houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance role-check system with stricter checks (#15392)

Browse Source 
## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.
This commit is contained in:
Félix Malfait
2025-11-07 15:37:17 +01:00
committed by GitHub
parent 44d6ec2594
commit cff17db6cb
306 changed files with 13863 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/api/graphql/graphql-config/hooks/use-cached-metadata.ts
+6 -1
View File
@@ -20,7 +20,7 @@ export function useCachedMetadata(config: CacheMetadataPluginConfig): Plugin {
request,
}: {
operationName: string;
request: Pick<Request, 'workspace' | 'locale' | 'body'>;
request: Pick<Request, 'workspace' | 'locale' | 'body' | 'userWorkspaceId'>;
}) => {
const workspace = request.workspace;
@@ -34,6 +34,11 @@ export function useCachedMetadata(config: CacheMetadataPluginConfig): Plugin {
.update(request.body.query)
.digest('hex');
// For FindAllCoreViews, use user-specific cache key since visibility filtering is user-dependent
if (operationName === 'FindAllCoreViews') {
return `graphql:operations:${operationName}:${workspace.id}:${workspaceMetadataVersion}:${request.userWorkspaceId}:${queryHash}`;
}
return `graphql:operations:${operationName}:${workspace.id}:${workspaceMetadataVersion}:${locale}:${queryHash}`;
};
packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts
+21 -14
View File
@@ -31,8 +31,10 @@ import { ConfigVariableGraphqlApiExceptionFilter } from 'src/engine/core-modules
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { AdminPanelGuard } from 'src/engine/guards/admin-panel-guard';
import { ServerLevelImpersonateGuard } from 'src/engine/guards/server-level-impersonate.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { AdminPanelHealthServiceDataDTO } from './dtos/admin-panel-health-service-data.dto';
import { QueueMetricsDataDTO } from './dtos/queue-metrics-data.dto';
@@ -44,6 +46,11 @@ import { QueueMetricsDataDTO } from './dtos/queue-metrics-data.dto';
PreventNestToAutoLogGraphqlErrorsFilter,
ConfigVariableGraphqlApiExceptionFilter,
)
@UseGuards(
WorkspaceAuthGuard,
UserAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.SECURITY),
)
export class AdminPanelResolver {
constructor(
private adminService: AdminPanelService,
@@ -53,7 +60,7 @@ export class AdminPanelResolver {
private readonly twentyConfigService: TwentyConfigService,
) {}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, ServerLevelImpersonateGuard)
@UseGuards(ServerLevelImpersonateGuard)
@Mutation(() => UserLookup)
async userLookupAdminPanel(
@Args() userLookupInput: UserLookupInput,
@@ -61,7 +68,7 @@ export class AdminPanelResolver {
return await this.adminService.userLookup(userLookupInput.userIdentifier);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async updateWorkspaceFeatureFlag(
@Args() updateFlagInput: UpdateWorkspaceFeatureFlagInput,
@@ -83,19 +90,19 @@ export class AdminPanelResolver {
}
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => ConfigVariablesOutput)
async getConfigVariablesGrouped(): Promise<ConfigVariablesOutput> {
return this.adminService.getConfigVariablesGrouped();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => SystemHealthDTO)
async getSystemHealthStatus(): Promise<SystemHealthDTO> {
return this.adminPanelHealthService.getSystemHealthStatus();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => AdminPanelHealthServiceDataDTO)
async getIndicatorHealthStatus(
@Args('indicatorId', {
@@ -106,7 +113,7 @@ export class AdminPanelResolver {
return this.adminPanelHealthService.getIndicatorHealthStatus(indicatorId);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => QueueMetricsDataDTO)
async getQueueMetrics(
@Args('queueName', { type: () => String })
@@ -124,13 +131,13 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => VersionInfoDTO)
async versionInfo(): Promise<VersionInfoDTO> {
return this.adminService.getVersionInfo();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => ConfigVariableDTO)
async getDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -140,7 +147,7 @@ export class AdminPanelResolver {
return this.adminService.getConfigVariable(key);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async createDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -152,7 +159,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async updateDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -164,7 +171,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async deleteDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -174,7 +181,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => QueueJobsResponseDTO)
async getQueueJobs(
@Args('queueName', { type: () => String })
@@ -194,7 +201,7 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => RetryJobsResponseDTO)
async retryJobs(
@Args('queueName', { type: () => String })
@@ -208,7 +215,7 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => DeleteJobsResponseDTO)
async deleteJobs(
@Args('queueName', { type: () => String })
packages/twenty-server/src/engine/core-modules/application/application.module.ts
+2
View File
@@ -13,6 +13,7 @@ import { DataSourceModule } from 'src/engine/metadata-modules/data-source/data-s
import { DatabaseEventTriggerModule } from 'src/engine/metadata-modules/database-event-trigger/database-event-trigger.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { ObjectMetadataModule } from 'src/engine/metadata-modules/object-metadata/object-metadata.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RouteTriggerModule } from 'src/engine/metadata-modules/route-trigger/route-trigger.module';
import { ServerlessFunctionLayerModule } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.module';
import { ServerlessFunctionModule } from 'src/engine/metadata-modules/serverless-function/serverless-function.module';
@@ -33,6 +34,7 @@ import { FieldMetadataModule } from 'src/engine/metadata-modules/field-metadata/
CronTriggerModule,
RouteTriggerModule,
WorkspaceMigrationV2Module,
PermissionsModule,
],
providers: [ApplicationResolver, ApplicationService, ApplicationSyncService],
})
packages/twenty-server/src/engine/core-modules/application/application.resolver.ts
+6 -1
View File
@@ -12,9 +12,14 @@ import { FeatureFlagKey } from 'src/engine/core-modules/feature-flag/enums/featu
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { RequireFeatureFlag } from 'src/engine/guards/feature-flag.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.APPLICATIONS),
)
@Resolver()
@UseFilters(ApplicationExceptionFilter)
export class ApplicationResolver {
packages/twenty-server/src/engine/core-modules/applicationVariable/application-variable.module.ts
+5 -1
View File
@@ -5,9 +5,13 @@ import { NestjsQueryTypeOrmModule } from '@ptc-org/nestjs-query-typeorm';
import { ApplicationVariableEntity } from 'src/engine/core-modules/applicationVariable/application-variable.entity';
import { ApplicationVariableEntityService } from 'src/engine/core-modules/applicationVariable/application-variable.service';
import { ApplicationVariableEntityResolver } from 'src/engine/core-modules/applicationVariable/application-variable.resolver';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [NestjsQueryTypeOrmModule.forFeature([ApplicationVariableEntity])],
imports: [
NestjsQueryTypeOrmModule.forFeature([ApplicationVariableEntity]),
PermissionsModule,
],
providers: [
ApplicationVariableEntityService,
ApplicationVariableEntityResolver,
packages/twenty-server/src/engine/core-modules/applicationVariable/application-variable.resolver.ts
+8 -3
View File
@@ -1,12 +1,17 @@
import { UseFilters, UseGuards } from '@nestjs/common';
import { Args, Mutation, Resolver } from '@nestjs/graphql';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ApplicationVariableEntityExceptionFilter } from 'src/engine/core-modules/applicationVariable/application-variable-exception-filter';
import { ApplicationVariableEntityService } from 'src/engine/core-modules/applicationVariable/application-variable.service';
import { UpdateApplicationVariableEntityInput } from 'src/engine/core-modules/applicationVariable/dtos/update-application-variable.input';
import { ApplicationVariableEntityExceptionFilter } from 'src/engine/core-modules/applicationVariable/application-variable-exception-filter';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.APPLICATIONS),
)
@Resolver()
@UseFilters(ApplicationVariableEntityExceptionFilter)
export class ApplicationVariableEntityResolver {
packages/twenty-server/src/engine/core-modules/approved-access-domain/approved-access-domain.module.ts
+2
View File
@@ -7,12 +7,14 @@ import { ApprovedAccessDomainResolver } from 'src/engine/core-modules/approved-a
import { ApprovedAccessDomainService } from 'src/engine/core-modules/approved-access-domain/services/approved-access-domain.service';
import { WorkspaceDomainsModule } from 'src/engine/core-modules/domain/workspace-domains/workspace-domains.module';
import { FileModule } from 'src/engine/core-modules/file/file.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
WorkspaceDomainsModule,
FileModule,
NestjsQueryTypeOrmModule.forFeature([ApprovedAccessDomainEntity]),
PermissionsModule,
],
exports: [ApprovedAccessDomainService],
providers: [ApprovedAccessDomainService, ApprovedAccessDomainResolver],
packages/twenty-server/src/engine/core-modules/approved-access-domain/approved-access-domain.resolver.ts
+6 -1
View File
@@ -13,11 +13,16 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE_MEMBERS),
)
@UsePipes(ResolverValidationPipe)
@UseFilters(
ApprovedAccessDomainExceptionFilter,
packages/twenty-server/src/engine/core-modules/audit/audit.resolver.ts
+4 -3
View File
@@ -13,15 +13,16 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { Analytics } from './dtos/analytics.dto';
import {
CreateAnalyticsInputV2,
isPageviewAnalyticsInput,
isTrackAnalyticsInput,
} from './dtos/create-analytics.input';
import { Analytics } from './dtos/analytics.dto';
import { AuditService } from './services/audit.service';
@Resolver(() => Analytics)
@@ -42,7 +43,7 @@ export class AuditResolver {
}
@Mutation(() => Analytics)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
async createObjectEvent(
@Args()
createObjectEventInput: CreateObjectEventInput,
@@ -70,7 +71,7 @@ export class AuditResolver {
}
@Mutation(() => Analytics)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async trackAnalytics(
@Args()
createAnalyticsInput: CreateAnalyticsInputV2,
packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts
+18 -17
View File
@@ -68,6 +68,7 @@ import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.ent
import { AuthProvider } from 'src/engine/decorators/auth/auth-provider.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -76,11 +77,11 @@ import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/cons
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
import { ApiKeyToken } from './dto/api-key-token.dto';
import { AuthTokens } from './dto/auth-tokens.dto';
import { GetAuthTokensFromLoginTokenInput } from './dto/get-auth-tokens-from-login-token.input';
import { LoginTokenOutput } from './dto/login-token.dto';
import { SignUpInput } from './dto/sign-up.input';
import { ApiKeyToken } from './dto/api-key-token.dto';
import { AuthTokens } from './dto/auth-tokens.dto';
import { UserCredentialsInput } from './dto/user-credentials.input';
import { CheckUserExistOutput } from './dto/user-exists.dto';
import { EmailAndCaptchaInput } from './dto/user-exists.input';
@@ -135,7 +136,7 @@ export class AuthResolver {
}
@Mutation(() => GetAuthorizationUrlForSSOOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getAuthorizationUrlForSSO(
@Args('input') params: GetAuthorizationUrlForSSOInput,
) {
@@ -166,7 +167,7 @@ export class AuthResolver {
}
@Mutation(() => LoginTokenOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async getLoginTokenFromCredentials(
@Args()
getLoginTokenFromCredentialsInput: UserCredentialsInput,
@@ -201,7 +202,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signIn(
@Args()
userCredentials: UserCredentialsInput,
@@ -239,7 +240,7 @@ export class AuthResolver {
}
@Mutation(() => GetLoginTokenFromEmailVerificationTokenOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getLoginTokenFromEmailVerificationToken(
@Args()
getAuthTokenFromEmailVerificationTokenInput: GetAuthTokenFromEmailVerificationTokenInput,
@@ -275,7 +276,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getWorkspaceAgnosticTokenFromEmailVerificationToken(
@Args()
getAuthTokenFromEmailVerificationTokenInput: GetAuthTokenFromEmailVerificationTokenInput,
@@ -319,7 +320,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async getAuthTokensFromOTP(
@Args()
twoFactorAuthenticationVerificationInput: TwoFactorAuthenticationVerificationInput,
@@ -357,7 +358,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signUp(
@Args() signUpInput: UserCredentialsInput,
): Promise<AvailableWorkspacesAndAccessTokensOutput> {
@@ -409,7 +410,7 @@ export class AuthResolver {
}
@Mutation(() => SignUpOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signUpInWorkspace(
@Args() signUpInput: SignUpInput,
@AuthProvider() authProvider: AuthProviderEnum,
@@ -482,7 +483,7 @@ export class AuthResolver {
}
@Mutation(() => SignUpOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async signUpInNewWorkspace(
@AuthUser() currentUser: UserEntity,
@AuthProvider() authProvider: AuthProviderEnum,
@@ -511,7 +512,7 @@ export class AuthResolver {
}
@Mutation(() => TransientTokenOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async generateTransientToken(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -535,7 +536,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getAuthTokensFromLoginToken(
@Args() getAuthTokensFromLoginTokenInput: GetAuthTokensFromLoginTokenInput,
@Args('origin') origin: string,
@@ -757,7 +758,7 @@ export class AuthResolver {
}
@Mutation(() => AuthorizeAppOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async authorizeApp(
@Args() authorizeAppInput: AuthorizeAppInput,
@AuthUser() user: UserEntity,
@@ -771,7 +772,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async renewToken(@Args() args: AppTokenInput): Promise<AuthTokens> {
const tokens = await this.renewTokenService.generateTokensFromRefreshToken(
args.appToken,
@@ -797,7 +798,7 @@ export class AuthResolver {
}
@Mutation(() => EmailPasswordResetLinkOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async emailPasswordResetLink(
@Args() emailPasswordResetInput: EmailPasswordResetLinkInput,
@Context() context: I18nContext,
@@ -816,7 +817,7 @@ export class AuthResolver {
}
@Mutation(() => InvalidatePasswordOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async updatePasswordViaResetToken(
@Args()
{ passwordResetToken, newPassword }: UpdatePasswordViaResetTokenInput,
packages/twenty-server/src/engine/core-modules/billing/billing.resolver.ts
+13 -12
View File
@@ -7,6 +7,7 @@ import { WorkspaceActivationStatus } from 'twenty-shared/workspace';
import { BillingCheckoutSessionInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-checkout-session.input';
import { BillingSessionInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-session.input';
import { BillingUpdateSubscriptionItemPriceInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-update-subscription-item-price.input';
import { BillingEndTrialPeriodOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-end-trial-period.output';
import { BillingMeteredProductUsageOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-metered-product-usage.output';
import { BillingPlanOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-plan.output';
@@ -27,6 +28,7 @@ import { AuthApiKey } from 'src/engine/decorators/auth/auth-api-key.decorator';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -38,7 +40,6 @@ import {
} from 'src/engine/metadata-modules/permissions/permissions.exception';
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
import { BillingUpdateSubscriptionItemPriceInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-update-subscription-item-price.input';
@Resolver()
@UsePipes(ResolverValidationPipe)
@@ -59,7 +60,7 @@ export class BillingResolver {
@Query(() => BillingSessionOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async billingPortalSession(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -74,7 +75,7 @@ export class BillingResolver {
}
@Mutation(() => BillingSessionOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, NoPermissionGuard)
async checkoutSession(
@AuthWorkspace() workspace: WorkspaceEntity,
@AuthUser() user: UserEntity,
@@ -137,7 +138,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async switchSubscriptionInterval(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -159,7 +160,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async switchBillingPlan(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.changePlan(workspace);
@@ -179,7 +180,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchBillingPlan(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.cancelSwitchPlan(workspace);
@@ -199,7 +200,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchBillingInterval(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -221,7 +222,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async setMeteredSubscriptionPrice(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -255,7 +256,7 @@ export class BillingResolver {
@Mutation(() => BillingEndTrialPeriodOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async endSubscriptionTrialPeriod(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -266,7 +267,7 @@ export class BillingResolver {
@Query(() => [BillingMeteredProductUsageOutput])
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async getMeteredProductsUsage(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -277,7 +278,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchMeteredPrice(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.cancelSwitchMeteredPrice(workspace);
@@ -320,7 +321,7 @@ export class BillingResolver {
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
workspaceId,
setting: PermissionFlagType.WORKSPACE,
setting: PermissionFlagType.BILLING,
apiKeyId,
});
packages/twenty-server/src/engine/core-modules/email-verification/email-verification.resolver.ts
+2 -1
View File
@@ -9,6 +9,7 @@ import { EmailVerificationService } from 'src/engine/core-modules/email-verifica
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { I18nContext } from 'src/engine/core-modules/i18n/types/i18n-context.type';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
@Resolver()
@@ -25,7 +26,7 @@ export class EmailVerificationResolver {
// TODO: this should be an authenticated endpoint
@Mutation(() => ResendEmailVerificationTokenOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async resendEmailVerificationToken(
@Args()
resendEmailVerificationTokenInput: ResendEmailVerificationTokenInput,
packages/twenty-server/src/engine/core-modules/emailing-domain/emailing-domain.module.ts
+2
View File
@@ -9,11 +9,13 @@ import { EmailingDomainDriverFactory } from 'src/engine/core-modules/emailing-do
import { EmailingDomainEntity } from 'src/engine/core-modules/emailing-domain/emailing-domain.entity';
import { EmailingDomainResolver } from 'src/engine/core-modules/emailing-domain/emailing-domain.resolver';
import { EmailingDomainService } from 'src/engine/core-modules/emailing-domain/services/emailing-domain.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
TypeORMModule,
NestjsQueryTypeOrmModule.forFeature([EmailingDomainEntity]),
PermissionsModule,
],
exports: [EmailingDomainService],
providers: [
packages/twenty-server/src/engine/core-modules/emailing-domain/emailing-domain.resolver.ts
+6 -1
View File
@@ -7,9 +7,14 @@ import { EmailingDomainService } from 'src/engine/core-modules/emailing-domain/s
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
)
@UsePipes(ResolverValidationPipe)
@Resolver(() => EmailingDomainDto)
export class EmailingDomainResolver {
packages/twenty-server/src/engine/core-modules/file/file-upload/file-upload.module.ts
+2 -1
View File
@@ -4,9 +4,10 @@ import { Module } from '@nestjs/common';
import { FileUploadResolver } from 'src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver';
import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
import { FileModule } from 'src/engine/core-modules/file/file.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [FileModule, HttpModule],
imports: [FileModule, HttpModule, PermissionsModule],
providers: [FileUploadService, FileUploadResolver],
exports: [FileUploadService, FileUploadResolver],
})
packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.spec.ts
+5
View File
@@ -2,6 +2,7 @@ import { Test, type TestingModule } from '@nestjs/testing';
import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { FileUploadResolver } from './file-upload.resolver';
@@ -20,6 +21,10 @@ describe('FileUploadResolver', () => {
provide: TwentyConfigService,
useValue: {},
},
{
provide: PermissionsService,
useValue: {},
},
],
}).compile();
packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.ts
+4
View File
@@ -11,7 +11,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
@UseGuards(WorkspaceAuthGuard)
@@ -22,6 +24,7 @@ export class FileUploadResolver {
constructor(private readonly fileUploadService: FileUploadService) {}
@Mutation(() => SignedFileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async uploadFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
@@ -48,6 +51,7 @@ export class FileUploadResolver {
}
@Mutation(() => SignedFileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async uploadImage(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
packages/twenty-server/src/engine/core-modules/file/file.module.ts
+2
View File
@@ -9,6 +9,7 @@ import { FileAttachmentListener } from 'src/engine/core-modules/file/listeners/f
import { FileWorkspaceMemberListener } from 'src/engine/core-modules/file/listeners/file-workspace-member.listener';
import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { FileController } from './controllers/file.controller';
import { FileEntity } from './entities/file.entity';
@@ -22,6 +23,7 @@ import { FileService } from './services/file.service';
JwtModule,
TypeOrmModule.forFeature([FileEntity, WorkspaceEntity]),
HttpModule,
PermissionsModule,
],
providers: [
FileService,
packages/twenty-server/src/engine/core-modules/file/resolvers/file.resolver.ts
+4
View File
@@ -10,7 +10,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
@UseGuards(WorkspaceAuthGuard)
@@ -21,6 +23,7 @@ export class FileResolver {
constructor(private readonly fileMetadataService: FileMetadataService) {}
@Mutation(() => FileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async createFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
@@ -38,6 +41,7 @@ export class FileResolver {
}
@Mutation(() => FileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async deleteFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args('fileId', { type: () => UUIDScalarType }) fileId: string,
packages/twenty-server/src/engine/core-modules/impersonation/impersonation.resolver.ts
+2
View File
@@ -10,6 +10,7 @@ import {
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { ImpersonationService } from 'src/engine/core-modules/impersonation/services/impersonation.service';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { ImpersonatePermissionGuard } from 'src/engine/guards/impersonate-permission.guard';
import { NoImpersonationGuard } from 'src/engine/guards/no-impersonation.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -25,6 +26,7 @@ export class ImpersonationResolver {
UserAuthGuard,
NoImpersonationGuard,
ImpersonatePermissionGuard,
CustomPermissionGuard,
)
@Mutation(() => ImpersonateOutput)
async impersonate(
packages/twenty-server/src/engine/core-modules/onboarding/onboarding.resolver.ts
+3
View File
@@ -9,6 +9,7 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -20,6 +21,7 @@ export class OnboardingResolver {
constructor(private readonly onboardingService: OnboardingService) {}
@Mutation(() => OnboardingStepSuccessDTO)
@UseGuards(NoPermissionGuard)
async skipSyncEmailOnboardingStep(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -34,6 +36,7 @@ export class OnboardingResolver {
}
@Mutation(() => OnboardingStepSuccessDTO)
@UseGuards(NoPermissionGuard)
async skipBookOnboardingStep(
@AuthWorkspace() workspace: WorkspaceEntity,
): Promise<OnboardingStepSuccessDTO> {
packages/twenty-server/src/engine/core-modules/page-layout/page-layout.module.ts
+2
View File
@@ -15,6 +15,7 @@ import { PageLayoutTabService } from 'src/engine/core-modules/page-layout/servic
import { PageLayoutUpdateService } from 'src/engine/core-modules/page-layout/services/page-layout-update.service';
import { PageLayoutWidgetService } from 'src/engine/core-modules/page-layout/services/page-layout-widget.service';
import { PageLayoutService } from 'src/engine/core-modules/page-layout/services/page-layout.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
@Module({
@@ -25,6 +26,7 @@ import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
PageLayoutWidgetEntity,
]),
TwentyORMModule,
PermissionsModule,
FeatureFlagModule,
],
controllers: [
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout-tab.resolver.ts
+8 -1
View File
@@ -9,9 +9,11 @@ import { UpdatePageLayoutTabInput } from 'src/engine/core-modules/page-layout/dt
import { PageLayoutTabDTO } from 'src/engine/core-modules/page-layout/dtos/page-layout-tab.dto';
import { PageLayoutTabService } from 'src/engine/core-modules/page-layout/services/page-layout-tab.service';
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutTabDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@@ -40,6 +42,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async createPageLayoutTab(
@Args('input') input: CreatePageLayoutTabInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -48,6 +51,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async updatePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@Args('input') input: UpdatePageLayoutTabInput,
@@ -57,6 +61,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async deletePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -70,6 +75,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async destroyPageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -78,6 +84,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async restorePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout-widget.resolver.ts
+8 -1
View File
@@ -16,9 +16,11 @@ import { WidgetConfiguration } from 'src/engine/core-modules/page-layout/dtos/wi
import { PageLayoutWidgetService } from 'src/engine/core-modules/page-layout/services/page-layout-widget.service';
import { injectWidgetConfigurationDiscriminator } from 'src/engine/core-modules/page-layout/utils/inject-widget-configuration-discriminator.util';
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutWidgetDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@@ -49,6 +51,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async createPageLayoutWidget(
@Args('input') input: CreatePageLayoutWidgetInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -57,6 +60,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async updatePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@Args('input') input: UpdatePageLayoutWidgetInput,
@@ -66,6 +70,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async deletePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -74,6 +79,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async destroyPageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -82,6 +88,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async restorePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout.resolver.ts
+6 -1
View File
@@ -13,11 +13,16 @@ import { PageLayoutService } from 'src/engine/core-modules/page-layout/services/
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.LAYOUTS),
)
@UsePipes(ResolverValidationPipe)
export class PageLayoutResolver {
constructor(
packages/twenty-server/src/engine/core-modules/postgres-credentials/postgres-credentials.module.ts
+6 -1
View File
@@ -5,9 +5,14 @@ import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
import { PostgresCredentialsEntity } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.entity';
import { PostgresCredentialsResolver } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.resolver';
import { PostgresCredentialsService } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [JwtModule, TypeOrmModule.forFeature([PostgresCredentialsEntity])],
imports: [
JwtModule,
TypeOrmModule.forFeature([PostgresCredentialsEntity]),
PermissionsModule,
],
providers: [
PostgresCredentialsResolver,
PostgresCredentialsService,
packages/twenty-server/src/engine/core-modules/postgres-credentials/postgres-credentials.resolver.ts
+6 -3
View File
@@ -5,15 +5,20 @@ import { PostgresCredentialsDTO } from 'src/engine/core-modules/postgres-credent
import { PostgresCredentialsService } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL),
)
@Resolver(() => PostgresCredentialsDTO)
export class PostgresCredentialsResolver {
constructor(
private readonly postgresCredentialsService: PostgresCredentialsService,
) {}
@UseGuards(WorkspaceAuthGuard)
@Mutation(() => PostgresCredentialsDTO)
async enablePostgresProxy(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -21,7 +26,6 @@ export class PostgresCredentialsResolver {
return this.postgresCredentialsService.enablePostgresProxy(workspaceId);
}
@UseGuards(WorkspaceAuthGuard)
@Mutation(() => PostgresCredentialsDTO)
async disablePostgresProxy(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -29,7 +33,6 @@ export class PostgresCredentialsResolver {
return this.postgresCredentialsService.disablePostgresProxy(workspaceId);
}
@UseGuards(WorkspaceAuthGuard)
@Query(() => PostgresCredentialsDTO, { nullable: true })
async getPostgresCredentials(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/public-domain/public-domain.module.ts
+2
View File
@@ -9,11 +9,13 @@ import { DnsManagerModule } from 'src/engine/core-modules/dns-manager/dns-manage
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { CheckPublicDomainsValidRecordsCronCommand } from 'src/engine/core-modules/public-domain/crons/commands/check-public-domains-valid-records.cron.command';
import { CheckPublicDomainsValidRecordsCronJob } from 'src/engine/core-modules/public-domain/crons/jobs/check-public-domains-valid-records.cron.job';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
NestjsQueryTypeOrmModule.forFeature([PublicDomainEntity, WorkspaceEntity]),
DnsManagerModule,
PermissionsModule,
],
exports: [CheckPublicDomainsValidRecordsCronCommand, PublicDomainService],
providers: [
packages/twenty-server/src/engine/core-modules/public-domain/public-domain.resolver.ts
+15 -10
View File
@@ -1,28 +1,33 @@
import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
import { UseFilters, UseGuards, UsePipes } from '@nestjs/common';
import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { assertIsDefinedOrThrow } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
import { DomainValidRecords } from 'src/engine/core-modules/dns-manager/dtos/domain-valid-records';
import { DnsManagerService } from 'src/engine/core-modules/dns-manager/services/dns-manager.service';
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { PublicDomainExceptionFilter } from 'src/engine/core-modules/public-domain/public-domain-exception-filter';
import { PublicDomainService } from 'src/engine/core-modules/public-domain/public-domain.service';
import { PublicDomainDTO } from 'src/engine/core-modules/public-domain/dtos/public-domain.dto';
import { PublicDomainInput } from 'src/engine/core-modules/public-domain/dtos/public-domain.input';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { DomainValidRecords } from 'src/engine/core-modules/dns-manager/dtos/domain-valid-records';
