Improve workspace auth context surface (#18164)

2026-03-05 16:13:59 +01:00
parent 5853891b02
commit cfeea43eaf
118 changed files with 453 additions and 677 deletions
@@ -3,8 +3,9 @@ import { Test, type TestingModule } from '@nestjs/testing';
 import { FieldMetadataType } from 'twenty-shared/types';

 import { DataArgProcessorService } from 'src/engine/api/common/common-args-processors/data-arg-processor/data-arg-processor.service';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type SystemWorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { RecordPositionService } from 'src/engine/core-modules/record-position/services/record-position.service';
+import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
 import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
 import { type FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
 import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
@@ -27,12 +28,10 @@ describe('DataArgProcessorService', () => {

  const mockWorkspaceId = '20202020-1234-1234-1234-123456789012';

-  const createMockAuthContext = (): AuthContext =>
-    ({
-      workspace: {
-        id: mockWorkspaceId,
-      },
-    }) as AuthContext;
+  const createMockAuthContext = (): SystemWorkspaceAuthContext => ({
+    type: 'system',
+    workspace: { id: mockWorkspaceId } as WorkspaceEntity,
+  });

  const createFlatFieldMetadataMaps = (
    fieldNames: string[],
@@ -48,7 +48,7 @@ import {
  CommonQueryRunnerExceptionCode,
 } from 'src/engine/api/common/common-query-runners/errors/common-query-runner.exception';
 import { STANDARD_ERROR_MESSAGE } from 'src/engine/api/common/common-query-runners/errors/standard-error-message.constant';
-import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { RecordPositionService } from 'src/engine/core-modules/record-position/services/record-position.service';
 import { transformEmailsValue } from 'src/engine/core-modules/record-transformer/utils/transform-emails-value.util';
 import { transformLinksValue } from 'src/engine/core-modules/record-transformer/utils/transform-links-value.util';
@@ -73,7 +73,7 @@ export class DataArgProcessorService {
    shouldBackfillPositionIfUndefined = true,
  }: {
    partialRecordInputs: Partial<ObjectRecord>[] | undefined;
-    authContext: AuthContext;
+    authContext: WorkspaceAuthContext;
    flatObjectMetadata: FlatObjectMetadata;
    flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
    shouldBackfillPositionIfUndefined?: boolean;
@@ -14,7 +14,7 @@ import { ProcessAggregateHelper } from 'src/engine/api/graphql/graphql-query-run
 import { buildColumnsToSelect } from 'src/engine/api/graphql/graphql-query-runner/utils/build-columns-to-select';
 import { getTargetObjectMetadataOrThrow } from 'src/engine/api/graphql/graphql-query-runner/utils/get-target-object-metadata.util';
 import { type AggregationField } from 'src/engine/api/graphql/workspace-schema-builder/utils/get-available-aggregations-from-object-fields.util';
-import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
 import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
 import { FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
@@ -55,7 +55,7 @@ export class ProcessNestedRelationsV2Helper {
    relations: Record<string, FindOptionsRelations<ObjectLiteral>>;
    aggregate?: Record<string, AggregationField>;
    limit: number;
-    authContext: AuthContext;
+    authContext: WorkspaceAuthContext;
    workspaceDataSource: GlobalWorkspaceDataSource;
    rolePermissionConfig?: RolePermissionConfig;
    // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -111,7 +111,7 @@ export class ProcessNestedRelationsV2Helper {
    nestedRelations: FindOptionsRelations<ObjectLiteral>;
    aggregate: Record<string, AggregationField>;
    limit: number;
-    authContext: AuthContext;
+    authContext: WorkspaceAuthContext;
    workspaceDataSource: GlobalWorkspaceDataSource;
    rolePermissionConfig?: RolePermissionConfig;
    selectedFields: Record<string, unknown>;
@@ -5,7 +5,7 @@ import { type FindOptionsRelations, type ObjectLiteral } from 'typeorm';

 import { ProcessNestedRelationsV2Helper } from 'src/engine/api/common/common-nested-relations-processor/process-nested-relations-v2.helper';
 import { type AggregationField } from 'src/engine/api/graphql/workspace-schema-builder/utils/get-available-aggregations-from-object-fields.util';
-import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
 import { FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
 import { FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
@@ -41,7 +41,7 @@ export class ProcessNestedRelationsHelper {
    relations: Record<string, FindOptionsRelations<ObjectLiteral>>;
    aggregate?: Record<string, AggregationField>;
    limit: number;
-    authContext: AuthContext;
+    authContext: WorkspaceAuthContext;
    workspaceDataSource: GlobalWorkspaceDataSource;
    rolePermissionConfig?: RolePermissionConfig;
    // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -31,9 +31,8 @@ import { WorkspacePreQueryHookPayload } from 'src/engine/api/graphql/workspace-q
 import { WorkspaceQueryHookService } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.service';
 import { ApiKeyRoleService } from 'src/engine/core-modules/api-key/services/api-key-role.service';
 import { isApiKeyAuthContext } from 'src/engine/core-modules/auth/guards/is-api-key-auth-context.guard';
+import { isApplicationAuthContext } from 'src/engine/core-modules/auth/guards/is-application-auth-context.guard';
 import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
-import { isWorkspaceAuthContext } from 'src/engine/core-modules/auth/guards/is-workspace-auth-context.guard';
-import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
 import { WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { FeatureFlagService } from 'src/engine/core-modules/feature-flag/services/feature-flag.service';
 import { MetricsService } from 'src/engine/core-modules/metrics/metrics.service';
@@ -105,14 +104,6 @@ export abstract class CommonBaseQueryRunnerService<
      flatFieldMetadataMaps,
    } = queryRunnerContext;

