User is required'); + const isTwentyStandardApplication = + isDefined(application) && + application.universalIdentifier === + TWENTY_STANDARD_APPLICATION.universalIdentifier; + + if ( + !isDefined(user) && + !isDefined(apiKey) && + !isTwentyStandardApplication + ) { + throw new ForbiddenError('Authentication is required'); } const workspace = authContext.workspace; diff --git a/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-one.post-query.hook.ts b/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-one.post-query.hook.ts index e6cf8fe401..bdf976965b 100644 --- a/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-one.post-query.hook.ts +++ b/packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-one.post-query.hook.ts @@ -6,6 +6,7 @@ import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runne import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type'; import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type'; import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util'; +import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications'; import { ApplyMessagesVisibilityRestrictionsService } from 'src/modules/messaging/common/query-hooks/message/apply-messages-visibility-restrictions.service'; import { type MessageWorkspaceEntity } from 'src/modules/messaging/common/standard-objects/message.workspace-entity'; @@ -25,10 +26,19 @@ export class MessageFindOnePostQueryHook _objectName: string, payload: MessageWorkspaceEntity[], ): Promise { - const { user, apiKey } = authContext; + const { user, apiKey, application } = authContext; - if (!isDefined(user) && !isDefined(apiKey)) { - throw new ForbiddenError('User is required'); + const isTwentyStandardApplication = + isDefined(application) && + application.universalIdentifier === + TWENTY_STANDARD_APPLICATION.universalIdentifier; + + if ( + !isDefined(user) && + !isDefined(apiKey) && + !isTwentyStandardApplication + ) { + throw new ForbiddenError('Authentication is required'); } const workspace = authContext.workspace;