import { PublicDomainExceptionFilter } from 'src/engine/core-modules/public-domain/public-domain-exception-filter';
import { PublicDomainEntity } from 'src/engine/core-modules/public-domain/public-domain.entity';
import { DnsManagerService } from 'src/engine/core-modules/dns-manager/services/dns-manager.service';
import {
PublicDomainException,
PublicDomainExceptionCode,
} from 'src/engine/core-modules/public-domain/public-domain.exception';
import { PublicDomainService } from 'src/engine/core-modules/public-domain/public-domain.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE_MEMBERS),
)
@UsePipes(ResolverValidationPipe)
@UseFilters(
PublicDomainExceptionFilter,
packages/twenty-server/src/engine/core-modules/two-factor-authentication/two-factor-authentication.resolver.ts
+6 -4
View File
@@ -17,6 +17,8 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -45,7 +47,7 @@ export class TwoFactorAuthenticationResolver {
) {}
@Mutation(() => InitiateTwoFactorAuthenticationProvisioningOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async initiateOTPProvisioning(
@Args()
initiateTwoFactorAuthenticationProvisioningInput: InitiateTwoFactorAuthenticationProvisioningInput,
@@ -97,7 +99,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => InitiateTwoFactorAuthenticationProvisioningOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async initiateOTPProvisioningForAuthenticatedUser(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -121,7 +123,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => DeleteTwoFactorAuthenticationMethodOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, CustomPermissionGuard)
async deleteTwoFactorAuthenticationMethod(
@Args()
deleteTwoFactorAuthenticationMethodInput: DeleteTwoFactorAuthenticationMethodInput,
@@ -161,7 +163,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => VerifyTwoFactorAuthenticationMethodOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, NoPermissionGuard)
async verifyTwoFactorAuthenticationMethodForAuthenticatedUser(
@Args()
verifyTwoFactorAuthenticationMethodInput: VerifyTwoFactorAuthenticationMethodInput,
packages/twenty-server/src/engine/core-modules/user/user.resolver.ts
+6 -4
View File
@@ -54,6 +54,8 @@ import { AuthProvider } from 'src/engine/decorators/auth/auth-provider.decorator
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@@ -124,7 +126,7 @@ export class UserResolver {
}
@Query(() => UserEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async currentUser(
@AuthUser() { id: userId }: UserEntity,
@AuthWorkspace({ allowUndefined: true }) workspace: WorkspaceEntity,
@@ -366,7 +368,7 @@ export class UserResolver {
}
@Mutation(() => SignedFileDTO)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
async uploadProfilePicture(
@AuthUser() { id }: UserEntity,
@AuthWorkspace({ allowUndefined: true })
@@ -398,13 +400,13 @@ export class UserResolver {
}
@Mutation(() => UserEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async deleteUser(@AuthUser() { id: userId }: UserEntity) {
return this.userService.deleteUser(userId);
}
@Mutation(() => UserWorkspaceEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, CustomPermissionGuard)
async deleteUserFromWorkspace(
@Args('workspaceMemberIdToDelete') workspaceMemberIdToDelete: string,
@AuthUser() { id: userId }: UserEntity,
packages/twenty-server/src/engine/core-modules/webhook/webhook.module.ts
+2
View File
@@ -5,6 +5,7 @@ import { AuthModule } from 'src/engine/core-modules/auth/auth.module';
import { WebhookEntity } from 'src/engine/core-modules/webhook/webhook.entity';
import { WebhookResolver } from 'src/engine/core-modules/webhook/webhook.resolver';
import { WebhookService } from 'src/engine/core-modules/webhook/webhook.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WebhookController } from './controllers/webhook.controller';
@@ -13,6 +14,7 @@ import { WebhookController } from './controllers/webhook.controller';
imports: [
TypeOrmModule.forFeature([WebhookEntity]),
AuthModule,
PermissionsModule,
WorkspaceCacheStorageModule,
],
providers: [WebhookService, WebhookResolver],
packages/twenty-server/src/engine/core-modules/webhook/webhook.resolver.ts
+6 -1
View File
@@ -10,13 +10,18 @@ import { UpdateWebhookInput } from 'src/engine/core-modules/webhook/dtos/update-
import { webhookGraphqlApiExceptionHandler } from 'src/engine/core-modules/webhook/utils/webhook-graphql-api-exception-handler.util';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { WebhookEntity } from './webhook.entity';
import { WebhookService } from './webhook.service';
@Resolver(() => WebhookEntity)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.API_KEYS_AND_WEBHOOKS),
)
export class WebhookResolver {
constructor(private readonly webhookService: WebhookService) {}
packages/twenty-server/src/engine/core-modules/workspace/services/workspace.service.ts
+64 -65
View File
@@ -54,6 +54,26 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
private readonly featureLookUpKey = BillingEntitlementKey.CUSTOM_DOMAIN;
protected readonly logger = new Logger(WorkspaceService.name);
private readonly WORKSPACE_FIELD_PERMISSIONS: Record<
string,
PermissionFlagType
> = {
subdomain: PermissionFlagType.WORKSPACE,
customDomain: PermissionFlagType.WORKSPACE,
displayName: PermissionFlagType.WORKSPACE,
logo: PermissionFlagType.WORKSPACE,
trashRetentionDays: PermissionFlagType.WORKSPACE,
inviteHash: PermissionFlagType.WORKSPACE_MEMBERS,
isPublicInviteLinkEnabled: PermissionFlagType.SECURITY,
allowImpersonation: PermissionFlagType.SECURITY,
isGoogleAuthEnabled: PermissionFlagType.SECURITY,
isMicrosoftAuthEnabled: PermissionFlagType.SECURITY,
isPasswordAuthEnabled: PermissionFlagType.SECURITY,
isTwoFactorAuthenticationEnforced: PermissionFlagType.SECURITY,
defaultRoleId: PermissionFlagType.ROLES,
routerModel: PermissionFlagType.WORKSPACE,
};
constructor(
@InjectRepository(WorkspaceEntity)
private readonly workspaceRepository: Repository<WorkspaceEntity>,
@@ -95,14 +115,7 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
assertIsDefinedOrThrow(workspace, WorkspaceNotFoundDefaultError);
await this.validateSecurityPermissions({
payload,
userWorkspaceId,
workspaceId: workspace.id,
apiKey,
});
await this.validateWorkspacePermissions({
await this.validateWorkspaceUpdatePermissions({
payload,
userWorkspaceId,
workspaceId: workspace.id,
@@ -366,48 +379,7 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
}
}
private async validateSecurityPermissions({
payload,
userWorkspaceId,
workspaceId,
apiKey,
}: {
payload: Partial<WorkspaceEntity>;
userWorkspaceId?: string;
workspaceId: string;
apiKey?: string;
}) {
if (
'isGoogleAuthEnabled' in payload ||
'isMicrosoftAuthEnabled' in payload ||
'isPasswordAuthEnabled' in payload ||
'isPublicInviteLinkEnabled' in payload
) {
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
}
const userHasPermission =
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
setting: PermissionFlagType.SECURITY,
workspaceId: workspaceId,
apiKeyId: apiKey,
});
if (!userHasPermission) {
throw new PermissionsException(
PermissionsExceptionMessage.PERMISSION_DENIED,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`You do not have permission to manage security settings. Please contact your workspace administrator.`,
},
);
}
}
}
private async validateWorkspacePermissions({
private async validateWorkspaceUpdatePermissions({
payload,
userWorkspaceId,
workspaceId,
@@ -421,36 +393,63 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
workspaceActivationStatus: WorkspaceActivationStatus;
}) {
if (
'displayName' in payload ||
'subdomain' in payload ||
'customDomain' in payload ||
'logo' in payload ||
'trashRetentionDays' in payload
workspaceActivationStatus === WorkspaceActivationStatus.PENDING_CREATION
) {
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
return;
}
const systemFields = new Set(['id', 'createdAt', 'updatedAt', 'deletedAt']);
const fieldsBeingUpdated = Object.keys(payload).filter(
(field) => !systemFields.has(field),
);
if (fieldsBeingUpdated.length === 0) {
return;
}
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
}
const fieldsByPermission = new Map<PermissionFlagType, string[]>();
for (const field of fieldsBeingUpdated) {
const requiredPermission = this.WORKSPACE_FIELD_PERMISSIONS[field];
if (!requiredPermission) {
throw new PermissionsException(
`Field "${field}" is not allowed to be updated`,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`The field "${field}" cannot be updated. Please contact your workspace administrator.`,
},
);
}
if (
workspaceActivationStatus === WorkspaceActivationStatus.PENDING_CREATION
) {
return;
if (!fieldsByPermission.has(requiredPermission)) {
fieldsByPermission.set(requiredPermission, []);
}
fieldsByPermission.get(requiredPermission)!.push(field);
}
const userHasPermission =
for (const [permission, fields] of fieldsByPermission.entries()) {
const hasPermission =
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
workspaceId,
setting: PermissionFlagType.WORKSPACE,
setting: permission,
apiKeyId: apiKey,
});
if (!userHasPermission) {
if (!hasPermission) {
const fieldsList = fields.join(', ');
throw new PermissionsException(
PermissionsExceptionMessage.PERMISSION_DENIED,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`You do not have permission to manage workspace settings. Please contact your workspace administrator.`,
userFriendlyMessage: msg`You do not have permission to update these fields: ${fieldsList}. Please contact your workspace administrator.`,
},
);
}
packages/twenty-server/src/engine/core-modules/workspace/workspace.resolver.ts
+13 -5
View File
@@ -59,6 +59,8 @@ import { AuthApiKey } from 'src/engine/decorators/auth/auth-api-key.decorator';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -112,7 +114,7 @@ export class WorkspaceResolver {
}
@Mutation(() => WorkspaceEntity)
@UseGuards(UserAuthGuard, WorkspaceAuthGuard)
@UseGuards(UserAuthGuard, WorkspaceAuthGuard, NoPermissionGuard)
async activateWorkspace(
@Args('data') data: ActivateWorkspaceInput,
@AuthUser() user: UserEntity,
@@ -122,7 +124,7 @@ export class WorkspaceResolver {
}
@Mutation(() => WorkspaceEntity)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, CustomPermissionGuard)
async updateWorkspace(
@Args('data') data: UpdateWorkspaceInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -307,8 +309,11 @@ export class WorkspaceResolver {
}
@ResolveField(() => [ViewDTO])
async views(@Parent() workspace: WorkspaceEntity): Promise<ViewDTO[]> {
return this.viewService.findByWorkspaceId(workspace.id);
async views(
@Parent() workspace: WorkspaceEntity,
@AuthUserWorkspaceId() userWorkspaceId: string | undefined,
): Promise<ViewDTO[]> {
return this.viewService.findByWorkspaceId(workspace.id, userWorkspaceId);
}
@Query(() => PublicWorkspaceDataOutput)
@@ -379,7 +384,10 @@ export class WorkspaceResolver {
}
@Mutation(() => DomainValidRecords, { nullable: true })
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
)
async checkCustomDomainValidRecords(
@AuthWorkspace() workspace: WorkspaceEntity,
): Promise<DomainValidRecords | undefined> {
packages/twenty-server/src/engine/guards/__tests__/custom-permission.guard.spec.ts
+32
View File
@@ -0,0 +1,32 @@
import { type ExecutionContext } from '@nestjs/common';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
describe('CustomPermissionGuard', () => {
let guard: CustomPermissionGuard;
let mockExecutionContext: ExecutionContext;
beforeEach(() => {
guard = new CustomPermissionGuard();
mockExecutionContext = {} as ExecutionContext;
});
describe('canActivate', () => {
it('should always return true', () => {
const result = guard.canActivate(mockExecutionContext);
expect(result).toBe(true);
});
it('should return true even with different contexts', () => {
const differentContext = {
switchToHttp: jest.fn(),
getHandler: jest.fn(),
} as unknown as ExecutionContext;
const result = guard.canActivate(differentContext);
expect(result).toBe(true);
});
});
});
packages/twenty-server/src/engine/guards/__tests__/no-permission.guard.spec.ts
+32
View File
@@ -0,0 +1,32 @@
import { type ExecutionContext } from '@nestjs/common';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
describe('NoPermissionGuard', () => {
let guard: NoPermissionGuard;
let mockExecutionContext: ExecutionContext;
beforeEach(() => {
guard = new NoPermissionGuard();
mockExecutionContext = {} as ExecutionContext;
});
describe('canActivate', () => {
it('should always return true', () => {
const result = guard.canActivate(mockExecutionContext);
expect(result).toBe(true);
});
it('should return true even with different contexts', () => {
const differentContext = {
switchToHttp: jest.fn(),
getHandler: jest.fn(),
} as unknown as ExecutionContext;
const result = guard.canActivate(differentContext);
expect(result).toBe(true);
});
});
});
packages/twenty-server/src/engine/guards/__tests__/settings-permissions.guard.spec.ts
+89
View File
@@ -0,0 +1,89 @@
import { type ExecutionContext } from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { WorkspaceActivationStatus } from 'twenty-shared/workspace';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { PermissionsException } from 'src/engine/metadata-modules/permissions/permissions.exception';
import { type PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
describe('SettingsPermissionsGuard', () => {
let guard: any;
let mockPermissionsService: jest.Mocked<PermissionsService>;
let mockExecutionContext: ExecutionContext;
let mockGqlContext: any;
beforeEach(() => {
mockPermissionsService = {
userHasWorkspaceSettingPermission: jest.fn(),
} as any;
mockGqlContext = {
req: {
workspace: {
id: 'workspace-id',
activationStatus: WorkspaceActivationStatus.ACTIVE,
},
userWorkspaceId: 'user-workspace-id',
apiKey: null,
},
};
mockExecutionContext = {} as ExecutionContext;
jest
.spyOn(GqlExecutionContext, 'create')
.mockReturnValue({ getContext: () => mockGqlContext } as any);
const GuardClass = SettingsPermissionsGuard(PermissionFlagType.WORKSPACE);
guard = new GuardClass(mockPermissionsService);
});
afterEach(() => {
jest.restoreAllMocks();
});
describe('canActivate', () => {
it('should bypass permission check when workspace is being created', async () => {
mockGqlContext.req.workspace.activationStatus =
WorkspaceActivationStatus.PENDING_CREATION;
const result = await guard.canActivate(mockExecutionContext);
expect(result).toBe(true);
expect(
mockPermissionsService.userHasWorkspaceSettingPermission,
).not.toHaveBeenCalled();
});
it('should return true when user has required permission', async () => {
mockPermissionsService.userHasWorkspaceSettingPermission.mockResolvedValue(
true,
);
const result = await guard.canActivate(mockExecutionContext);
expect(result).toBe(true);
expect(
mockPermissionsService.userHasWorkspaceSettingPermission,
).toHaveBeenCalledWith({
userWorkspaceId: 'user-workspace-id',
setting: PermissionFlagType.WORKSPACE,
workspaceId: 'workspace-id',
apiKeyId: undefined,
});
});
it('should throw PermissionsException when user lacks permission', async () => {
mockPermissionsService.userHasWorkspaceSettingPermission.mockResolvedValue(
false,
);
await expect(guard.canActivate(mockExecutionContext)).rejects.toThrow(
PermissionsException,
);
});
});
});
packages/twenty-server/src/engine/guards/custom-permission.guard.ts
+23
View File
@@ -0,0 +1,23 @@
import {
type CanActivate,
type ExecutionContext,
Injectable,
} from '@nestjs/common';
// Guard that explicitly marks an endpoint as having custom permission logic
// This guard always returns true and serves as documentation that the endpoint
// has custom permission checks implemented within the resolver method itself
//
// Use this when you need custom permission validation that cannot be expressed
// with standard SettingsPermissionsGuard
//
// Examples of when to use CustomPermissionGuard:
// - Self-only operations (users can only modify their own data)
// - Complex permission logic (multiple conditions)
// - Dynamic permission requirements (depends on object type, record ownership, etc.)
