houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance role-check system with stricter checks (#15392)

Browse Source 
## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.
This commit is contained in:
Félix Malfait
2025-11-07 15:37:17 +01:00
committed by GitHub
parent 44d6ec2594
commit cff17db6cb
306 changed files with 13863 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/core-modules/admin-panel/admin-panel.resolver.ts
+21 -14
View File
@@ -31,8 +31,10 @@ import { ConfigVariableGraphqlApiExceptionFilter } from 'src/engine/core-modules
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { AdminPanelGuard } from 'src/engine/guards/admin-panel-guard';
import { ServerLevelImpersonateGuard } from 'src/engine/guards/server-level-impersonate.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { AdminPanelHealthServiceDataDTO } from './dtos/admin-panel-health-service-data.dto';
import { QueueMetricsDataDTO } from './dtos/queue-metrics-data.dto';
@@ -44,6 +46,11 @@ import { QueueMetricsDataDTO } from './dtos/queue-metrics-data.dto';
PreventNestToAutoLogGraphqlErrorsFilter,
ConfigVariableGraphqlApiExceptionFilter,
)
@UseGuards(
WorkspaceAuthGuard,
UserAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.SECURITY),
)
export class AdminPanelResolver {
constructor(
private adminService: AdminPanelService,
@@ -53,7 +60,7 @@ export class AdminPanelResolver {
private readonly twentyConfigService: TwentyConfigService,
) {}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, ServerLevelImpersonateGuard)
@UseGuards(ServerLevelImpersonateGuard)
@Mutation(() => UserLookup)
async userLookupAdminPanel(
@Args() userLookupInput: UserLookupInput,
@@ -61,7 +68,7 @@ export class AdminPanelResolver {
return await this.adminService.userLookup(userLookupInput.userIdentifier);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async updateWorkspaceFeatureFlag(
@Args() updateFlagInput: UpdateWorkspaceFeatureFlagInput,
@@ -83,19 +90,19 @@ export class AdminPanelResolver {
}
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => ConfigVariablesOutput)
async getConfigVariablesGrouped(): Promise<ConfigVariablesOutput> {
return this.adminService.getConfigVariablesGrouped();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => SystemHealthDTO)
async getSystemHealthStatus(): Promise<SystemHealthDTO> {
return this.adminPanelHealthService.getSystemHealthStatus();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => AdminPanelHealthServiceDataDTO)
async getIndicatorHealthStatus(
@Args('indicatorId', {
@@ -106,7 +113,7 @@ export class AdminPanelResolver {
return this.adminPanelHealthService.getIndicatorHealthStatus(indicatorId);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => QueueMetricsDataDTO)
async getQueueMetrics(
@Args('queueName', { type: () => String })
@@ -124,13 +131,13 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => VersionInfoDTO)
async versionInfo(): Promise<VersionInfoDTO> {
return this.adminService.getVersionInfo();
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => ConfigVariableDTO)
async getDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -140,7 +147,7 @@ export class AdminPanelResolver {
return this.adminService.getConfigVariable(key);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async createDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -152,7 +159,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async updateDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -164,7 +171,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => Boolean)
async deleteDatabaseConfigVariable(
@Args('key', { type: () => String }) key: keyof ConfigVariables,
@@ -174,7 +181,7 @@ export class AdminPanelResolver {
return true;
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Query(() => QueueJobsResponseDTO)
async getQueueJobs(
@Args('queueName', { type: () => String })
@@ -194,7 +201,7 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => RetryJobsResponseDTO)
async retryJobs(
@Args('queueName', { type: () => String })
@@ -208,7 +215,7 @@ export class AdminPanelResolver {
);
}
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, AdminPanelGuard)
@UseGuards(AdminPanelGuard)
@Mutation(() => DeleteJobsResponseDTO)
async deleteJobs(
@Args('queueName', { type: () => String })
packages/twenty-server/src/engine/core-modules/application/application.module.ts
+2
View File
@@ -13,6 +13,7 @@ import { DataSourceModule } from 'src/engine/metadata-modules/data-source/data-s
import { DatabaseEventTriggerModule } from 'src/engine/metadata-modules/database-event-trigger/database-event-trigger.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { ObjectMetadataModule } from 'src/engine/metadata-modules/object-metadata/object-metadata.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { RouteTriggerModule } from 'src/engine/metadata-modules/route-trigger/route-trigger.module';
import { ServerlessFunctionLayerModule } from 'src/engine/metadata-modules/serverless-function-layer/serverless-function-layer.module';
import { ServerlessFunctionModule } from 'src/engine/metadata-modules/serverless-function/serverless-function.module';
@@ -33,6 +34,7 @@ import { FieldMetadataModule } from 'src/engine/metadata-modules/field-metadata/
