houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Improve workspace auth context surface (#18164)

Browse Source
This commit is contained in:
Weiko
2026-03-05 16:13:59 +01:00
committed by GitHub
parent 5853891b02
commit cfeea43eaf
118 changed files with 453 additions and 677 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/twenty-orm/entity-manager/workspace-entity-manager.ts
+3 -4
View File
@@ -37,7 +37,6 @@ import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interf
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { InternalServerError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
@@ -138,7 +137,7 @@ export class WorkspaceEntityManager extends EntityManager {
override getRepository<Entity extends ObjectLiteral>(
target: EntityTarget<Entity>,
rolePermissionConfig?: RolePermissionConfig,
authContext?: AuthContext,
authContext?: WorkspaceAuthContext,
): WorkspaceRepository<Entity> {
const dataSource = this.connection;
@@ -239,7 +238,7 @@ export class WorkspaceEntityManager extends EntityManager {
| QueryDeepPartialEntityWithNestedRelationFields<Entity>[],
selectedColumns: string[] | '*' = '*',
permissionOptions?: PermissionOptions,
authContext?: AuthContext,
authContext?: WorkspaceAuthContext,
): Promise<InsertResult> {
const metadata = this.connection.getMetadata(target);
@@ -250,7 +249,7 @@ export class WorkspaceEntityManager extends EntityManager {
permissionOptions,
)
.insert()
.setAuthContext(authContext ?? {})
.setWorkspaceAuthContext(authContext ?? ({} as WorkspaceAuthContext))
.values(entity)
.returning(selectedColumns)
.execute();
packages/twenty-server/src/engine/twenty-orm/repository/workspace-delete-query-builder.ts
+3 -3
View File
@@ -14,7 +14,7 @@ import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interf
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { computeTwentyORMException } from 'src/engine/twenty-orm/error-handling/compute-twenty-orm-exception';
import {
TwentyORMException,
@@ -38,14 +38,14 @@ export class WorkspaceDeleteQueryBuilder<
private objectRecordsPermissions: ObjectsPermissions;
private shouldBypassPermissionChecks: boolean;
private internalContext: WorkspaceInternalContext;
private authContext: AuthContext;
private authContext: WorkspaceAuthContext;
private featureFlagMap: FeatureFlagMap;
constructor(
queryBuilder: DeleteQueryBuilder<T>,
objectRecordsPermissions: ObjectsPermissions,
internalContext: WorkspaceInternalContext,
shouldBypassPermissionChecks: boolean,
authContext: AuthContext,
authContext: WorkspaceAuthContext,
featureFlagMap: FeatureFlagMap,
) {
super(queryBuilder);
packages/twenty-server/src/engine/twenty-orm/repository/workspace-insert-query-builder.ts
+6 -4
View File
@@ -11,7 +11,7 @@ import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interf
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { type QueryDeepPartialEntityWithNestedRelationFields } from 'src/engine/twenty-orm/entity-manager/types/query-deep-partial-entity-with-nested-relation-fields.type';
import { type RelationConnectQueryConfig } from 'src/engine/twenty-orm/entity-manager/types/relation-connect-query-config.type';
import { type RelationDisconnectQueryFieldsByEntityIndex } from 'src/engine/twenty-orm/entity-manager/types/relation-nested-query-fields-by-entity-index.type';
@@ -40,7 +40,7 @@ export class WorkspaceInsertQueryBuilder<
private objectRecordsPermissions: ObjectsPermissions;
private shouldBypassPermissionChecks: boolean;
private internalContext: WorkspaceInternalContext;
private authContext: AuthContext;
private authContext: WorkspaceAuthContext;
private featureFlagMap: FeatureFlagMap;
private relationNestedConfig:
| [RelationConnectQueryConfig[], RelationDisconnectQueryFieldsByEntityIndex]
@@ -64,7 +64,7 @@ export class WorkspaceInsertQueryBuilder<
objectRecordsPermissions: ObjectsPermissions,
internalContext: WorkspaceInternalContext,
shouldBypassPermissionChecks: boolean,
authContext: AuthContext,
authContext: WorkspaceAuthContext,
featureFlagMap: FeatureFlagMap,
) {
super(queryBuilder);
@@ -399,7 +399,9 @@ export class WorkspaceInsertQueryBuilder<
);
}
setAuthContext(authContext: AuthContext): WorkspaceInsertQueryBuilder<T> {
setWorkspaceAuthContext(