@Injectable()
export class CustomPermissionGuard implements CanActivate {
canActivate(_context: ExecutionContext): boolean {
return true;
}
}
packages/twenty-server/src/engine/guards/no-permission.guard.ts
+25
View File
@@ -0,0 +1,25 @@
import {
type CanActivate,
type ExecutionContext,
Injectable,
} from '@nestjs/common';
// Guard that explicitly marks an endpoint as NOT requiring permission checks
// This guard always returns true and serves as explicit documentation that
// the endpoint intentionally bypasses standard permission validation
//
// Use this ONLY for special cases where permission checks don't apply:
// - Workspace initialization/onboarding flows
// - Public or semi-public endpoints
// - Self-service operations that don't require elevated permissions
//
// Examples: activateWorkspace (onboarding), user profile updates
//
// WARNING: Use sparingly! Most mutations should use SettingsPermissionsGuard
// If you're unsure, use CustomPermissionGuard and implement checks in the method
@Injectable()
export class NoPermissionGuard implements CanActivate {
canActivate(_context: ExecutionContext): boolean {
return true;
}
}
packages/twenty-server/src/engine/metadata-modules/agent/agent-chat.resolver.ts
+7 -1
View File
@@ -8,13 +8,19 @@ import {
FeatureFlagGuard,
RequireFeatureFlag,
} from 'src/engine/guards/feature-flag.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { AgentChatService } from 'src/engine/metadata-modules/agent/agent-chat.service';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { AgentChatMessageDTO } from './dtos/agent-chat-message.dto';
import { AgentChatThreadDTO } from './dtos/agent-chat-thread.dto';
@UseGuards(WorkspaceAuthGuard, FeatureFlagGuard)
@UseGuards(
WorkspaceAuthGuard,
FeatureFlagGuard,
SettingsPermissionsGuard(PermissionFlagType.AI),
)
@Resolver()
export class AgentChatResolver {
constructor(private readonly agentChatService: AgentChatService) {}
packages/twenty-server/src/engine/metadata-modules/agent/agent.resolver.ts
+7
View File
@@ -8,9 +8,11 @@ import {
FeatureFlagGuard,
RequireFeatureFlag,
} from 'src/engine/guards/feature-flag.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { CreateAgentHandoffInput } from 'src/engine/metadata-modules/agent/dtos/create-agent-handoff.input';
import { RemoveAgentHandoffInput } from 'src/engine/metadata-modules/agent/dtos/remove-agent-handoff.input';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { AgentHandoffService } from './agent-handoff.service';
import { AgentService } from './agent.service';
@@ -70,6 +72,7 @@ export class AgentResolver {
@Mutation(() => AgentDTO)
@RequireFeatureFlag(FeatureFlagKey.IS_AI_ENABLED)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.AI_SETTINGS))
async createOneAgent(
@Args('input') input: CreateAgentInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -82,6 +85,7 @@ export class AgentResolver {
@Mutation(() => AgentDTO)
@RequireFeatureFlag(FeatureFlagKey.IS_AI_ENABLED)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.AI_SETTINGS))
async updateOneAgent(
@Args('input') input: UpdateAgentInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -91,6 +95,7 @@ export class AgentResolver {
@Mutation(() => AgentDTO)
@RequireFeatureFlag(FeatureFlagKey.IS_AI_ENABLED)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.AI_SETTINGS))
async deleteOneAgent(
@Args('input') { id }: AgentIdInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -100,6 +105,7 @@ export class AgentResolver {
@Mutation(() => Boolean)
@RequireFeatureFlag(FeatureFlagKey.IS_AI_ENABLED)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.AI_SETTINGS))
async createAgentHandoff(
@Args('input') input: CreateAgentHandoffInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -116,6 +122,7 @@ export class AgentResolver {
@Mutation(() => Boolean)
@RequireFeatureFlag(FeatureFlagKey.IS_AI_ENABLED)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.AI_SETTINGS))
async removeAgentHandoff(
@Args('input') input: RemoveAgentHandoffInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/cron-trigger/cron-trigger.module.ts
+2
View File
@@ -9,12 +9,14 @@ import { CronTriggerResolver } from 'src/engine/metadata-modules/cron-trigger/re
import { CronTriggerV2Service } from 'src/engine/metadata-modules/cron-trigger/services/cron-trigger-v2.service';
import { WorkspaceFlatCronTriggerMapCacheService } from 'src/engine/metadata-modules/cron-trigger/services/workspace-flat-cron-trigger-map-cache.service';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@Module({
imports: [
TypeOrmModule.forFeature([WorkspaceEntity, CronTriggerEntity]),
WorkspaceManyOrAllFlatEntityMapsCacheModule,
PermissionsModule,
WorkspaceMigrationV2Module,
],
providers: [
packages/twenty-server/src/engine/metadata-modules/cron-trigger/resolvers/cron-trigger.resolver.ts
+6 -1
View File
@@ -8,6 +8,7 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { CreateCronTriggerInput } from 'src/engine/metadata-modules/cron-trigger/dtos/create-cron-trigger.input';
import { CronTriggerIdInput } from 'src/engine/metadata-modules/cron-trigger/dtos/cron-trigger-id.input';
@@ -16,8 +17,12 @@ import { UpdateCronTriggerInput } from 'src/engine/metadata-modules/cron-trigger
import { CronTriggerEntity } from 'src/engine/metadata-modules/cron-trigger/entities/cron-trigger.entity';
import { CronTriggerV2Service } from 'src/engine/metadata-modules/cron-trigger/services/cron-trigger-v2.service';
import { cronTriggerGraphQLApiExceptionHandler } from 'src/engine/metadata-modules/cron-trigger/utils/cron-trigger-graphql-api-exception-handler.util';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS),
)
@Resolver()
@UsePipes(ResolverValidationPipe)
@UseFilters(PreventNestToAutoLogGraphqlErrorsFilter)
packages/twenty-server/src/engine/metadata-modules/database-event-trigger/database-event-trigger.module.ts
+2
View File
@@ -8,12 +8,14 @@ import { DatabaseEventTriggerResolver } from 'src/engine/metadata-modules/databa
import { DatabaseEventTriggerV2Service } from 'src/engine/metadata-modules/database-event-trigger/services/database-event-trigger-v2.service';
import { WorkspaceFlatDatabaseEventTriggerMapCacheService } from 'src/engine/metadata-modules/database-event-trigger/services/workspace-flat-database-event-trigger-map-cache.service';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@Module({
imports: [
TypeOrmModule.forFeature([WorkspaceEntity, DatabaseEventTriggerEntity]),
WorkspaceManyOrAllFlatEntityMapsCacheModule,
PermissionsModule,
WorkspaceMigrationV2Module,
],
providers: [
packages/twenty-server/src/engine/metadata-modules/database-event-trigger/resolvers/database-event-trigger.resolver.ts
+6 -1
View File
@@ -8,6 +8,7 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { CreateDatabaseEventTriggerInput } from 'src/engine/metadata-modules/database-event-trigger/dtos/create-database-event-trigger.input';
import { DatabaseEventTriggerIdInput } from 'src/engine/metadata-modules/database-event-trigger/dtos/database-event-trigger-id.input';
@@ -16,8 +17,12 @@ import { UpdateDatabaseEventTriggerInput } from 'src/engine/metadata-modules/dat
import { DatabaseEventTriggerEntity } from 'src/engine/metadata-modules/database-event-trigger/entities/database-event-trigger.entity';
import { DatabaseEventTriggerV2Service } from 'src/engine/metadata-modules/database-event-trigger/services/database-event-trigger-v2.service';
import { databaseEventTriggerGraphQLApiExceptionHandler } from 'src/engine/metadata-modules/database-event-trigger/utils/database-event-trigger-graphql-api-exception-handler.utils';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS),
)
@Resolver()
@UsePipes(ResolverValidationPipe)
@UseFilters(PreventNestToAutoLogGraphqlErrorsFilter)
packages/twenty-server/src/engine/metadata-modules/flat-view/constants/flat-view-editable-properties.constant.ts
+1
View File
@@ -12,4 +12,5 @@ export const FLAT_VIEW_EDITABLE_PROPERTIES = [
'anyFieldFilterValue',
'calendarLayout',
'calendarFieldMetadataId',
'visibility',
] as const satisfies (keyof FlatView)[];
packages/twenty-server/src/engine/metadata-modules/flat-view/constants/view-entity-relation-properties.constant.ts
+2
View File
@@ -8,4 +8,6 @@ export const VIEW_ENTITY_RELATION_PROPERTIES = [
'viewGroups',
'viewSorts',
'workspace',
'createdBy',
'application',
] as const satisfies ViewEntityRelationProperties[];
packages/twenty-server/src/engine/metadata-modules/flat-view/types/flat-view.type.ts
+4
View File
@@ -1,3 +1,5 @@
import { type ApplicationEntity } from 'src/engine/core-modules/application/application.entity';
import { type UserWorkspaceEntity } from 'src/engine/core-modules/user-workspace/user-workspace.entity';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { type FieldMetadataEntity } from 'src/engine/metadata-modules/field-metadata/field-metadata.entity';
import { type FlatEntityFrom } from 'src/engine/metadata-modules/flat-entity/types/flat-entity.type';
@@ -21,6 +23,8 @@ export type ViewEntityRelationProperties =
| ViewFilterGroupEntity
| WorkspaceEntity
| FieldMetadataEntity
| UserWorkspaceEntity
| ApplicationEntity
>;
export type FlatView = FlatEntityFrom<
packages/twenty-server/src/engine/metadata-modules/flat-view/utils/from-create-view-input-to-flat-view-to-create.util.ts
+5
View File
@@ -5,13 +5,16 @@ import { type FlatView } from 'src/engine/metadata-modules/flat-view/types/flat-
import { type CreateViewInput } from 'src/engine/metadata-modules/view/dtos/inputs/create-view.input';
import { ViewOpenRecordIn } from 'src/engine/metadata-modules/view/enums/view-open-record-in';
import { ViewType } from 'src/engine/metadata-modules/view/enums/view-type.enum';
import { ViewVisibility } from 'src/engine/metadata-modules/view/enums/view-visibility.enum';
export const fromCreateViewInputToFlatViewToCreate = ({
createViewInput: rawCreateViewInput,
workspaceId,
createdByUserWorkspaceId,
}: {
createViewInput: CreateViewInput;
workspaceId: string;
createdByUserWorkspaceId?: string;
}): FlatView => {
const { objectMetadataId, ...createViewInput } =
trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties(
@@ -44,6 +47,8 @@ export const fromCreateViewInputToFlatViewToCreate = ({
position: createViewInput.position ?? 0,
type: createViewInput.type ?? ViewType.TABLE,
universalIdentifier: createViewInput.universalIdentifier ?? viewId,
visibility: createViewInput.visibility ?? ViewVisibility.WORKSPACE,
createdByUserWorkspaceId: createdByUserWorkspaceId ?? null,
viewFieldIds: [],
viewFilterIds: [],
viewGroupIds: [],
packages/twenty-server/src/engine/metadata-modules/permissions/constants/permission-flag-type.constants.ts
+9 -1
View File
@@ -5,14 +5,22 @@ export enum PermissionFlagType {
WORKSPACE_MEMBERS = 'WORKSPACE_MEMBERS',
ROLES = 'ROLES',
DATA_MODEL = 'DATA_MODEL',
ADMIN_PANEL = 'ADMIN_PANEL',
SECURITY = 'SECURITY',
WORKFLOWS = 'WORKFLOWS',
IMPERSONATE = 'IMPERSONATE',
SSO_BYPASS = 'SSO_BYPASS',
APPLICATIONS = 'APPLICATIONS',
LAYOUTS = 'LAYOUTS',
BILLING = 'BILLING',
AI_SETTINGS = 'AI_SETTINGS',
// Tool permissions
AI = 'AI',
VIEWS = 'VIEWS',
UPLOAD_FILE = 'UPLOAD_FILE',
DOWNLOAD_FILE = 'DOWNLOAD_FILE',
SEND_EMAIL_TOOL = 'SEND_EMAIL_TOOL',
IMPORT_CSV = 'IMPORT_CSV',
EXPORT_CSV = 'EXPORT_CSV',
CONNECTED_ACCOUNTS = 'CONNECTED_ACCOUNTS',
}
packages/twenty-server/src/engine/metadata-modules/permissions/constants/tool-permission-flags.ts
+5
View File
@@ -1,5 +1,10 @@
export const TOOL_PERMISSION_FLAGS = [
'AI',
'VIEWS',
'UPLOAD_FILE',
'DOWNLOAD_FILE',
'SEND_EMAIL_TOOL',
'IMPORT_CSV',
'EXPORT_CSV',
'CONNECTED_ACCOUNTS',
];
packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
+9 -1
View File
@@ -98,12 +98,20 @@ export class PermissionsService {
[PermissionFlagType.WORKSPACE_MEMBERS]: false,
[PermissionFlagType.ROLES]: false,
[PermissionFlagType.DATA_MODEL]: false,
[PermissionFlagType.ADMIN_PANEL]: false,
[PermissionFlagType.SECURITY]: false,
[PermissionFlagType.WORKFLOWS]: false,
[PermissionFlagType.APPLICATIONS]: false,
[PermissionFlagType.LAYOUTS]: false,
[PermissionFlagType.VIEWS]: false,
[PermissionFlagType.BILLING]: false,
[PermissionFlagType.AI_SETTINGS]: false,
[PermissionFlagType.AI]: false,
[PermissionFlagType.UPLOAD_FILE]: false,
[PermissionFlagType.DOWNLOAD_FILE]: false,
[PermissionFlagType.SEND_EMAIL_TOOL]: false,
[PermissionFlagType.IMPORT_CSV]: false,
[PermissionFlagType.EXPORT_CSV]: false,
[PermissionFlagType.CONNECTED_ACCOUNTS]: false,
[PermissionFlagType.IMPERSONATE]: false,
[PermissionFlagType.SSO_BYPASS]: false,
},
packages/twenty-server/src/engine/metadata-modules/permissions/utils/__tests__/permission-graphql-api-exception-handler.util.spec.ts
+101
View File
@@ -0,0 +1,101 @@
import {
ForbiddenError,
NotFoundError,
UserInputError,
} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
import {
PermissionsException,
PermissionsExceptionCode,
PermissionsExceptionMessage,
} from 'src/engine/metadata-modules/permissions/permissions.exception';
import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
describe('permissionGraphqlApiExceptionHandler', () => {
it('should throw ForbiddenError for PERMISSION_DENIED', () => {
const exception = new PermissionsException(
PermissionsExceptionMessage.PERMISSION_DENIED,
PermissionsExceptionCode.PERMISSION_DENIED,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
ForbiddenError,
);
});
it('should throw ForbiddenError for role-related forbidden cases', () => {
const exception = new PermissionsException(