CronTriggerModule,
RouteTriggerModule,
WorkspaceMigrationV2Module,
PermissionsModule,
],
providers: [ApplicationResolver, ApplicationService, ApplicationSyncService],
})
packages/twenty-server/src/engine/core-modules/application/application.resolver.ts
+6 -1
View File
@@ -12,9 +12,14 @@ import { FeatureFlagKey } from 'src/engine/core-modules/feature-flag/enums/featu
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { RequireFeatureFlag } from 'src/engine/guards/feature-flag.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.APPLICATIONS),
)
@Resolver()
@UseFilters(ApplicationExceptionFilter)
export class ApplicationResolver {
packages/twenty-server/src/engine/core-modules/applicationVariable/application-variable.module.ts
+5 -1
View File
@@ -5,9 +5,13 @@ import { NestjsQueryTypeOrmModule } from '@ptc-org/nestjs-query-typeorm';
import { ApplicationVariableEntity } from 'src/engine/core-modules/applicationVariable/application-variable.entity';
import { ApplicationVariableEntityService } from 'src/engine/core-modules/applicationVariable/application-variable.service';
import { ApplicationVariableEntityResolver } from 'src/engine/core-modules/applicationVariable/application-variable.resolver';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [NestjsQueryTypeOrmModule.forFeature([ApplicationVariableEntity])],
imports: [
NestjsQueryTypeOrmModule.forFeature([ApplicationVariableEntity]),
PermissionsModule,
],
providers: [
ApplicationVariableEntityService,
ApplicationVariableEntityResolver,
packages/twenty-server/src/engine/core-modules/applicationVariable/application-variable.resolver.ts
+8 -3
View File
@@ -1,12 +1,17 @@
import { UseFilters, UseGuards } from '@nestjs/common';
import { Args, Mutation, Resolver } from '@nestjs/graphql';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ApplicationVariableEntityExceptionFilter } from 'src/engine/core-modules/applicationVariable/application-variable-exception-filter';
import { ApplicationVariableEntityService } from 'src/engine/core-modules/applicationVariable/application-variable.service';
import { UpdateApplicationVariableEntityInput } from 'src/engine/core-modules/applicationVariable/dtos/update-application-variable.input';
import { ApplicationVariableEntityExceptionFilter } from 'src/engine/core-modules/applicationVariable/application-variable-exception-filter';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.APPLICATIONS),
)
@Resolver()
@UseFilters(ApplicationVariableEntityExceptionFilter)
export class ApplicationVariableEntityResolver {
packages/twenty-server/src/engine/core-modules/approved-access-domain/approved-access-domain.module.ts
+2
View File
@@ -7,12 +7,14 @@ import { ApprovedAccessDomainResolver } from 'src/engine/core-modules/approved-a
import { ApprovedAccessDomainService } from 'src/engine/core-modules/approved-access-domain/services/approved-access-domain.service';
import { WorkspaceDomainsModule } from 'src/engine/core-modules/domain/workspace-domains/workspace-domains.module';
import { FileModule } from 'src/engine/core-modules/file/file.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
WorkspaceDomainsModule,
FileModule,
NestjsQueryTypeOrmModule.forFeature([ApprovedAccessDomainEntity]),
PermissionsModule,
],
exports: [ApprovedAccessDomainService],
providers: [ApprovedAccessDomainService, ApprovedAccessDomainResolver],
packages/twenty-server/src/engine/core-modules/approved-access-domain/approved-access-domain.resolver.ts
+6 -1
View File
@@ -13,11 +13,16 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE_MEMBERS),
)
@UsePipes(ResolverValidationPipe)
@UseFilters(
ApprovedAccessDomainExceptionFilter,
packages/twenty-server/src/engine/core-modules/audit/audit.resolver.ts
+4 -3
View File
@@ -13,15 +13,16 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { Analytics } from './dtos/analytics.dto';
import {
CreateAnalyticsInputV2,
isPageviewAnalyticsInput,
isTrackAnalyticsInput,
} from './dtos/create-analytics.input';
import { Analytics } from './dtos/analytics.dto';
import { AuditService } from './services/audit.service';
@Resolver(() => Analytics)
@@ -42,7 +43,7 @@ export class AuditResolver {
}
@Mutation(() => Analytics)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
async createObjectEvent(
@Args()
createObjectEventInput: CreateObjectEventInput,
@@ -70,7 +71,7 @@ export class AuditResolver {
}
@Mutation(() => Analytics)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async trackAnalytics(
@Args()
createAnalyticsInput: CreateAnalyticsInputV2,
packages/twenty-server/src/engine/core-modules/auth/auth.resolver.ts
+18 -17
View File
@@ -68,6 +68,7 @@ import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.ent
import { AuthProvider } from 'src/engine/decorators/auth/auth-provider.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -76,11 +77,11 @@ import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/cons
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
import { ApiKeyToken } from './dto/api-key-token.dto';
import { AuthTokens } from './dto/auth-tokens.dto';
import { GetAuthTokensFromLoginTokenInput } from './dto/get-auth-tokens-from-login-token.input';