authContext: WorkspaceAuthContext,
): WorkspaceInsertQueryBuilder<T> {
this.authContext = authContext;
return this;
packages/twenty-server/src/engine/twenty-orm/repository/workspace-select-query-builder.ts
+3 -3
View File
@@ -9,7 +9,7 @@ import { type QueryDeepPartialEntity } from 'typeorm/query-builder/QueryPartialE
import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interfaces/feature-flag-map.interface';
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import {
PermissionsException,
PermissionsExceptionCode,
@@ -34,14 +34,14 @@ export class WorkspaceSelectQueryBuilder<
objectRecordsPermissions: ObjectsPermissions;
shouldBypassPermissionChecks: boolean;
internalContext: WorkspaceInternalContext;
authContext: AuthContext;
authContext: WorkspaceAuthContext;
featureFlagMap: FeatureFlagMap;
constructor(
queryBuilder: SelectQueryBuilder<T>,
objectRecordsPermissions: ObjectsPermissions,
internalContext: WorkspaceInternalContext,
shouldBypassPermissionChecks: boolean,
authContext: AuthContext,
authContext: WorkspaceAuthContext,
featureFlagMap: FeatureFlagMap,
) {
super(queryBuilder);
packages/twenty-server/src/engine/twenty-orm/repository/workspace-soft-delete-query-builder.ts
+3 -3
View File
@@ -12,7 +12,7 @@ import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interf
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { computeTwentyORMException } from 'src/engine/twenty-orm/error-handling/compute-twenty-orm-exception';
import {
TwentyORMException,
@@ -36,7 +36,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
private objectRecordsPermissions: ObjectsPermissions;
private shouldBypassPermissionChecks: boolean;
private internalContext: WorkspaceInternalContext;
private authContext: AuthContext;
private authContext: WorkspaceAuthContext;
private featureFlagMap: FeatureFlagMap;
constructor(
@@ -44,7 +44,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
objectRecordsPermissions: ObjectsPermissions,
internalContext: WorkspaceInternalContext,
shouldBypassPermissionChecks: boolean,
authContext: AuthContext,
authContext: WorkspaceAuthContext,
featureFlagMap: FeatureFlagMap,
) {
super(queryBuilder);
packages/twenty-server/src/engine/twenty-orm/repository/workspace-update-query-builder.ts
+3 -3
View File
@@ -15,7 +15,7 @@ import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interf
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { type QueryDeepPartialEntityWithNestedRelationFields } from 'src/engine/twenty-orm/entity-manager/types/query-deep-partial-entity-with-nested-relation-fields.type';
import { type RelationConnectQueryConfig } from 'src/engine/twenty-orm/entity-manager/types/relation-connect-query-config.type';
import { type RelationDisconnectQueryFieldsByEntityIndex } from 'src/engine/twenty-orm/entity-manager/types/relation-nested-query-fields-by-entity-index.type';
@@ -47,7 +47,7 @@ export class WorkspaceUpdateQueryBuilder<
private objectRecordsPermissions: ObjectsPermissions;
private shouldBypassPermissionChecks: boolean;
private internalContext: WorkspaceInternalContext;
private authContext: AuthContext;
private authContext: WorkspaceAuthContext;
private featureFlagMap: FeatureFlagMap;
private relationNestedConfig:
| [RelationConnectQueryConfig[], RelationDisconnectQueryFieldsByEntityIndex]
@@ -75,7 +75,7 @@ export class WorkspaceUpdateQueryBuilder<
objectRecordsPermissions: ObjectsPermissions,
internalContext: WorkspaceInternalContext,
shouldBypassPermissionChecks: boolean,
authContext: AuthContext,
authContext: WorkspaceAuthContext,
featureFlagMap: FeatureFlagMap,
) {
super(queryBuilder);
packages/twenty-server/src/engine/twenty-orm/repository/workspace.repository.ts
+4 -4
View File
@@ -22,7 +22,7 @@ import { type UpsertOptions } from 'typeorm/repository/UpsertOptions';
import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interfaces/feature-flag-map.interface';
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import {
PermissionsException,
PermissionsExceptionCode,
@@ -40,7 +40,7 @@ export class WorkspaceRepository<
private shouldBypassPermissionChecks: boolean;
private featureFlagMap: FeatureFlagMap;
public readonly objectRecordsPermissions?: ObjectsPermissions;