'Cannot update self',
PermissionsExceptionCode.CANNOT_UPDATE_SELF_ROLE,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
ForbiddenError,
);
});
it('should throw UserInputError for INVALID_ARG', () => {
const exception = new PermissionsException(
'Invalid argument',
PermissionsExceptionCode.INVALID_ARG,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
UserInputError,
);
});
it('should throw UserInputError for permission validation errors', () => {
const exception = new PermissionsException(
'Empty field permission',
PermissionsExceptionCode.EMPTY_FIELD_PERMISSION_NOT_ALLOWED,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
UserInputError,
);
});
it('should throw NotFoundError for ROLE_NOT_FOUND', () => {
const exception = new PermissionsException(
'Role not found',
PermissionsExceptionCode.ROLE_NOT_FOUND,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
NotFoundError,
);
});
it('should throw NotFoundError for metadata not found cases', () => {
const exception = new PermissionsException(
'Object metadata not found',
PermissionsExceptionCode.OBJECT_METADATA_NOT_FOUND,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
NotFoundError,
);
});
it('should rethrow exception for METHOD_NOT_ALLOWED', () => {
const exception = new PermissionsException(
'Method not allowed',
PermissionsExceptionCode.METHOD_NOT_ALLOWED,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
exception,
);
});
it('should rethrow exception for internal error codes', () => {
const exception = new PermissionsException(
'Default role not found',
PermissionsExceptionCode.DEFAULT_ROLE_NOT_FOUND,
);
expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
exception,
);
});
});
packages/twenty-server/src/engine/metadata-modules/remote-server/remote-server.module.ts
+2
View File
@@ -4,6 +4,7 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { ForeignDataWrapperServerQueryFactory } from 'src/engine/api/graphql/workspace-query-builder/factories/foreign-data-wrapper-server-query.factory';
import { FeatureFlagEntity } from 'src/engine/core-modules/feature-flag/feature-flag.entity';
import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RemoteServerEntity } from 'src/engine/metadata-modules/remote-server/remote-server.entity';
import { RemoteServerResolver } from 'src/engine/metadata-modules/remote-server/remote-server.resolver';
import { RemoteServerService } from 'src/engine/metadata-modules/remote-server/remote-server.service';
@@ -13,6 +14,7 @@ import { WorkspaceDataSourceModule } from 'src/engine/workspace-datasource/works
@Module({
imports: [
JwtModule,
PermissionsModule,
TypeOrmModule.forFeature([RemoteServerEntity]),
RemoteTableModule,
WorkspaceDataSourceModule,
packages/twenty-server/src/engine/metadata-modules/remote-server/remote-server.resolver.ts
+5
View File
@@ -5,7 +5,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { CreateRemoteServerInput } from 'src/engine/metadata-modules/remote-server/dtos/create-remote-server.input';
import { RemoteServerIdInput } from 'src/engine/metadata-modules/remote-server/dtos/remote-server-id.input';
import { RemoteServerTypeInput } from 'src/engine/metadata-modules/remote-server/dtos/remote-server-type.input';
@@ -25,6 +27,7 @@ export class RemoteServerResolver {
) {}
@Mutation(() => RemoteServerDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async createOneRemoteServer(
@Args('input') input: CreateRemoteServerInput<RemoteServerType>,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -40,6 +43,7 @@ export class RemoteServerResolver {
}
@Mutation(() => RemoteServerDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async updateOneRemoteServer(
@Args('input') input: UpdateRemoteServerInput<RemoteServerType>,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -55,6 +59,7 @@ export class RemoteServerResolver {
}
@Mutation(() => RemoteServerDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async deleteOneRemoteServer(
@Args('input') { id }: RemoteServerIdInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/remote-table.module.ts
+2
View File
@@ -4,6 +4,7 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { DataSourceModule } from 'src/engine/metadata-modules/data-source/data-source.module';
import { FieldMetadataModule } from 'src/engine/metadata-modules/field-metadata/field-metadata.module';
import { ObjectMetadataModule } from 'src/engine/metadata-modules/object-metadata/object-metadata.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RemoteServerEntity } from 'src/engine/metadata-modules/remote-server/remote-server.entity';
import { DistantTableModule } from 'src/engine/metadata-modules/remote-server/remote-table/distant-table/distant-table.module';
import { ForeignTableModule } from 'src/engine/metadata-modules/remote-server/remote-table/foreign-table/foreign-table.module';
@@ -21,6 +22,7 @@ import { WorkspaceDataSourceModule } from 'src/engine/workspace-datasource/works
DataSourceModule,
ObjectMetadataModule,
FieldMetadataModule,
PermissionsModule,
WorkspaceMetadataVersionModule,
WorkspaceDataSourceModule,
ForeignTableModule,
packages/twenty-server/src/engine/metadata-modules/remote-server/remote-table/remote-table.resolver.ts
+5
View File
@@ -5,7 +5,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { FindManyRemoteTablesInput } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/find-many-remote-tables-input';
import { RemoteTableInput } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/remote-table-input';
import { RemoteTableDTO } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/remote-table.dto';
@@ -36,6 +38,7 @@ export class RemoteTableResolver {
}
@Mutation(() => RemoteTableDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async syncRemoteTable(
@Args('input') input: RemoteTableInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -48,6 +51,7 @@ export class RemoteTableResolver {
}
@Mutation(() => RemoteTableDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async unsyncRemoteTable(
@Args('input') input: RemoteTableInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -63,6 +67,7 @@ export class RemoteTableResolver {
}
@Mutation(() => RemoteTableDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL))
async syncRemoteTableSchemaChanges(
@Args('input') input: RemoteTableInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/route-trigger/resolvers/route-trigger.resolver.ts
+11 -2
View File
@@ -8,7 +8,10 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
import { CreateRouteTriggerInput } from 'src/engine/metadata-modules/route-trigger/dtos/create-route-trigger.input';
import { RouteTriggerIdInput } from 'src/engine/metadata-modules/route-trigger/dtos/route-trigger-id.input';
import { RouteTriggerDTO } from 'src/engine/metadata-modules/route-trigger/dtos/route-trigger.dto';
@@ -17,10 +20,16 @@ import { RouteTriggerEntity } from 'src/engine/metadata-modules/route-trigger/ro
import { RouteTriggerV2Service } from 'src/engine/metadata-modules/route-trigger/services/route-trigger-v2.service';
import { routeTriggerGraphQLApiExceptionHandler } from 'src/engine/metadata-modules/route-trigger/utils/route-trigger-graphql-api-exception-handler.utils';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS),
)
@Resolver()
@UsePipes(ResolverValidationPipe)
@UseFilters(PreventNestToAutoLogGraphqlErrorsFilter)
@UseFilters(
PreventNestToAutoLogGraphqlErrorsFilter,
PermissionsGraphqlApiExceptionFilter,
)
export class RouteTriggerResolver {
constructor(
private readonly routeV2Service: RouteTriggerV2Service,
packages/twenty-server/src/engine/metadata-modules/route-trigger/route-trigger.module.ts
+2
View File
@@ -4,6 +4,7 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { AuthModule } from 'src/engine/core-modules/auth/auth.module';
import { WorkspaceDomainsModule } from 'src/engine/core-modules/domain/workspace-domains/workspace-domains.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RouteTriggerResolver } from 'src/engine/metadata-modules/route-trigger/resolvers/route-trigger.resolver';
import { RouteTriggerController } from 'src/engine/metadata-modules/route-trigger/route-trigger.controller';
import { RouteTriggerEntity } from 'src/engine/metadata-modules/route-trigger/route-trigger.entity';
@@ -20,6 +21,7 @@ import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspa
WorkspaceDomainsModule,
ServerlessFunctionModule,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
PermissionsModule,
WorkspaceMigrationV2Module,
],
controllers: [RouteTriggerController],
packages/twenty-server/src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.module.ts
+6 -2
View File
@@ -1,12 +1,16 @@
import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ServerlessFunctionLayerEntity } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.entity';
import { ServerlessFunctionLayerService } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.service';
import { ServerlessFunctionLayerResolver } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.resolver';
import { ServerlessFunctionLayerService } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.service';
@Module({
imports: [TypeOrmModule.forFeature([ServerlessFunctionLayerEntity])],
imports: [
PermissionsModule,
TypeOrmModule.forFeature([ServerlessFunctionLayerEntity]),
],
providers: [ServerlessFunctionLayerService, ServerlessFunctionLayerResolver],
exports: [ServerlessFunctionLayerService],
})
packages/twenty-server/src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.resolver.ts
+6 -3
View File
@@ -1,12 +1,14 @@
import { UseGuards } from '@nestjs/common';
import { Args, Mutation, Resolver } from '@nestjs/graphql';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ServerlessFunctionLayerService } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.service';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { CreateServerlessFunctionLayerInput } from 'src/engine/metadata-modules/serverless-function-layer/dtos/create-serverless-function-layer.input';
import { ServerlessFunctionLayerDTO } from 'src/engine/metadata-modules/serverless-function-layer/dtos/serverless-function-layer.dto';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { ServerlessFunctionLayerService } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.service';
@UseGuards(WorkspaceAuthGuard)
@Resolver()
@@ -16,6 +18,7 @@ export class ServerlessFunctionLayerResolver {
) {}
@Mutation(() => ServerlessFunctionLayerDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async createOneServerlessFunctionLayer(
@Args()
createServerlessFunctionLayerInput: CreateServerlessFunctionLayerInput,
packages/twenty-server/src/engine/metadata-modules/serverless-function/serverless-function.module.ts
+2
View File
@@ -12,6 +12,7 @@ import { ThrottlerModule } from 'src/engine/core-modules/throttler/throttler.mod
import { CronTriggerEntity } from 'src/engine/metadata-modules/cron-trigger/entities/cron-trigger.entity';
import { DatabaseEventTriggerEntity } from 'src/engine/metadata-modules/database-event-trigger/entities/database-event-trigger.entity';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RouteTriggerEntity } from 'src/engine/metadata-modules/route-trigger/route-trigger.entity';
import { ServerlessFunctionLayerModule } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.module';
import { ServerlessFunctionTriggerJob } from 'src/engine/metadata-modules/serverless-function/jobs/serverless-function-trigger.job';
@@ -36,6 +37,7 @@ import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspa
ThrottlerModule,
AuditModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
WorkspaceMigrationV2Module,
ServerlessFunctionLayerModule,
packages/twenty-server/src/engine/metadata-modules/serverless-function/serverless-function.resolver.ts
+8 -1
View File
@@ -10,7 +10,10 @@ import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/re
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { FeatureFlagGuard } from 'src/engine/guards/feature-flag.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { CreateServerlessFunctionInput } from 'src/engine/metadata-modules/serverless-function/dtos/create-serverless-function.input';
import { ExecuteServerlessFunctionInput } from 'src/engine/metadata-modules/serverless-function/dtos/execute-serverless-function.input';
import { GetServerlessFunctionSourceCodeInput } from 'src/engine/metadata-modules/serverless-function/dtos/get-serverless-function-source-code.input';
import { PublishServerlessFunctionInput } from 'src/engine/metadata-modules/serverless-function/dtos/publish-serverless-function.input';
@@ -21,7 +24,6 @@ import { UpdateServerlessFunctionInput } from 'src/engine/metadata-modules/serve
import { ServerlessFunctionEntity } from 'src/engine/metadata-modules/serverless-function/serverless-function.entity';
import { ServerlessFunctionService } from 'src/engine/metadata-modules/serverless-function/serverless-function.service';
import { serverlessFunctionGraphQLApiExceptionHandler } from 'src/engine/metadata-modules/serverless-function/utils/serverless-function-graphql-api-exception-handler.utils';
import { CreateServerlessFunctionInput } from 'src/engine/metadata-modules/serverless-function/dtos/create-serverless-function.input';
@UseGuards(WorkspaceAuthGuard, FeatureFlagGuard)
@Resolver()
@@ -92,6 +94,7 @@ export class ServerlessFunctionResolver {
}
@Mutation(() => ServerlessFunctionDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async deleteOneServerlessFunction(