import { LoginTokenOutput } from './dto/login-token.dto';
import { SignUpInput } from './dto/sign-up.input';
import { ApiKeyToken } from './dto/api-key-token.dto';
import { AuthTokens } from './dto/auth-tokens.dto';
import { UserCredentialsInput } from './dto/user-credentials.input';
import { CheckUserExistOutput } from './dto/user-exists.dto';
import { EmailAndCaptchaInput } from './dto/user-exists.input';
@@ -135,7 +136,7 @@ export class AuthResolver {
}
@Mutation(() => GetAuthorizationUrlForSSOOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getAuthorizationUrlForSSO(
@Args('input') params: GetAuthorizationUrlForSSOInput,
) {
@@ -166,7 +167,7 @@ export class AuthResolver {
}
@Mutation(() => LoginTokenOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async getLoginTokenFromCredentials(
@Args()
getLoginTokenFromCredentialsInput: UserCredentialsInput,
@@ -201,7 +202,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signIn(
@Args()
userCredentials: UserCredentialsInput,
@@ -239,7 +240,7 @@ export class AuthResolver {
}
@Mutation(() => GetLoginTokenFromEmailVerificationTokenOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getLoginTokenFromEmailVerificationToken(
@Args()
getAuthTokenFromEmailVerificationTokenInput: GetAuthTokenFromEmailVerificationTokenInput,
@@ -275,7 +276,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getWorkspaceAgnosticTokenFromEmailVerificationToken(
@Args()
getAuthTokenFromEmailVerificationTokenInput: GetAuthTokenFromEmailVerificationTokenInput,
@@ -319,7 +320,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async getAuthTokensFromOTP(
@Args()
twoFactorAuthenticationVerificationInput: TwoFactorAuthenticationVerificationInput,
@@ -357,7 +358,7 @@ export class AuthResolver {
}
@Mutation(() => AvailableWorkspacesAndAccessTokensOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signUp(
@Args() signUpInput: UserCredentialsInput,
): Promise<AvailableWorkspacesAndAccessTokensOutput> {
@@ -409,7 +410,7 @@ export class AuthResolver {
}
@Mutation(() => SignUpOutput)
@UseGuards(CaptchaGuard, PublicEndpointGuard)
@UseGuards(CaptchaGuard, PublicEndpointGuard, NoPermissionGuard)
async signUpInWorkspace(
@Args() signUpInput: SignUpInput,
@AuthProvider() authProvider: AuthProviderEnum,
@@ -482,7 +483,7 @@ export class AuthResolver {
}
@Mutation(() => SignUpOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async signUpInNewWorkspace(
@AuthUser() currentUser: UserEntity,
@AuthProvider() authProvider: AuthProviderEnum,
@@ -511,7 +512,7 @@ export class AuthResolver {
}
@Mutation(() => TransientTokenOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async generateTransientToken(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -535,7 +536,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async getAuthTokensFromLoginToken(
@Args() getAuthTokensFromLoginTokenInput: GetAuthTokensFromLoginTokenInput,
@Args('origin') origin: string,
@@ -757,7 +758,7 @@ export class AuthResolver {
}
@Mutation(() => AuthorizeAppOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async authorizeApp(
@Args() authorizeAppInput: AuthorizeAppInput,
@AuthUser() user: UserEntity,
@@ -771,7 +772,7 @@ export class AuthResolver {
}
@Mutation(() => AuthTokens)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async renewToken(@Args() args: AppTokenInput): Promise<AuthTokens> {
const tokens = await this.renewTokenService.generateTokensFromRefreshToken(
args.appToken,
@@ -797,7 +798,7 @@ export class AuthResolver {
}
@Mutation(() => EmailPasswordResetLinkOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async emailPasswordResetLink(
@Args() emailPasswordResetInput: EmailPasswordResetLinkInput,
@Context() context: I18nContext,
@@ -816,7 +817,7 @@ export class AuthResolver {
}
@Mutation(() => InvalidatePasswordOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async updatePasswordViaResetToken(
@Args()
{ passwordResetToken, newPassword }: UpdatePasswordViaResetTokenInput,
packages/twenty-server/src/engine/core-modules/billing/billing.resolver.ts
+13 -12
View File
@@ -7,6 +7,7 @@ import { WorkspaceActivationStatus } from 'twenty-shared/workspace';
import { BillingCheckoutSessionInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-checkout-session.input';
import { BillingSessionInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-session.input';
import { BillingUpdateSubscriptionItemPriceInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-update-subscription-item-price.input';
import { BillingEndTrialPeriodOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-end-trial-period.output';
import { BillingMeteredProductUsageOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-metered-product-usage.output';
import { BillingPlanOutput } from 'src/engine/core-modules/billing/dtos/outputs/billing-plan.output';
@@ -27,6 +28,7 @@ import { AuthApiKey } from 'src/engine/decorators/auth/auth-api-key.decorator';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -38,7 +40,6 @@ import {
} from 'src/engine/metadata-modules/permissions/permissions.exception';
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
import { BillingUpdateSubscriptionItemPriceInput } from 'src/engine/core-modules/billing/dtos/inputs/billing-update-subscription-item-price.input';