private authContext?: AuthContext;
private authContext?: WorkspaceAuthContext;
declare manager: WorkspaceEntityManager;
get internalContext(): WorkspaceInternalContext {
@@ -54,7 +54,7 @@ export class WorkspaceRepository<
queryRunner?: QueryRunner,
objectRecordsPermissions?: ObjectsPermissions,
shouldBypassPermissionChecks = false,
authContext?: AuthContext,
authContext?: WorkspaceAuthContext,
) {
super(target, manager, queryRunner);
this.featureFlagMap = featureFlagMap;
@@ -82,7 +82,7 @@ export class WorkspaceRepository<
this.objectRecordsPermissions,
this.internalContext,
this.shouldBypassPermissionChecks,
this.authContext ?? {},
this.authContext ?? ({} as WorkspaceAuthContext),
this.featureFlagMap,
);
}
packages/twenty-server/src/engine/twenty-orm/utils/apply-row-level-permission-predicates.util.ts
+12 -6
View File
@@ -1,18 +1,19 @@
/* @license Enterprise */
import { FeatureFlagKey } from 'twenty-shared/types';
import {
Brackets,
NotBrackets,
type ObjectLiteral,
type WhereExpressionBuilder,
} from 'typeorm';
import { FeatureFlagKey } from 'twenty-shared/types';
import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interfaces/feature-flag-map.interface';
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { GraphqlQueryFilterFieldParser } from 'src/engine/api/graphql/graphql-query-runner/graphql-query-parsers/graphql-query-filter/graphql-query-filter-field.parser';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
import { type WorkspaceSelectQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-select-query-builder';
import { buildRowLevelPermissionRecordFilter } from 'src/engine/twenty-orm/utils/build-row-level-permission-record-filter.util';
@@ -21,7 +22,7 @@ type ApplyRowLevelPermissionPredicatesArgs<T extends ObjectLiteral> = {
queryBuilder: WorkspaceSelectQueryBuilder<T>;
objectMetadata: FlatObjectMetadata;
internalContext: WorkspaceInternalContext;
authContext: AuthContext;
authContext: WorkspaceAuthContext;
featureFlagMap: FeatureFlagMap;
};
@@ -40,8 +41,11 @@ export const applyRowLevelPermissionPredicates = <T extends ObjectLiteral>({
return;
}
const roleId = authContext.userWorkspaceId
? internalContext.userWorkspaceRoleMap[authContext.userWorkspaceId]
const userWorkspaceId = isUserAuthContext(authContext)
? authContext.userWorkspaceId
: undefined;
const roleId = userWorkspaceId
? internalContext.userWorkspaceRoleMap[userWorkspaceId]
: undefined;
const recordFilter = buildRowLevelPermissionRecordFilter({
@@ -52,7 +56,9 @@ export const applyRowLevelPermissionPredicates = <T extends ObjectLiteral>({
flatFieldMetadataMaps: internalContext.flatFieldMetadataMaps,
objectMetadata,
roleId,
authContext,
workspaceMember: isUserAuthContext(authContext)
? authContext.workspaceMember
: undefined,
});
if (!recordFilter || Object.keys(recordFilter).length === 0) {
packages/twenty-server/src/engine/twenty-orm/utils/build-row-level-permission-record-filter.util.ts
+8 -7
View File
@@ -18,7 +18,7 @@ import {
type RecordFilterGroup,
} from 'twenty-shared/utils';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type UserWorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { isCompositeFieldMetadataType } from 'src/engine/metadata-modules/field-metadata/utils/is-composite-field-metadata-type.util';
import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
@@ -38,7 +38,7 @@ type BuildRowLevelPermissionRecordFilterArgs = {
flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
objectMetadata: FlatObjectMetadata;
roleId: string | undefined;
authContext: AuthContext;
workspaceMember?: UserWorkspaceAuthContext['workspaceMember'];
};
export const buildRowLevelPermissionRecordFilter = ({
@@ -47,7 +47,7 @@ export const buildRowLevelPermissionRecordFilter = ({
flatFieldMetadataMaps,
objectMetadata,
roleId,
authContext,
workspaceMember,
}: BuildRowLevelPermissionRecordFilterArgs): RecordGqlOperationFilter | null => {
if (!isDefined(roleId)) {
return null;
@@ -68,8 +68,6 @@ export const buildRowLevelPermissionRecordFilter = ({
return null;
}
const workspaceMember = authContext.workspaceMember;
const recordFilters = predicates
.map((predicate) => {
const fieldMetadata = findFlatEntityByIdInFlatEntityMaps({
