Improve workspace auth context surface (#18164)

packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-channel-update-one.pre-query.hook.ts

@@ -12,7 +12,7 @@ import {
   WorkspaceQueryRunnerException,
   WorkspaceQueryRunnerExceptionCode,
 } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-runner.exception';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { WorkspaceNotFoundDefaultError } from 'src/engine/core-modules/workspace/workspace.exception';
 import { GlobalWorkspaceOrmManager } from 'src/engine/twenty-orm/global-workspace-datasource/global-workspace-orm.manager';
 import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
@@ -45,7 +45,7 @@ export class MessageChannelUpdateOnePreQueryHook
   ) {}
 
   async execute(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
     _objectName: string,
     payload: UpdateOneResolverArgs<MessageChannelWorkspaceEntity>,
   ): Promise<UpdateOneResolverArgs<MessageChannelWorkspaceEntity>> {

packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-many.post-query.hook.ts

@@ -1,10 +1,9 @@
-import { isDefined } from 'twenty-shared/utils';
-
 import { type WorkspacePostQueryHookInstance } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/interfaces/workspace-query-hook.interface';
 
 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
 import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications';
 import { ApplyMessagesVisibilityRestrictionsService } from 'src/modules/messaging/common/query-hooks/message/apply-messages-visibility-restrictions.service';
@@ -22,20 +21,18 @@ export class MessageFindManyPostQueryHook
   ) {}
 
   async execute(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
     _objectName: string,
     payload: MessageWorkspaceEntity[],
   ): Promise<void> {
-    const { user, apiKey, application } = authContext;
-
     const isTwentyStandardApplication =
-      isDefined(application) &&
-      application.universalIdentifier ===
+      authContext.type === 'application' &&
+      authContext.application.universalIdentifier ===
         TWENTY_STANDARD_APPLICATION.universalIdentifier;
 
     if (
-      !isDefined(user) &&
-      !isDefined(apiKey) &&
+      authContext.type !== 'user' &&
+      authContext.type !== 'apiKey' &&
       !isTwentyStandardApplication
     ) {
       throw new ForbiddenError('Authentication is required');
@@ -47,10 +44,14 @@ export class MessageFindManyPostQueryHook
       throw new ForbiddenError('Workspace is required');
     }
 
+    const userId = isUserAuthContext(authContext)
+      ? authContext.user.id
+      : undefined;
+
     await this.applyMessagesVisibilityRestrictionsService.applyMessagesVisibilityRestrictions(
       payload,
       workspace.id,
-      user?.id,
+      userId,
     );
   }
 }

packages/twenty-server/src/modules/messaging/common/query-hooks/message/message-find-one.post-query.hook.ts

@@ -1,10 +1,11 @@
-import { isDefined } from 'twenty-shared/utils';
-
 import { type WorkspacePostQueryHookInstance } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/interfaces/workspace-query-hook.interface';
 
 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { WorkspaceQueryHookType } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/types/workspace-query-hook.type';
-import { type AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { isApiKeyAuthContext } from 'src/engine/core-modules/auth/guards/is-api-key-auth-context.guard';
+import { isApplicationAuthContext } from 'src/engine/core-modules/auth/guards/is-application-auth-context.guard';
+import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
+import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { ForbiddenError } from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
 import { TWENTY_STANDARD_APPLICATION } from 'src/engine/workspace-manager/twenty-standard-application/constants/twenty-standard-applications';
 import { ApplyMessagesVisibilityRestrictionsService } from 'src/modules/messaging/common/query-hooks/message/apply-messages-visibility-restrictions.service';
@@ -22,20 +23,18 @@ export class MessageFindOnePostQueryHook
   ) {}
 
   async execute(
-    authContext: AuthContext,
+    authContext: WorkspaceAuthContext,
     _objectName: string,
     payload: MessageWorkspaceEntity[],
   ): Promise<void> {
-    const { user, apiKey, application } = authContext;
-
     const isTwentyStandardApplication =
-      isDefined(application) &&
-      application.universalIdentifier ===
+      isApplicationAuthContext(authContext) &&
+      authContext.application.universalIdentifier ===
         TWENTY_STANDARD_APPLICATION.universalIdentifier;
 
     if (
-      !isDefined(user) &&
-      !isDefined(apiKey) &&
+      !isUserAuthContext(authContext) &&
+      !isApiKeyAuthContext(authContext) &&
       !isTwentyStandardApplication
     ) {
       throw new ForbiddenError('Authentication is required');
@@ -47,10 +46,14 @@ export class MessageFindOnePostQueryHook
       throw new ForbiddenError('Workspace is required');
     }
 
+    const userId = isUserAuthContext(authContext)
+      ? authContext.user.id
+      : undefined;
+
     await this.applyMessagesVisibilityRestrictionsService.applyMessagesVisibilityRestrictions(
       payload,
       workspace.id,
-      user?.id,
+      userId,
     );
   }
 }