@Resolver()
@UsePipes(ResolverValidationPipe)
@@ -59,7 +60,7 @@ export class BillingResolver {
@Query(() => BillingSessionOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async billingPortalSession(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -74,7 +75,7 @@ export class BillingResolver {
}
@Mutation(() => BillingSessionOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, NoPermissionGuard)
async checkoutSession(
@AuthWorkspace() workspace: WorkspaceEntity,
@AuthUser() user: UserEntity,
@@ -137,7 +138,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async switchSubscriptionInterval(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -159,7 +160,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async switchBillingPlan(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.changePlan(workspace);
@@ -179,7 +180,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchBillingPlan(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.cancelSwitchPlan(workspace);
@@ -199,7 +200,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchBillingInterval(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -221,7 +222,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async setMeteredSubscriptionPrice(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -255,7 +256,7 @@ export class BillingResolver {
@Mutation(() => BillingEndTrialPeriodOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async endSubscriptionTrialPeriod(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -266,7 +267,7 @@ export class BillingResolver {
@Query(() => [BillingMeteredProductUsageOutput])
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async getMeteredProductsUsage(
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -277,7 +278,7 @@ export class BillingResolver {
@Mutation(() => BillingUpdateOutput)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
SettingsPermissionsGuard(PermissionFlagType.BILLING),
)
async cancelSwitchMeteredPrice(@AuthWorkspace() workspace: WorkspaceEntity) {
await this.billingSubscriptionService.cancelSwitchMeteredPrice(workspace);
@@ -320,7 +321,7 @@ export class BillingResolver {
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
workspaceId,
setting: PermissionFlagType.WORKSPACE,
setting: PermissionFlagType.BILLING,
apiKeyId,
});
packages/twenty-server/src/engine/core-modules/email-verification/email-verification.resolver.ts
+2 -1
View File
@@ -9,6 +9,7 @@ import { EmailVerificationService } from 'src/engine/core-modules/email-verifica
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { I18nContext } from 'src/engine/core-modules/i18n/types/i18n-context.type';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
@Resolver()
@@ -25,7 +26,7 @@ export class EmailVerificationResolver {
// TODO: this should be an authenticated endpoint
@Mutation(() => ResendEmailVerificationTokenOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async resendEmailVerificationToken(
@Args()
resendEmailVerificationTokenInput: ResendEmailVerificationTokenInput,
packages/twenty-server/src/engine/core-modules/emailing-domain/emailing-domain.module.ts
+2
View File
@@ -9,11 +9,13 @@ import { EmailingDomainDriverFactory } from 'src/engine/core-modules/emailing-do
import { EmailingDomainEntity } from 'src/engine/core-modules/emailing-domain/emailing-domain.entity';
import { EmailingDomainResolver } from 'src/engine/core-modules/emailing-domain/emailing-domain.resolver';
import { EmailingDomainService } from 'src/engine/core-modules/emailing-domain/services/emailing-domain.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
TypeORMModule,
NestjsQueryTypeOrmModule.forFeature([EmailingDomainEntity]),
PermissionsModule,
],
exports: [EmailingDomainService],
providers: [
packages/twenty-server/src/engine/core-modules/emailing-domain/emailing-domain.resolver.ts
+6 -1
View File
@@ -7,9 +7,14 @@ import { EmailingDomainService } from 'src/engine/core-modules/emailing-domain/s
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
)
@UsePipes(ResolverValidationPipe)
@Resolver(() => EmailingDomainDto)
export class EmailingDomainResolver {
packages/twenty-server/src/engine/core-modules/file/file-upload/file-upload.module.ts
+2 -1
View File
@@ -4,9 +4,10 @@ import { Module } from '@nestjs/common';
import { FileUploadResolver } from 'src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver';
import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
import { FileModule } from 'src/engine/core-modules/file/file.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [FileModule, HttpModule],
imports: [FileModule, HttpModule, PermissionsModule],
providers: [FileUploadService, FileUploadResolver],
exports: [FileUploadService, FileUploadResolver],
})
packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.spec.ts
+5
View File
@@ -2,6 +2,7 @@ import { Test, type TestingModule } from '@nestjs/testing';
import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { FileUploadResolver } from './file-upload.resolver';
@@ -20,6 +21,10 @@ describe('FileUploadResolver', () => {
provide: TwentyConfigService,
useValue: {},
},
{
provide: PermissionsService,
useValue: {},