@Args('input') input: ServerlessFunctionIdInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -107,6 +110,7 @@ export class ServerlessFunctionResolver {
}
@Mutation(() => ServerlessFunctionDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async updateOneServerlessFunction(
@Args('input')
input: UpdateServerlessFunctionInput,
@@ -123,6 +127,7 @@ export class ServerlessFunctionResolver {
}
@Mutation(() => ServerlessFunctionDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async createOneServerlessFunction(
@Args('input')
input: CreateServerlessFunctionInput,
@@ -139,6 +144,7 @@ export class ServerlessFunctionResolver {
}
@Mutation(() => ServerlessFunctionExecutionResultDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async executeOneServerlessFunction(
@Args('input') input: ExecuteServerlessFunctionInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -158,6 +164,7 @@ export class ServerlessFunctionResolver {
}
@Mutation(() => ServerlessFunctionDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.WORKFLOWS))
async publishServerlessFunction(
@Args('input') input: PublishServerlessFunctionInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-field/controllers/view-field.controller.ts
+6
View File
@@ -32,6 +32,9 @@ import {
import { ViewFieldRestApiExceptionFilter } from 'src/engine/metadata-modules/view-field/filters/view-field-rest-api-exception.filter';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { CreateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard';
import { DeleteViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard';
import { UpdateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-field-permission.guard';
@Controller('rest/metadata/viewFields')
@UseGuards(WorkspaceAuthGuard)
@@ -81,6 +84,7 @@ export class ViewFieldController {
}
@Patch(':id')
@UseGuards(UpdateViewFieldPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewFieldInput['update'],
@@ -122,6 +126,7 @@ export class ViewFieldController {
}
@Post()
@UseGuards(CreateViewFieldPermissionGuard)
async create(
@Body() input: CreateViewFieldInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -161,6 +166,7 @@ export class ViewFieldController {
}
@Delete(':id')
@UseGuards(DeleteViewFieldPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-field/exceptions/view-field.exception.ts
+4
View File
@@ -17,6 +17,7 @@ export class ViewFieldException extends CustomException {
export enum ViewFieldExceptionCode {
VIEW_FIELD_NOT_FOUND = 'VIEW_FIELD_NOT_FOUND',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
INVALID_VIEW_FIELD_DATA = 'INVALID_VIEW_FIELD_DATA',
}
@@ -24,6 +25,7 @@ export enum ViewFieldExceptionMessageKey {
WORKSPACE_ID_REQUIRED = 'WORKSPACE_ID_REQUIRED',
VIEW_ID_REQUIRED = 'VIEW_ID_REQUIRED',
VIEW_FIELD_NOT_FOUND = 'VIEW_FIELD_NOT_FOUND',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
INVALID_VIEW_FIELD_DATA = 'INVALID_VIEW_FIELD_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_FIELD_ALREADY_EXISTS = 'VIEW_FIELD_ALREADY_EXISTS',
@@ -40,6 +42,8 @@ export const generateViewFieldExceptionMessage = (
return 'ViewId is required';
case ViewFieldExceptionMessageKey.VIEW_FIELD_NOT_FOUND:
return `View field${id ? ` (id: ${id})` : ''} not found`;
case ViewFieldExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
case ViewFieldExceptionMessageKey.INVALID_VIEW_FIELD_DATA:
return `Invalid view field data${id ? ` for view field id: ${id}` : ''}`;
case ViewFieldExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
packages/twenty-server/src/engine/metadata-modules/view-field/resolvers/view-field.resolver.ts
+11 -11
View File
@@ -18,6 +18,10 @@ import {
} from 'src/engine/metadata-modules/view-field/exceptions/view-field.exception';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { CreateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard';
import { DeleteViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard';
import { DestroyViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-field-permission.guard';
import { UpdateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-field-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewFieldDTO)
@@ -47,6 +51,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(UpdateViewFieldPermissionGuard)
async updateCoreViewField(
@Args('input') updateViewFieldInput: UpdateViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -72,6 +77,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(CreateViewFieldPermissionGuard)
async createCoreViewField(
@Args('input') createViewFieldInput: CreateViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -96,6 +102,7 @@ export class ViewFieldResolver {
}
@Mutation(() => [ViewFieldDTO])
@UseGuards(CreateViewFieldPermissionGuard)
async createManyCoreViewFields(
@Args('inputs', { type: () => [CreateViewFieldInput] })
createViewFieldInputs: CreateViewFieldInput[],
@@ -121,6 +128,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(DeleteViewFieldPermissionGuard)
async deleteCoreViewField(
@Args('input') deleteViewFieldInput: DeleteViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -137,15 +145,12 @@ export class ViewFieldResolver {
workspaceId,
});
}
const deletedViewField = await this.viewFieldService.delete(
deleteViewFieldInput.id,
workspaceId,
);
return deletedViewField;
return this.viewFieldService.delete(deleteViewFieldInput.id, workspaceId);
}
@Mutation(() => ViewFieldDTO)
@UseGuards(DestroyViewFieldPermissionGuard)
async destroyCoreViewField(
@Args('input') destroyViewFieldInput: DestroyViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -163,11 +168,6 @@ export class ViewFieldResolver {
});
}
const deletedViewField = await this.viewFieldService.destroy(
destroyViewFieldInput.id,
workspaceId,
);
return deletedViewField;
return this.viewFieldService.destroy(destroyViewFieldInput.id, workspaceId);
}
}
packages/twenty-server/src/engine/metadata-modules/view-field/services/tests/view-field.service.spec.ts
+8 -2
View File
@@ -513,12 +513,18 @@ describe('ViewFieldService', () => {
const id = 'view-field-id';
const workspaceId = 'workspace-id';
jest.spyOn(viewFieldService, 'findById').mockResolvedValue(mockViewField);
jest
.spyOn(viewFieldRepository, 'findOne')
.mockResolvedValue(mockViewField);
jest.spyOn(viewFieldRepository, 'delete').mockResolvedValue({} as any);
const result = await viewFieldService.destroy(id, workspaceId);
expect(viewFieldService.findById).toHaveBeenCalledWith(id, workspaceId);
expect(viewFieldRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: ['workspace', 'view'],
withDeleted: true,
});
expect(viewFieldRepository.delete).toHaveBeenCalledWith(id);
expect(result).toBeDefined();
});
packages/twenty-server/src/engine/metadata-modules/view-field/services/view-field.service.ts
+9 -1
View File
@@ -205,6 +205,7 @@ export class ViewFieldService {
ViewFieldExceptionCode.VIEW_FIELD_NOT_FOUND,
);
}
const viewId = existingViewField.viewId;
if (this.updatesPosition(updateData)) {
@@ -257,7 +258,14 @@ export class ViewFieldService {
}
async destroy(id: string, workspaceId: string): Promise<ViewFieldEntity> {
const viewField = await this.findById(id, workspaceId);
const viewField = await this.viewFieldRepository.findOne({
where: {
id,
workspaceId,
},
relations: ['workspace', 'view'],
withDeleted: true,
});
if (!isDefined(viewField)) {
throw new ViewFieldException(
packages/twenty-server/src/engine/metadata-modules/view-field/view-field.module.ts
+4
View File
@@ -3,11 +3,13 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewFieldController } from 'src/engine/metadata-modules/view-field/controllers/view-field.controller';
import { ViewFieldEntity } from 'src/engine/metadata-modules/view-field/entities/view-field.entity';
import { ViewFieldResolver } from 'src/engine/metadata-modules/view-field/resolvers/view-field.resolver';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@@ -17,8 +19,10 @@ import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspa
TypeOrmModule.forFeature([ViewFieldEntity, ViewEntity]),
WorkspaceCacheStorageModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceMigrationV2Module,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
ViewPermissionsModule,
],
controllers: [ViewFieldController],
providers: [ViewFieldService, ViewFieldResolver, ViewFieldV2Service],
packages/twenty-server/src/engine/metadata-modules/view-filter-group/controllers/view-filter-group.controller.ts
+6
View File
@@ -28,6 +28,9 @@ import {
} from 'src/engine/metadata-modules/view-filter-group/exceptions/view-filter-group.exception';
import { ViewFilterGroupRestApiExceptionFilter } from 'src/engine/metadata-modules/view-filter-group/filters/view-filter-group-rest-api-exception.filter';
import { ViewFilterGroupService } from 'src/engine/metadata-modules/view-filter-group/services/view-filter-group.service';
import { CreateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-group-permission.guard';
import { DeleteViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-group-permission.guard';
import { UpdateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-group-permission.guard';
@Controller('rest/metadata/viewFilterGroups')
@UseGuards(WorkspaceAuthGuard)
@@ -79,6 +82,7 @@ export class ViewFilterGroupController {
}
@Post()
@UseGuards(CreateViewFilterGroupPermissionGuard)
async create(
@Body() input: CreateViewFilterGroupInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -90,6 +94,7 @@ export class ViewFilterGroupController {
}
@Patch(':id')
@UseGuards(UpdateViewFilterGroupPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewFilterGroupInput,
@@ -105,6 +110,7 @@ export class ViewFilterGroupController {
}
@Delete(':id')
@UseGuards(DeleteViewFilterGroupPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-filter-group/exceptions/view-filter-group.exception.ts
+5 -1
View File
@@ -1,5 +1,5 @@
import { msg } from '@lingui/core/macro';
import { type MessageDescriptor } from '@lingui/core';
import { msg } from '@lingui/core/macro';
import { assertUnreachable } from 'twenty-shared/utils';
import { CustomException } from 'src/utils/custom-exception';
@@ -18,6 +18,7 @@ export class ViewFilterGroupException extends CustomException {
export enum ViewFilterGroupExceptionCode {
VIEW_FILTER_GROUP_NOT_FOUND = 'VIEW_FILTER_GROUP_NOT_FOUND',
INVALID_VIEW_FILTER_GROUP_DATA = 'INVALID_VIEW_FILTER_GROUP_DATA',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export enum ViewFilterGroupExceptionMessageKey {
@@ -26,6 +27,7 @@ export enum ViewFilterGroupExceptionMessageKey {
VIEW_FILTER_GROUP_NOT_FOUND = 'VIEW_FILTER_GROUP_NOT_FOUND',
INVALID_VIEW_FILTER_GROUP_DATA = 'INVALID_VIEW_FILTER_GROUP_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export const generateViewFilterGroupExceptionMessage = (
@@ -43,6 +45,8 @@ export const generateViewFilterGroupExceptionMessage = (
return `Invalid view filter group data${id ? ` for view filter group id: ${id}` : ''}`;
case ViewFilterGroupExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return 'FieldMetadataId is required';
case ViewFilterGroupExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
default:
assertUnreachable(key);
}
packages/twenty-server/src/engine/metadata-modules/view-filter-group/resolvers/view-filter-group.resolver.ts
+9 -6
View File
@@ -10,6 +10,10 @@ import { CreateViewFilterGroupInput } from 'src/engine/metadata-modules/view-fil
import { UpdateViewFilterGroupInput } from 'src/engine/metadata-modules/view-filter-group/dtos/inputs/update-view-filter-group.input';
import { ViewFilterGroupDTO } from 'src/engine/metadata-modules/view-filter-group/dtos/view-filter-group.dto';
import { ViewFilterGroupService } from 'src/engine/metadata-modules/view-filter-group/services/view-filter-group.service';
import { CreateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-group-permission.guard';
import { DeleteViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-group-permission.guard';
import { DestroyViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-filter-group-permission.guard';
import { UpdateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-group-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewFilterGroupDTO)
@@ -42,6 +46,7 @@ export class ViewFilterGroupResolver {
}
@Mutation(() => ViewFilterGroupDTO)
@UseGuards(CreateViewFilterGroupPermissionGuard)
async createCoreViewFilterGroup(
@Args('input') input: CreateViewFilterGroupInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -53,6 +58,7 @@ export class ViewFilterGroupResolver {
}
@Mutation(() => ViewFilterGroupDTO)
@UseGuards(UpdateViewFilterGroupPermissionGuard)
async updateCoreViewFilterGroup(
@Args('id', { type: () => String }) id: string,
@Args('input') input: UpdateViewFilterGroupInput,
@@ -62,6 +68,7 @@ export class ViewFilterGroupResolver {
}
@Mutation(() => Boolean)
@UseGuards(DeleteViewFilterGroupPermissionGuard)
async deleteCoreViewFilterGroup(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -75,15 +82,11 @@ export class ViewFilterGroupResolver {
}
@Mutation(() => Boolean)
@UseGuards(DestroyViewFilterGroupPermissionGuard)
async destroyCoreViewFilterGroup(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
): Promise<boolean> {
const deletedViewFilterGroup = await this.viewFilterGroupService.destroy(
id,
workspace.id,
);
return isDefined(deletedViewFilterGroup);
return this.viewFilterGroupService.destroy(id, workspace.id);
}
}