-    if (!isWorkspaceAuthContext(authContext)) {
-      throw new CommonQueryRunnerException(
-        'Invalid auth context',
-        CommonQueryRunnerExceptionCode.INVALID_AUTH_CONTEXT,
-        { userFriendlyMessage: STANDARD_ERROR_MESSAGE },
-      );
-    }
-
    await this.throttleQueryExecution(authContext);

    await this.validate(args, queryRunnerContext);
@@ -312,32 +303,35 @@ export abstract class CommonBaseQueryRunnerService<
  }

  private async getRoleIdOrThrow(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
    workspaceId: string,
  ): Promise<string> {
-    if (isDefined(authContext.apiKey)) {
+    if (isApiKeyAuthContext(authContext)) {
      return this.apiKeyRoleService.getRoleIdForApiKeyId(
        authContext.apiKey.id,
        workspaceId,
      );
    }

-    if (isDefined(authContext.application?.defaultRoleId)) {
-      return authContext.application?.defaultRoleId;
+    if (
+      isApplicationAuthContext(authContext) &&
+      isDefined(authContext.application.defaultRoleId)
+    ) {
+      return authContext.application.defaultRoleId;
    }

-    if (!isDefined(authContext.userWorkspaceId)) {
-      throw new CommonQueryRunnerException(
-        'Invalid auth context',
-        CommonQueryRunnerExceptionCode.INVALID_AUTH_CONTEXT,
-        { userFriendlyMessage: STANDARD_ERROR_MESSAGE },
-      );
+    if (isUserAuthContext(authContext)) {
+      return this.userRoleService.getRoleIdForUserWorkspace({
+        userWorkspaceId: authContext.userWorkspaceId,
+        workspaceId,
+      });
    }

-    return this.userRoleService.getRoleIdForUserWorkspace({
-      userWorkspaceId: authContext.userWorkspaceId,
-      workspaceId,
-    });
+    throw new CommonQueryRunnerException(
+      'Invalid auth context',
+      CommonQueryRunnerExceptionCode.INVALID_AUTH_CONTEXT,
+      { userFriendlyMessage: STANDARD_ERROR_MESSAGE },
+    );
  }

  private async prepareExtendedQueryRunnerContextWithGlobalDatasource(
@@ -29,7 +29,6 @@ import { buildColumnsToReturn } from 'src/engine/api/graphql/graphql-query-runne
 import { buildColumnsToSelect } from 'src/engine/api/graphql/graphql-query-runner/utils/build-columns-to-select';
 import { assertIsValidUuid } from 'src/engine/api/graphql/workspace-query-runner/utils/assert-is-valid-uuid.util';
 import { getAllSelectableColumnNames } from 'src/engine/api/utils/get-all-selectable-column-names.utils';
-import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
 import { WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
 import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
@@ -117,7 +116,7 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
    flatObjectMetadata: FlatObjectMetadata;
    flatObjectMetadataMaps: FlatEntityMaps<FlatObjectMetadata>;
    flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
-    authContext: AuthContext;
+    authContext: WorkspaceAuthContext;
    workspaceDataSource: GlobalWorkspaceDataSource;
    rolePermissionConfig?: RolePermissionConfig;
  }): Promise<void> {
@@ -1,10 +1,10 @@
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
 import { type FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
 import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';

 export type CommonBaseQueryRunnerContext = {
-  authContext: AuthContext;
+  authContext: WorkspaceAuthContext;
  flatObjectMetadata: FlatObjectMetadata;
  flatObjectMetadataMaps: FlatEntityMaps<FlatObjectMetadata>;
  flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
@@ -1,11 +1,11 @@
 import { type QueryResultFieldValue } from 'src/engine/api/graphql/workspace-query-runner/factories/query-result-getters/interfaces/query-result-field-value';
 import { type ResolverArgs } from 'src/engine/api/graphql/workspace-resolver-builder/interfaces/workspace-resolvers-builder.interface';

-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';

 export interface WorkspacePreQueryHookInstance {
  execute(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
    objectName: string,
    payload: ResolverArgs,
  ): Promise<ResolverArgs>;
@@ -13,7 +13,7 @@ export interface WorkspacePreQueryHookInstance {

 export interface WorkspacePostQueryHookInstance {
  execute(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
    objectName: string,
    payload: QueryResultFieldValue,
  ): Promise<void>;
@@ -12,6 +12,8 @@ import {
  type WorkspacePreQueryHookInstance,
 } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/interfaces/workspace-query-hook.interface';