},
],
}).compile();
packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.ts
+4
View File
@@ -11,7 +11,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
@UseGuards(WorkspaceAuthGuard)
@@ -22,6 +24,7 @@ export class FileUploadResolver {
constructor(private readonly fileUploadService: FileUploadService) {}
@Mutation(() => SignedFileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async uploadFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
@@ -48,6 +51,7 @@ export class FileUploadResolver {
}
@Mutation(() => SignedFileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async uploadImage(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
packages/twenty-server/src/engine/core-modules/file/file.module.ts
+2
View File
@@ -9,6 +9,7 @@ import { FileAttachmentListener } from 'src/engine/core-modules/file/listeners/f
import { FileWorkspaceMemberListener } from 'src/engine/core-modules/file/listeners/file-workspace-member.listener';
import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { FileController } from './controllers/file.controller';
import { FileEntity } from './entities/file.entity';
@@ -22,6 +23,7 @@ import { FileService } from './services/file.service';
JwtModule,
TypeOrmModule.forFeature([FileEntity, WorkspaceEntity]),
HttpModule,
PermissionsModule,
],
providers: [
FileService,
packages/twenty-server/src/engine/core-modules/file/resolvers/file.resolver.ts
+4
View File
@@ -10,7 +10,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
@UseGuards(WorkspaceAuthGuard)
@@ -21,6 +23,7 @@ export class FileResolver {
constructor(private readonly fileMetadataService: FileMetadataService) {}
@Mutation(() => FileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async createFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args({ name: 'file', type: () => GraphQLUpload })
@@ -38,6 +41,7 @@ export class FileResolver {
}
@Mutation(() => FileDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
async deleteFile(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@Args('fileId', { type: () => UUIDScalarType }) fileId: string,
packages/twenty-server/src/engine/core-modules/impersonation/impersonation.resolver.ts
+2
View File
@@ -10,6 +10,7 @@ import {
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { ImpersonationService } from 'src/engine/core-modules/impersonation/services/impersonation.service';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { ImpersonatePermissionGuard } from 'src/engine/guards/impersonate-permission.guard';
import { NoImpersonationGuard } from 'src/engine/guards/no-impersonation.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -25,6 +26,7 @@ export class ImpersonationResolver {
UserAuthGuard,
NoImpersonationGuard,
ImpersonatePermissionGuard,
CustomPermissionGuard,
)
@Mutation(() => ImpersonateOutput)
async impersonate(
packages/twenty-server/src/engine/core-modules/onboarding/onboarding.resolver.ts
+3
View File
@@ -9,6 +9,7 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -20,6 +21,7 @@ export class OnboardingResolver {
constructor(private readonly onboardingService: OnboardingService) {}
@Mutation(() => OnboardingStepSuccessDTO)
@UseGuards(NoPermissionGuard)
async skipSyncEmailOnboardingStep(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -34,6 +36,7 @@ export class OnboardingResolver {
}
@Mutation(() => OnboardingStepSuccessDTO)
@UseGuards(NoPermissionGuard)
async skipBookOnboardingStep(
@AuthWorkspace() workspace: WorkspaceEntity,
): Promise<OnboardingStepSuccessDTO> {
packages/twenty-server/src/engine/core-modules/page-layout/page-layout.module.ts
+2
View File
@@ -15,6 +15,7 @@ import { PageLayoutTabService } from 'src/engine/core-modules/page-layout/servic
import { PageLayoutUpdateService } from 'src/engine/core-modules/page-layout/services/page-layout-update.service';
import { PageLayoutWidgetService } from 'src/engine/core-modules/page-layout/services/page-layout-widget.service';
import { PageLayoutService } from 'src/engine/core-modules/page-layout/services/page-layout.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
@Module({
@@ -25,6 +26,7 @@ import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
PageLayoutWidgetEntity,
]),
TwentyORMModule,
PermissionsModule,
FeatureFlagModule,
],
controllers: [
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout-tab.resolver.ts
+8 -1
View File
@@ -9,9 +9,11 @@ import { UpdatePageLayoutTabInput } from 'src/engine/core-modules/page-layout/dt
import { PageLayoutTabDTO } from 'src/engine/core-modules/page-layout/dtos/page-layout-tab.dto';
import { PageLayoutTabService } from 'src/engine/core-modules/page-layout/services/page-layout-tab.service';
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutTabDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@@ -40,6 +42,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async createPageLayoutTab(
@Args('input') input: CreatePageLayoutTabInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -48,6 +51,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async updatePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@Args('input') input: UpdatePageLayoutTabInput,