packages/twenty-server/src/engine/metadata-modules/view-filter-group/services/tests/view-filter-group.service.spec.ts
+12 -5
View File
@@ -344,7 +344,7 @@ describe('ViewFilterGroupService', () => {
const workspaceId = 'workspace-id';
jest
.spyOn(viewFilterGroupService, 'findById')
.spyOn(viewFilterGroupRepository, 'findOne')
.mockResolvedValue(mockViewFilterGroup);
jest
.spyOn(viewFilterGroupRepository, 'delete')
@@ -352,10 +352,17 @@ describe('ViewFilterGroupService', () => {
const result = await viewFilterGroupService.destroy(id, workspaceId);
expect(viewFilterGroupService.findById).toHaveBeenCalledWith(
id,
workspaceId,
);
expect(viewFilterGroupRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: [
'workspace',
'view',
'viewFilters',
'parentViewFilterGroup',
'childViewFilterGroups',
],
withDeleted: true,
});
expect(viewFilterGroupRepository.delete).toHaveBeenCalledWith(id);
expect(result).toEqual(true);
});
packages/twenty-server/src/engine/metadata-modules/view-filter-group/services/view-filter-group.service.ts
+14 -1
View File
@@ -180,7 +180,20 @@ export class ViewFilterGroupService {
}
async destroy(id: string, workspaceId: string): Promise<boolean> {
const viewFilterGroup = await this.findById(id, workspaceId);
const viewFilterGroup = await this.viewFilterGroupRepository.findOne({
where: {
id,
workspaceId,
},
relations: [
'workspace',
'view',
'viewFilters',
'parentViewFilterGroup',
'childViewFilterGroups',
],
withDeleted: true,
});
if (!isDefined(viewFilterGroup)) {
throw new ViewFilterGroupException(
packages/twenty-server/src/engine/metadata-modules/view-filter-group/view-filter-group.module.ts
+6 -1
View File
@@ -1,16 +1,21 @@
import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewFilterGroupController } from 'src/engine/metadata-modules/view-filter-group/controllers/view-filter-group.controller';
import { ViewFilterGroupEntity } from 'src/engine/metadata-modules/view-filter-group/entities/view-filter-group.entity';
import { ViewFilterGroupResolver } from 'src/engine/metadata-modules/view-filter-group/resolvers/view-filter-group.resolver';
import { ViewFilterGroupService } from 'src/engine/metadata-modules/view-filter-group/services/view-filter-group.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
@Module({
imports: [
TypeOrmModule.forFeature([ViewFilterGroupEntity]),
TypeOrmModule.forFeature([ViewFilterGroupEntity, ViewEntity]),
PermissionsModule,
WorkspaceCacheStorageModule,
ViewPermissionsModule,
],
controllers: [ViewFilterGroupController],
providers: [ViewFilterGroupService, ViewFilterGroupResolver],
packages/twenty-server/src/engine/metadata-modules/view-filter/controllers/view-filter.controller.ts
+6
View File
@@ -31,6 +31,9 @@ import {
import { ViewFilterRestApiExceptionFilter } from 'src/engine/metadata-modules/view-filter/filters/view-filter-rest-api-exception.filter';
import { ViewFilterV2Service } from 'src/engine/metadata-modules/view-filter/services/view-filter-v2.service';
import { ViewFilterService } from 'src/engine/metadata-modules/view-filter/services/view-filter.service';
import { CreateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-permission.guard';
import { DeleteViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-permission.guard';
import { UpdateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-permission.guard';
@Controller('rest/metadata/viewFilters')
@UseGuards(WorkspaceAuthGuard)
@@ -80,6 +83,7 @@ export class ViewFilterController {
}
@Post()
@UseGuards(CreateViewFilterPermissionGuard)
async create(
@Body() input: CreateViewFilterInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -104,6 +108,7 @@ export class ViewFilterController {
}
@Patch(':id')
@UseGuards(UpdateViewFilterPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewFilterInput,
@@ -137,6 +142,7 @@ export class ViewFilterController {
}
@Delete(':id')
@UseGuards(DeleteViewFilterPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-filter/dtos/inputs/update-view-filter.input.ts
+1 -1
View File
@@ -1,5 +1,6 @@
import { Field, InputType } from '@nestjs/graphql';
import { Type } from 'class-transformer';
import {
IsEnum,
IsNotEmpty,
@@ -11,7 +12,6 @@ import {
} from 'class-validator';
import GraphQLJSON from 'graphql-type-json';
import { ViewFilterOperand } from 'twenty-shared/types';
import { Type } from 'class-transformer';
import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
import { ViewFilterValue } from 'src/engine/metadata-modules/view-filter/types/view-filter-value.type';
packages/twenty-server/src/engine/metadata-modules/view-filter/exceptions/view-filter.exception.ts
+5 -1
View File
@@ -1,5 +1,5 @@
import { msg } from '@lingui/core/macro';
import { type MessageDescriptor } from '@lingui/core';
import { msg } from '@lingui/core/macro';
import { assertUnreachable } from 'twenty-shared/utils';
import { CustomException } from 'src/utils/custom-exception';
@@ -18,6 +18,7 @@ export class ViewFilterException extends CustomException {
export enum ViewFilterExceptionCode {
VIEW_FILTER_NOT_FOUND = 'VIEW_FILTER_NOT_FOUND',
INVALID_VIEW_FILTER_DATA = 'INVALID_VIEW_FILTER_DATA',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export enum ViewFilterExceptionMessageKey {
@@ -26,6 +27,7 @@ export enum ViewFilterExceptionMessageKey {
VIEW_FILTER_NOT_FOUND = 'VIEW_FILTER_NOT_FOUND',
INVALID_VIEW_FILTER_DATA = 'INVALID_VIEW_FILTER_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export const generateViewFilterExceptionMessage = (
@@ -43,6 +45,8 @@ export const generateViewFilterExceptionMessage = (
return `Invalid view filter data${id ? ` for view filter id: ${id}` : ''}`;
case ViewFilterExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return 'FieldMetadataId is required';
case ViewFilterExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
default:
assertUnreachable(key);
}
packages/twenty-server/src/engine/metadata-modules/view-filter/resolvers/view-filter.resolver.ts
+11 -12
View File
@@ -13,6 +13,10 @@ import { UpdateViewFilterInput } from 'src/engine/metadata-modules/view-filter/d
import { ViewFilterDTO } from 'src/engine/metadata-modules/view-filter/dtos/view-filter.dto';
import { ViewFilterV2Service } from 'src/engine/metadata-modules/view-filter/services/view-filter-v2.service';
import { ViewFilterService } from 'src/engine/metadata-modules/view-filter/services/view-filter.service';
import { CreateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-permission.guard';
import { DeleteViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-permission.guard';
import { DestroyViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-filter-permission.guard';
import { UpdateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewFilterDTO)
@@ -47,6 +51,7 @@ export class ViewFilterResolver {
}
@Mutation(() => ViewFilterDTO)
@UseGuards(CreateViewFilterPermissionGuard)
async createCoreViewFilter(
@Args('input') createViewFilterInput: CreateViewFilterInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -71,6 +76,7 @@ export class ViewFilterResolver {
}
@Mutation(() => ViewFilterDTO)
@UseGuards(UpdateViewFilterPermissionGuard)
async updateCoreViewFilter(
@Args('input') updateViewFilterInput: UpdateViewFilterInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -96,6 +102,7 @@ export class ViewFilterResolver {
}
@Mutation(() => ViewFilterDTO)
@UseGuards(DeleteViewFilterPermissionGuard)
async deleteCoreViewFilter(
@Args('input') deleteViewFilterInput: DeleteViewFilterInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -113,15 +120,11 @@ export class ViewFilterResolver {
});
}
const deletedViewFilter = await this.viewFilterService.delete(
deleteViewFilterInput.id,
workspaceId,
);
return deletedViewFilter;
return this.viewFilterService.delete(deleteViewFilterInput.id, workspaceId);
}
@Mutation(() => ViewFilterDTO)
@UseGuards(DestroyViewFilterPermissionGuard)
async destroyCoreViewFilter(
@Args('input') destroyViewFilterInput: DestroyViewFilterInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -133,19 +136,15 @@ export class ViewFilterResolver {
);
if (isWorkspaceMigrationV2Enabled) {
const destroyedViewFilter = await this.viewFilterV2Service.destroyOne({
return await this.viewFilterV2Service.destroyOne({
destroyViewFilterInput,
workspaceId,
});
return destroyedViewFilter;
}
const destroyedViewFilter = await this.viewFilterService.destroy(
return this.viewFilterService.destroy(
destroyViewFilterInput.id,
workspaceId,
);
return destroyedViewFilter;
}
}
packages/twenty-server/src/engine/metadata-modules/view-filter/services/tests/view-filter.service.spec.ts
+6 -2
View File
@@ -325,13 +325,17 @@ describe('ViewFilterService', () => {
const workspaceId = 'workspace-id';
jest
.spyOn(viewFilterService, 'findById')
.spyOn(viewFilterRepository, 'findOne')
.mockResolvedValue(mockViewFilter);
jest.spyOn(viewFilterRepository, 'delete').mockResolvedValue({} as any);
const result = await viewFilterService.destroy(id, workspaceId);
expect(viewFilterService.findById).toHaveBeenCalledWith(id, workspaceId);
expect(viewFilterRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: ['workspace', 'view', 'viewFilterGroup'],
withDeleted: true,
});
expect(viewFilterRepository.delete).toHaveBeenCalledWith(id);
expect(result).toEqual(mockViewFilter);
});
packages/twenty-server/src/engine/metadata-modules/view-filter/services/view-filter.service.ts
+8 -1
View File
@@ -169,7 +169,14 @@ export class ViewFilterService {
}
async destroy(id: string, workspaceId: string): Promise<ViewFilterEntity> {
const viewFilter = await this.findById(id, workspaceId);
const viewFilter = await this.viewFilterRepository.findOne({
where: {
id,
workspaceId,
},
relations: ['workspace', 'view', 'viewFilterGroup'],
withDeleted: true,
});
if (!isDefined(viewFilter)) {
throw new ViewFilterException(
packages/twenty-server/src/engine/metadata-modules/view-filter/view-filter.module.ts
+4
View File
@@ -3,11 +3,13 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewFilterController } from 'src/engine/metadata-modules/view-filter/controllers/view-filter.controller';
import { ViewFilterEntity } from 'src/engine/metadata-modules/view-filter/entities/view-filter.entity';
import { ViewFilterResolver } from 'src/engine/metadata-modules/view-filter/resolvers/view-filter.resolver';
import { ViewFilterV2Service } from 'src/engine/metadata-modules/view-filter/services/view-filter-v2.service';
import { ViewFilterService } from 'src/engine/metadata-modules/view-filter/services/view-filter.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@@ -17,8 +19,10 @@ import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspa
TypeOrmModule.forFeature([ViewFilterEntity, ViewEntity]),
WorkspaceCacheStorageModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceMigrationV2Module,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
ViewPermissionsModule,
],
controllers: [ViewFilterController],
providers: [ViewFilterService, ViewFilterResolver, ViewFilterV2Service],
packages/twenty-server/src/engine/metadata-modules/view-group/controllers/view-group.controller.ts
+6
View File
@@ -31,6 +31,9 @@ import {
import { ViewGroupRestApiExceptionFilter } from 'src/engine/metadata-modules/view-group/filters/view-group-rest-api-exception.filter';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { CreateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard';
import { DeleteViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard';
import { UpdateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-group-permission.guard';
@Controller('rest/metadata/viewGroups')
@UseGuards(WorkspaceAuthGuard)
@@ -80,6 +83,7 @@ export class ViewGroupController {
}
@Post()
@UseGuards(CreateViewGroupPermissionGuard)
async create(
@Body() input: CreateViewGroupInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -104,6 +108,7 @@ export class ViewGroupController {
}
@Patch(':id')
@UseGuards(UpdateViewGroupPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewGroupInput,
@@ -137,6 +142,7 @@ export class ViewGroupController {
}
@Delete(':id')
@UseGuards(DeleteViewGroupPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-group/dtos/inputs/update-view-group.input.ts
+1 -1
View File
@@ -1,5 +1,6 @@
import { Field, InputType } from '@nestjs/graphql';
import { Type } from 'class-transformer';
import {
IsBoolean,
IsNotEmpty,
@@ -9,7 +10,6 @@ import {
IsUUID,
ValidateNested,
} from 'class-validator';
import { Type } from 'class-transformer';
import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
packages/twenty-server/src/engine/metadata-modules/view-group/exceptions/view-group.exception.ts
+6 -4
View File
@@ -1,5 +1,6 @@
import { type MessageDescriptor } from '@lingui/core';
import { msg } from '@lingui/core/macro';
import { assertUnreachable } from 'twenty-shared/utils';
import { CustomException } from 'src/utils/custom-exception';
@@ -17,6 +18,7 @@ export class ViewGroupException extends CustomException {
export enum ViewGroupExceptionCode {
VIEW_GROUP_NOT_FOUND = 'VIEW_GROUP_NOT_FOUND',
INVALID_VIEW_GROUP_DATA = 'INVALID_VIEW_GROUP_DATA',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export enum ViewGroupExceptionMessageKey {
@@ -25,6 +27,7 @@ export enum ViewGroupExceptionMessageKey {
VIEW_GROUP_NOT_FOUND = 'VIEW_GROUP_NOT_FOUND',
INVALID_VIEW_GROUP_DATA = 'INVALID_VIEW_GROUP_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export const generateViewGroupExceptionMessage = (
@@ -42,8 +45,10 @@ export const generateViewGroupExceptionMessage = (