+import { isApiKeyAuthContext } from 'src/engine/core-modules/auth/guards/is-api-key-auth-context.guard';
+import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
 import { STANDARD_ERROR_MESSAGE } from 'src/engine/api/common/common-query-runners/errors/standard-error-message.constant';
 import {
  GraphqlQueryRunnerException,
@@ -171,14 +173,24 @@ export class WorkspaceQueryHookExplorer implements OnModuleInit {
      const contextId = createContextId();

      if (this.moduleRef.registerRequestByContextId) {
+        const authContext = executeParams[0];
+
        this.moduleRef.registerRequestByContextId(
          {
            req: {
              workspaceId: workspace.id,
-              userWorkspaceId: executeParams?.[0].userWorkspaceId,
-              apiKey: executeParams?.[0].apiKey,
-              workspaceMemberId: executeParams?.[0].workspaceMemberId,
-              user: executeParams?.[0].user,
+              userWorkspaceId: isUserAuthContext(authContext)
+                ? authContext.userWorkspaceId
+                : undefined,
+              apiKey: isApiKeyAuthContext(authContext)
+                ? authContext.apiKey
+                : undefined,
+              workspaceMemberId: isUserAuthContext(authContext)
+                ? authContext.workspaceMemberId
+                : undefined,
+              user: isUserAuthContext(authContext)
+                ? authContext.user
+                : undefined,
            },
          },
          contextId,
@@ -10,7 +10,7 @@ import { type WorkspaceQueryHookKey } from 'src/engine/api/graphql/workspace-que
 import { WorkspaceQueryHookStorage } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/storage/workspace-query-hook.storage';
 import { type WorkspacePreQueryHookPayload } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type';
 import { WorkspaceQueryHookExplorer } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/workspace-query-hook.explorer';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';

@Injectable()
 export class WorkspaceQueryHookService {
@@ -23,7 +23,7 @@ export class WorkspaceQueryHookService {
  public async executePreQueryHooks<
    T extends WorkspaceResolverBuilderMethodNames | CommonQueryNames,
  >(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
    // TODO: We should allow wildcard for object name
    objectName: string,
    methodName: T,
@@ -56,7 +56,7 @@ export class WorkspaceQueryHookService {
  public async executePostQueryHooks<
    T extends WorkspaceResolverBuilderMethodNames,
  >(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
    // TODO: We should allow wildcard for object name
    objectName: string,
    methodName: T,
@@ -36,7 +36,6 @@ export class CreateManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -35,7 +35,6 @@ export class CreateOneResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class DeleteManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -35,7 +35,6 @@ export class DeleteOneResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class DestroyManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -35,7 +35,6 @@ export class DestroyOneResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class FindDuplicatesResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class FindManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class FindOneResolverFactory

        const resolverContext = createQueryRunnerContext({
          workspaceSchemaBuilderContext: internalContext,
-          request: requestContext.req,
        });

        const record = await this.commonFindOneQueryRunnerService.execute(
@@ -36,7 +36,6 @@ export class GroupByResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      const shouldIncludeRecords =
@@ -35,7 +35,6 @@ export class MergeManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class RestoreManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -35,7 +35,6 @@ export class RestoreOneResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -36,7 +36,6 @@ export class UpdateManyResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -35,7 +35,6 @@ export class UpdateOneResolverFactory

      const resolverContext = createQueryRunnerContext({
        workspaceSchemaBuilderContext: internalContext,
-        request: requestContext.req,
      });

      try {
@@ -1,41 +1,15 @@
 import { type WorkspaceSchemaBuilderContext } from 'src/engine/api/graphql/workspace-schema-builder/interfaces/workspace-schema-builder-context.interface';

 import { type CommonBaseQueryRunnerContext } from 'src/engine/api/common/types/common-base-query-runner-context.type';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { getWorkspaceAuthContext } from 'src/engine/core-modules/auth/storage/workspace-auth-context.storage';

 export const createQueryRunnerContext = ({
  workspaceSchemaBuilderContext,
-  request,
 }: {
  workspaceSchemaBuilderContext: WorkspaceSchemaBuilderContext;
-  request: AuthContext;
 }): CommonBaseQueryRunnerContext => {
-  const {
-    user,
-    workspace,
-    apiKey,
-    workspaceMemberId,
-    userWorkspaceId,
-    userWorkspace,
-    authProvider,
-    impersonationContext,
-    workspaceMember,
-    application,
-  } = request;
-
  return {
    ...workspaceSchemaBuilderContext,
-    authContext: {
-      user,
-      workspace,
-      apiKey,
-      workspaceMemberId,
-      userWorkspaceId,
-      userWorkspace,
-      authProvider,
-      impersonationContext,
-      workspaceMember,
-      application,
-    },
+    authContext: getWorkspaceAuthContext(),
  };
 };