@@ -57,6 +61,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async deletePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -70,6 +75,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async destroyPageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -78,6 +84,7 @@ export class PageLayoutTabResolver {
}
@Mutation(() => PageLayoutTabDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async restorePageLayoutTab(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout-widget.resolver.ts
+8 -1
View File
@@ -16,9 +16,11 @@ import { WidgetConfiguration } from 'src/engine/core-modules/page-layout/dtos/wi
import { PageLayoutWidgetService } from 'src/engine/core-modules/page-layout/services/page-layout-widget.service';
import { injectWidgetConfigurationDiscriminator } from 'src/engine/core-modules/page-layout/utils/inject-widget-configuration-discriminator.util';
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { type WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutWidgetDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@@ -49,6 +51,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async createPageLayoutWidget(
@Args('input') input: CreatePageLayoutWidgetInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -57,6 +60,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async updatePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@Args('input') input: UpdatePageLayoutWidgetInput,
@@ -66,6 +70,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async deletePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -74,6 +79,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => Boolean)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async destroyPageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -82,6 +88,7 @@ export class PageLayoutWidgetResolver {
}
@Mutation(() => PageLayoutWidgetDTO)
@UseGuards(SettingsPermissionsGuard(PermissionFlagType.LAYOUTS))
async restorePageLayoutWidget(
@Args('id', { type: () => String }) id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/page-layout/resolvers/page-layout.resolver.ts
+6 -1
View File
@@ -13,11 +13,16 @@ import { PageLayoutService } from 'src/engine/core-modules/page-layout/services/
import { PageLayoutGraphqlApiExceptionFilter } from 'src/engine/core-modules/page-layout/utils/page-layout-graphql-api-exception.filter';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@Resolver(() => PageLayoutDTO)
@UseFilters(PageLayoutGraphqlApiExceptionFilter)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.LAYOUTS),
)
@UsePipes(ResolverValidationPipe)
export class PageLayoutResolver {
constructor(
packages/twenty-server/src/engine/core-modules/postgres-credentials/postgres-credentials.module.ts
+6 -1
View File
@@ -5,9 +5,14 @@ import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
import { PostgresCredentialsEntity } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.entity';
import { PostgresCredentialsResolver } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.resolver';
import { PostgresCredentialsService } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [JwtModule, TypeOrmModule.forFeature([PostgresCredentialsEntity])],
imports: [
JwtModule,
TypeOrmModule.forFeature([PostgresCredentialsEntity]),
PermissionsModule,
],
providers: [
PostgresCredentialsResolver,
PostgresCredentialsService,
packages/twenty-server/src/engine/core-modules/postgres-credentials/postgres-credentials.resolver.ts
+6 -3
View File
@@ -5,15 +5,20 @@ import { PostgresCredentialsDTO } from 'src/engine/core-modules/postgres-credent
import { PostgresCredentialsService } from 'src/engine/core-modules/postgres-credentials/postgres-credentials.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.DATA_MODEL),
)
@Resolver(() => PostgresCredentialsDTO)
export class PostgresCredentialsResolver {
constructor(
private readonly postgresCredentialsService: PostgresCredentialsService,
) {}
@UseGuards(WorkspaceAuthGuard)
@Mutation(() => PostgresCredentialsDTO)
async enablePostgresProxy(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -21,7 +26,6 @@ export class PostgresCredentialsResolver {
return this.postgresCredentialsService.enablePostgresProxy(workspaceId);
}
@UseGuards(WorkspaceAuthGuard)
@Mutation(() => PostgresCredentialsDTO)
async disablePostgresProxy(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -29,7 +33,6 @@ export class PostgresCredentialsResolver {
return this.postgresCredentialsService.disablePostgresProxy(workspaceId);
}
@UseGuards(WorkspaceAuthGuard)
@Query(() => PostgresCredentialsDTO, { nullable: true })
async getPostgresCredentials(
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
packages/twenty-server/src/engine/core-modules/public-domain/public-domain.module.ts
+2
View File
@@ -9,11 +9,13 @@ import { DnsManagerModule } from 'src/engine/core-modules/dns-manager/dns-manage
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { CheckPublicDomainsValidRecordsCronCommand } from 'src/engine/core-modules/public-domain/crons/commands/check-public-domains-valid-records.cron.command';
import { CheckPublicDomainsValidRecordsCronJob } from 'src/engine/core-modules/public-domain/crons/jobs/check-public-domains-valid-records.cron.job';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