@@ -114,9 +112,12 @@ export const buildRowLevelPermissionRecordFilter = ({
const workspaceMemberSubFieldName =
predicate.workspaceMemberSubFieldName;
if (!isDefined(rawWorkspaceMemberValue)) {
return null;
}
if (
isDefined(workspaceMemberSubFieldName) &&
isDefined(rawWorkspaceMemberValue) &&
isCompositeFieldMetadataType(workspaceMemberFieldMetadata.type) &&
typeof rawWorkspaceMemberValue === 'object'
) {
@@ -236,7 +237,7 @@ export const buildRowLevelPermissionRecordFilter = ({
recordFilterGroups,
fields: fieldMetadataItems,
filterValueDependencies: {
currentWorkspaceMemberId: authContext.workspaceMemberId,
currentWorkspaceMemberId: workspaceMember?.id,
},
});
};
packages/twenty-server/src/engine/twenty-orm/utils/compute-event-select-query-builder.util.ts
+2 -2
View File
@@ -5,7 +5,7 @@ import { type QueryExpressionMap } from 'typeorm/query-builder/QueryExpressionMa
import { type FeatureFlagMap } from 'src/engine/core-modules/feature-flag/interfaces/feature-flag-map.interface';
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { type WorkspaceDeleteQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-delete-query-builder';
import { type WorkspaceInsertQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-insert-query-builder';
import { WorkspaceSelectQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-select-query-builder';
@@ -18,7 +18,7 @@ type EventSelectQueryBuilderFactoryArgs<T extends ObjectLiteral> = {
| WorkspaceSoftDeleteQueryBuilder<T>
| WorkspaceDeleteQueryBuilder<T>
| WorkspaceInsertQueryBuilder<T>;
authContext: AuthContext;
authContext: WorkspaceAuthContext;
internalContext: WorkspaceInternalContext;
featureFlagMap: FeatureFlagMap;
expressionMap: QueryExpressionMap;
packages/twenty-server/src/engine/twenty-orm/utils/format-twenty-orm-event-to-database-batch-event.util.ts
+2 -2
View File
@@ -17,7 +17,7 @@ import {
import type { ObjectLiteral } from 'typeorm';
import { DatabaseEventAction } from 'src/engine/api/graphql/graphql-query-runner/enums/database-event-action';
import type { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type RawAuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { objectRecordChangedValues } from 'src/engine/core-modules/event-emitter/utils/object-record-changed-values';
import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
import { type FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
@@ -43,7 +43,7 @@ export const formatTwentyOrmEventToDatabaseBatchEvent = <
objectMetadataItem: FlatObjectMetadata;
flatFieldMetadataMaps: FlatEntityMaps<FlatFieldMetadata>;
workspaceId: string;
authContext?: AuthContext;
authContext?: RawAuthContext;
recordsAfter?: T[];
recordsBefore?: T[];
}): DatabaseBatchEventInput<T, DatabaseEventAction> | undefined => {
packages/twenty-server/src/engine/twenty-orm/utils/validate-rls-predicates-for-records.util.ts
+11 -5
View File
@@ -5,7 +5,8 @@ import { type ObjectLiteral } from 'typeorm';
import { type WorkspaceInternalContext } from 'src/engine/twenty-orm/interfaces/workspace-internal-context.interface';
import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
import {
TwentyORMException,
@@ -18,7 +19,7 @@ type ValidateRLSPredicatesForRecordsArgs<T extends ObjectLiteral> = {
records: T[];
objectMetadata: FlatObjectMetadata;
internalContext: WorkspaceInternalContext;
authContext: AuthContext;
authContext: WorkspaceAuthContext;
shouldBypassPermissionChecks: boolean;
errorMessage?: string;
};
@@ -35,8 +36,11 @@ export const validateRLSPredicatesForRecords = <T extends ObjectLiteral>({
return;
}
const roleId = authContext.userWorkspaceId
? internalContext.userWorkspaceRoleMap[authContext.userWorkspaceId]
const userWorkspaceId = isUserAuthContext(authContext)
? authContext.userWorkspaceId
: undefined;
const roleId = userWorkspaceId
? internalContext.userWorkspaceRoleMap[userWorkspaceId]
: undefined;
if (!roleId) {
@@ -51,7 +55,9 @@ export const validateRLSPredicatesForRecords = <T extends ObjectLiteral>({
flatFieldMetadataMaps: internalContext.flatFieldMetadataMaps,
objectMetadata,
roleId,
authContext,
workspaceMember: isUserAuthContext(authContext)
? authContext.workspaceMember
: undefined,
});
if (!recordFilter || Object.keys(recordFilter).length === 0) {