return `Invalid view group data${id ? ` for view group id: ${id}` : ''}`;
case ViewGroupExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return 'FieldMetadataId is required';
case ViewGroupExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
default:
return 'unknown';
assertUnreachable(key);
}
};
@@ -57,8 +62,5 @@ export const generateViewGroupUserFriendlyExceptionMessage = (
return msg`ViewId is required to create a view group.`;
case ViewGroupExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return msg`FieldMetadataId is required to create a view group.`;
default: {
return msg`unknown`;
}
}
};
packages/twenty-server/src/engine/metadata-modules/view-group/resolvers/view-group.resolver.ts
+12 -15
View File
@@ -17,6 +17,10 @@ import {
} from 'src/engine/metadata-modules/view-group/exceptions/view-group.exception';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { CreateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard';
import { DeleteViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard';
import { DestroyViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-group-permission.guard';
import { UpdateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-group-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewGroupDTO)
@@ -51,6 +55,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(CreateViewGroupPermissionGuard)
async createCoreViewGroup(
@Args('input') createViewGroupInput: CreateViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -75,6 +80,7 @@ export class ViewGroupResolver {
}
@Mutation(() => [ViewGroupDTO])
@UseGuards(CreateViewGroupPermissionGuard)
async createManyCoreViewGroups(
@Args('inputs', { type: () => [CreateViewGroupInput] })
createViewGroupInputs: CreateViewGroupInput[],
@@ -100,6 +106,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(UpdateViewGroupPermissionGuard)
async updateCoreViewGroup(
@Args('input') updateViewGroupInput: UpdateViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -125,6 +132,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(DeleteViewGroupPermissionGuard)
async deleteCoreViewGroup(
@Args('input') deleteViewGroupInput: DeleteViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -142,15 +150,11 @@ export class ViewGroupResolver {
});
}
const deletedViewGroup = await this.viewGroupService.delete(
deleteViewGroupInput.id,
workspaceId,
);
return deletedViewGroup;
return this.viewGroupService.delete(deleteViewGroupInput.id, workspaceId);
}
@Mutation(() => ViewGroupDTO)
@UseGuards(DestroyViewGroupPermissionGuard)
async destroyCoreViewGroup(
@Args('input') destroyViewGroupInput: DestroyViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -162,19 +166,12 @@ export class ViewGroupResolver {
);
if (isWorkspaceMigrationV2Enabled) {
const destroyedViewGroup = await this.viewGroupV2Service.destroyOne({
return await this.viewGroupV2Service.destroyOne({
destroyViewGroupInput,
workspaceId,
});
return destroyedViewGroup;
}
const destroyedViewGroup = await this.viewGroupService.destroy(
destroyViewGroupInput.id,
workspaceId,
);
return destroyedViewGroup;
return this.viewGroupService.destroy(destroyViewGroupInput.id, workspaceId);
}
}
packages/twenty-server/src/engine/metadata-modules/view-group/services/tests/view-group.service.spec.ts
+8 -2
View File
@@ -308,12 +308,18 @@ describe('ViewGroupService', () => {
const id = 'view-group-id';
const workspaceId = 'workspace-id';
jest.spyOn(viewGroupService, 'findById').mockResolvedValue(mockViewGroup);
jest
.spyOn(viewGroupRepository, 'findOne')
.mockResolvedValue(mockViewGroup);
jest.spyOn(viewGroupRepository, 'delete').mockResolvedValue({} as any);
const result = await viewGroupService.destroy(id, workspaceId);
expect(viewGroupService.findById).toHaveBeenCalledWith(id, workspaceId);
expect(viewGroupRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: ['workspace', 'view'],
withDeleted: true,
});
expect(viewGroupRepository.delete).toHaveBeenCalledWith(id);
expect(result).toEqual(mockViewGroup);
});
packages/twenty-server/src/engine/metadata-modules/view-group/services/view-group.service.ts
+8 -1
View File
@@ -169,7 +169,14 @@ export class ViewGroupService {
}
async destroy(id: string, workspaceId: string): Promise<ViewGroupEntity> {
const viewGroup = await this.findById(id, workspaceId);
const viewGroup = await this.viewGroupRepository.findOne({
where: {
id,
workspaceId,
},
relations: ['workspace', 'view'],
withDeleted: true,
});
if (!isDefined(viewGroup)) {
throw new ViewGroupException(
packages/twenty-server/src/engine/metadata-modules/view-group/view-group.module.ts
+6 -1
View File
@@ -3,21 +3,26 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewGroupController } from 'src/engine/metadata-modules/view-group/controllers/view-group.controller';
import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
import { ViewGroupResolver } from 'src/engine/metadata-modules/view-group/resolvers/view-group.resolver';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@Module({
imports: [
TypeOrmModule.forFeature([ViewGroupEntity]),
TypeOrmModule.forFeature([ViewGroupEntity, ViewEntity]),
WorkspaceCacheStorageModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceMigrationV2Module,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
ViewPermissionsModule,
],
controllers: [ViewGroupController],
providers: [ViewGroupService, ViewGroupV2Service, ViewGroupResolver],
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard.ts
+45
View File
@@ -0,0 +1,45 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class CreateViewFieldPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args.input or args.inputs
const args = gqlContext.getArgs();
if (typeof args?.input?.viewId === 'string') {
viewId = args.input.viewId;
}
if (!viewId && Array.isArray(args?.inputs) && args.inputs.length > 0) {
viewId =
typeof args.inputs[0]?.viewId === 'string'
? args.inputs[0].viewId
: null;
}
// For REST: extract from request body
if (!viewId && typeof request.body?.viewId === 'string') {
viewId = request.body.viewId;
}
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/create-view-filter-group-permission.guard.ts
+38
View File
@@ -0,0 +1,38 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class CreateViewFilterGroupPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args.input
const args = gqlContext.getArgs();
if (typeof args?.input?.viewId === 'string') {
viewId = args.input.viewId;
}
// For REST: extract from request body
if (!viewId && typeof request.body?.viewId === 'string') {
viewId = request.body.viewId;
}
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/create-view-filter-permission.guard.ts
+38
View File
@@ -0,0 +1,38 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class CreateViewFilterPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args.input
const args = gqlContext.getArgs();
if (typeof args?.input?.viewId === 'string') {
viewId = args.input.viewId;
}
// For REST: extract from request body
if (!viewId && typeof request.body?.viewId === 'string') {
viewId = request.body.viewId;
}
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard.ts
+45
View File
@@ -0,0 +1,45 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class CreateViewGroupPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args.input or args.inputs
const args = gqlContext.getArgs();
if (typeof args?.input?.viewId === 'string') {
viewId = args.input.viewId;
}
if (!viewId && Array.isArray(args?.inputs) && args.inputs.length > 0) {
viewId =
typeof args.inputs[0]?.viewId === 'string'
? args.inputs[0].viewId
: null;
}
// For REST: extract from request body
if (!viewId && typeof request.body?.viewId === 'string') {
viewId = request.body.viewId;
}
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/create-view-sort-permission.guard.ts
+38
View File
@@ -0,0 +1,38 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class CreateViewSortPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args.input
const args = gqlContext.getArgs();
if (typeof args?.input?.viewId === 'string') {
viewId = args.input.viewId;
}
// For REST: extract from request body
if (!viewId && typeof request.body?.viewId === 'string') {
viewId = request.body.viewId;
}
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard.ts
+50
View File
@@ -0,0 +1,50 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
import { ViewEntityLookupService } from 'src/engine/metadata-modules/view-permissions/services/view-entity-lookup.service';
@Injectable()
export class DeleteViewFieldPermissionGuard implements CanActivate {
constructor(
private readonly viewAccessService: ViewAccessService,
private readonly viewEntityLookupService: ViewEntityLookupService,
) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let entityId = '';
// For GraphQL: extract from args.input.id
const args = gqlContext.getArgs();
if (typeof args?.input?.id === 'string') {
entityId = args.input.id;
}
// For REST: extract from URL params
if (!entityId && typeof request.params?.id === 'string') {
entityId = request.params.id;
}
const viewId = entityId
? await this.viewEntityLookupService.findViewIdByEntityIdAndKind(
'viewField',
entityId,
request.workspace.id,
)
: null;
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/delete-view-filter-group-permission.guard.ts
+50
View File
@@ -0,0 +1,50 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
import { ViewEntityLookupService } from 'src/engine/metadata-modules/view-permissions/services/view-entity-lookup.service';
@Injectable()
export class DeleteViewFilterGroupPermissionGuard implements CanActivate {
constructor(
private readonly viewAccessService: ViewAccessService,
private readonly viewEntityLookupService: ViewEntityLookupService,
) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let entityId = '';
// For GraphQL: extract from args.id
const args = gqlContext.getArgs();
if (typeof args?.id === 'string') {
entityId = args.id;
}
// For REST: extract from URL params
if (!entityId && typeof request.params?.id === 'string') {
entityId = request.params.id;
}
const viewId = entityId
? await this.viewEntityLookupService.findViewIdByEntityIdAndKind(
'viewFilterGroup',
entityId,
request.workspace.id,
)
: null;
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/delete-view-filter-permission.guard.ts
+50
View File
@@ -0,0 +1,50 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
import { ViewEntityLookupService } from 'src/engine/metadata-modules/view-permissions/services/view-entity-lookup.service';
@Injectable()
export class DeleteViewFilterPermissionGuard implements CanActivate {
constructor(
private readonly viewAccessService: ViewAccessService,
private readonly viewEntityLookupService: ViewEntityLookupService,
) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let entityId = '';
// For GraphQL: extract from args.input.id
const args = gqlContext.getArgs();
if (typeof args?.input?.id === 'string') {
entityId = args.input.id;
}
// For REST: extract from URL params
if (!entityId && typeof request.params?.id === 'string') {
entityId = request.params.id;
}
const viewId = entityId
? await this.viewEntityLookupService.findViewIdByEntityIdAndKind(
'viewFilter',
entityId,
request.workspace.id,
)
: null;
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard.ts
+50
View File
@@ -0,0 +1,50 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
import { ViewEntityLookupService } from 'src/engine/metadata-modules/view-permissions/services/view-entity-lookup.service';
@Injectable()
export class DeleteViewGroupPermissionGuard implements CanActivate {
constructor(
private readonly viewAccessService: ViewAccessService,
private readonly viewEntityLookupService: ViewEntityLookupService,
) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let entityId = '';
// For GraphQL: extract from args.input.id
const args = gqlContext.getArgs();
if (typeof args?.input?.id === 'string') {
entityId = args.input.id;
}
// For REST: extract from URL params
if (!entityId && typeof request.params?.id === 'string') {
entityId = request.params.id;
}
const viewId = entityId
? await this.viewEntityLookupService.findViewIdByEntityIdAndKind(
'viewGroup',
entityId,
request.workspace.id,
)
: null;
return this.viewAccessService.canUserModifyViewByChildEntity(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}
packages/twenty-server/src/engine/metadata-modules/view-permissions/guards/delete-view-permission.guard.ts
+38
View File
@@ -0,0 +1,38 @@
import {
Injectable,
type CanActivate,
type ExecutionContext,
} from '@nestjs/common';
import { GqlExecutionContext } from '@nestjs/graphql';
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
@Injectable()
export class DeleteViewPermissionGuard implements CanActivate {
constructor(private readonly viewAccessService: ViewAccessService) {}
async canActivate(context: ExecutionContext): Promise<boolean> {
const gqlContext = GqlExecutionContext.create(context);
const request = gqlContext.getContext().req;
let viewId: string | null = null;
// For GraphQL: extract from args
const args = gqlContext.getArgs();
if (typeof args?.id === 'string') {
viewId = args.id;
}
// For REST: extract from URL params
if (!viewId && typeof request.params?.id === 'string') {
viewId = request.params.id;
}
return this.viewAccessService.canUserModifyView(
viewId,
request.userWorkspaceId,
request.workspace.id,
);
}
}

Some files were not shown because too many files have changed in this diff Show More