@Module({
imports: [
NestjsQueryTypeOrmModule.forFeature([PublicDomainEntity, WorkspaceEntity]),
DnsManagerModule,
PermissionsModule,
],
exports: [CheckPublicDomainsValidRecordsCronCommand, PublicDomainService],
providers: [
packages/twenty-server/src/engine/core-modules/public-domain/public-domain.resolver.ts
+15 -10
View File
@@ -1,28 +1,33 @@
import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
import { UseFilters, UseGuards, UsePipes } from '@nestjs/common';
import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { assertIsDefinedOrThrow } from 'twenty-shared/utils';
import { Repository } from 'typeorm';
import { DomainValidRecords } from 'src/engine/core-modules/dns-manager/dtos/domain-valid-records';
import { DnsManagerService } from 'src/engine/core-modules/dns-manager/services/dns-manager.service';
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
import { PublicDomainExceptionFilter } from 'src/engine/core-modules/public-domain/public-domain-exception-filter';
import { PublicDomainService } from 'src/engine/core-modules/public-domain/public-domain.service';
import { PublicDomainDTO } from 'src/engine/core-modules/public-domain/dtos/public-domain.dto';
import { PublicDomainInput } from 'src/engine/core-modules/public-domain/dtos/public-domain.input';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { DomainValidRecords } from 'src/engine/core-modules/dns-manager/dtos/domain-valid-records';
import { PublicDomainExceptionFilter } from 'src/engine/core-modules/public-domain/public-domain-exception-filter';
import { PublicDomainEntity } from 'src/engine/core-modules/public-domain/public-domain.entity';
import { DnsManagerService } from 'src/engine/core-modules/dns-manager/services/dns-manager.service';
import {
PublicDomainException,
PublicDomainExceptionCode,
} from 'src/engine/core-modules/public-domain/public-domain.exception';
import { PublicDomainService } from 'src/engine/core-modules/public-domain/public-domain.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE_MEMBERS),
)
@UsePipes(ResolverValidationPipe)
@UseFilters(
PublicDomainExceptionFilter,
packages/twenty-server/src/engine/core-modules/two-factor-authentication/two-factor-authentication.resolver.ts
+6 -4
View File
@@ -17,6 +17,8 @@ import { UserEntity } from 'src/engine/core-modules/user/user.entity';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
@@ -45,7 +47,7 @@ export class TwoFactorAuthenticationResolver {
) {}
@Mutation(() => InitiateTwoFactorAuthenticationProvisioningOutput)
@UseGuards(PublicEndpointGuard)
@UseGuards(PublicEndpointGuard, NoPermissionGuard)
async initiateOTPProvisioning(
@Args()
initiateTwoFactorAuthenticationProvisioningInput: InitiateTwoFactorAuthenticationProvisioningInput,
@@ -97,7 +99,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => InitiateTwoFactorAuthenticationProvisioningOutput)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async initiateOTPProvisioningForAuthenticatedUser(
@AuthUser() user: UserEntity,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -121,7 +123,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => DeleteTwoFactorAuthenticationMethodOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, CustomPermissionGuard)
async deleteTwoFactorAuthenticationMethod(
@Args()
deleteTwoFactorAuthenticationMethodInput: DeleteTwoFactorAuthenticationMethodInput,
@@ -161,7 +163,7 @@ export class TwoFactorAuthenticationResolver {
}
@Mutation(() => VerifyTwoFactorAuthenticationMethodOutput)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
@UseGuards(WorkspaceAuthGuard, UserAuthGuard, NoPermissionGuard)
async verifyTwoFactorAuthenticationMethodForAuthenticatedUser(
@Args()
verifyTwoFactorAuthenticationMethodInput: VerifyTwoFactorAuthenticationMethodInput,
packages/twenty-server/src/engine/core-modules/user/user.resolver.ts
+6 -4
View File
@@ -54,6 +54,8 @@ import { AuthProvider } from 'src/engine/decorators/auth/auth-provider.decorator
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
@@ -124,7 +126,7 @@ export class UserResolver {
}
@Query(() => UserEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async currentUser(
@AuthUser() { id: userId }: UserEntity,
@AuthWorkspace({ allowUndefined: true }) workspace: WorkspaceEntity,
@@ -366,7 +368,7 @@ export class UserResolver {
}
@Mutation(() => SignedFileDTO)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
async uploadProfilePicture(
@AuthUser() { id }: UserEntity,
@AuthWorkspace({ allowUndefined: true })
@@ -398,13 +400,13 @@ export class UserResolver {
}
@Mutation(() => UserEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, NoPermissionGuard)
async deleteUser(@AuthUser() { id: userId }: UserEntity) {
return this.userService.deleteUser(userId);
}
@Mutation(() => UserWorkspaceEntity)
@UseGuards(UserAuthGuard)
@UseGuards(UserAuthGuard, CustomPermissionGuard)
async deleteUserFromWorkspace(
@Args('workspaceMemberIdToDelete') workspaceMemberIdToDelete: string,
@AuthUser() { id: userId }: UserEntity,
packages/twenty-server/src/engine/core-modules/webhook/webhook.module.ts
+2
View File
@@ -5,6 +5,7 @@ import { AuthModule } from 'src/engine/core-modules/auth/auth.module';
import { WebhookEntity } from 'src/engine/core-modules/webhook/webhook.entity';
import { WebhookResolver } from 'src/engine/core-modules/webhook/webhook.resolver';
import { WebhookService } from 'src/engine/core-modules/webhook/webhook.service';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WebhookController } from './controllers/webhook.controller';
@@ -13,6 +14,7 @@ import { WebhookController } from './controllers/webhook.controller';
imports: [
TypeOrmModule.forFeature([WebhookEntity]),
AuthModule,
PermissionsModule,
WorkspaceCacheStorageModule,
],
providers: [WebhookService, WebhookResolver],
packages/twenty-server/src/engine/core-modules/webhook/webhook.resolver.ts
+6 -1
View File
@@ -10,13 +10,18 @@ import { UpdateWebhookInput } from 'src/engine/core-modules/webhook/dtos/update-
import { webhookGraphqlApiExceptionHandler } from 'src/engine/core-modules/webhook/utils/webhook-graphql-api-exception-handler.util';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
import { WebhookEntity } from './webhook.entity';
import { WebhookService } from './webhook.service';
@Resolver(() => WebhookEntity)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.API_KEYS_AND_WEBHOOKS),
)
export class WebhookResolver {
constructor(private readonly webhookService: WebhookService) {}
packages/twenty-server/src/engine/core-modules/workspace/services/workspace.service.ts
+64 -65
View File
@@ -54,6 +54,26 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
private readonly featureLookUpKey = BillingEntitlementKey.CUSTOM_DOMAIN;
protected readonly logger = new Logger(WorkspaceService.name);
private readonly WORKSPACE_FIELD_PERMISSIONS: Record<
string,
PermissionFlagType
> = {
subdomain: PermissionFlagType.WORKSPACE,
customDomain: PermissionFlagType.WORKSPACE,
displayName: PermissionFlagType.WORKSPACE,
logo: PermissionFlagType.WORKSPACE,
trashRetentionDays: PermissionFlagType.WORKSPACE,
inviteHash: PermissionFlagType.WORKSPACE_MEMBERS,
isPublicInviteLinkEnabled: PermissionFlagType.SECURITY,
allowImpersonation: PermissionFlagType.SECURITY,
isGoogleAuthEnabled: PermissionFlagType.SECURITY,
isMicrosoftAuthEnabled: PermissionFlagType.SECURITY,
isPasswordAuthEnabled: PermissionFlagType.SECURITY,
isTwoFactorAuthenticationEnforced: PermissionFlagType.SECURITY,
defaultRoleId: PermissionFlagType.ROLES,
routerModel: PermissionFlagType.WORKSPACE,
};
constructor(
@InjectRepository(WorkspaceEntity)
private readonly workspaceRepository: Repository<WorkspaceEntity>,
@@ -95,14 +115,7 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
assertIsDefinedOrThrow(workspace, WorkspaceNotFoundDefaultError);
await this.validateSecurityPermissions({
payload,
userWorkspaceId,
workspaceId: workspace.id,
apiKey,
});
await this.validateWorkspacePermissions({
await this.validateWorkspaceUpdatePermissions({
payload,
userWorkspaceId,
workspaceId: workspace.id,
@@ -366,48 +379,7 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
}
}
private async validateSecurityPermissions({
payload,
userWorkspaceId,
workspaceId,
apiKey,
}: {
payload: Partial<WorkspaceEntity>;
userWorkspaceId?: string;
workspaceId: string;
apiKey?: string;
}) {
if (
'isGoogleAuthEnabled' in payload ||
'isMicrosoftAuthEnabled' in payload ||
'isPasswordAuthEnabled' in payload ||
'isPublicInviteLinkEnabled' in payload
) {
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
}
const userHasPermission =
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
setting: PermissionFlagType.SECURITY,
workspaceId: workspaceId,
apiKeyId: apiKey,
});
if (!userHasPermission) {
throw new PermissionsException(
PermissionsExceptionMessage.PERMISSION_DENIED,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`You do not have permission to manage security settings. Please contact your workspace administrator.`,
},
);
}
}
}
private async validateWorkspacePermissions({
private async validateWorkspaceUpdatePermissions({
payload,
userWorkspaceId,
workspaceId,
@@ -421,36 +393,63 @@ export class WorkspaceService extends TypeOrmQueryService<WorkspaceEntity> {
workspaceActivationStatus: WorkspaceActivationStatus;
}) {
if (
'displayName' in payload ||
'subdomain' in payload ||
'customDomain' in payload ||
'logo' in payload ||
'trashRetentionDays' in payload
workspaceActivationStatus === WorkspaceActivationStatus.PENDING_CREATION
) {
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
return;
}
const systemFields = new Set(['id', 'createdAt', 'updatedAt', 'deletedAt']);
const fieldsBeingUpdated = Object.keys(payload).filter(
(field) => !systemFields.has(field),
);
if (fieldsBeingUpdated.length === 0) {
return;
}
if (!userWorkspaceId) {
throw new Error('Missing userWorkspaceId in authContext');
}
const fieldsByPermission = new Map<PermissionFlagType, string[]>();
for (const field of fieldsBeingUpdated) {
const requiredPermission = this.WORKSPACE_FIELD_PERMISSIONS[field];
if (!requiredPermission) {
throw new PermissionsException(
`Field "${field}" is not allowed to be updated`,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`The field "${field}" cannot be updated. Please contact your workspace administrator.`,
},
);
}
if (
workspaceActivationStatus === WorkspaceActivationStatus.PENDING_CREATION
) {
return;
if (!fieldsByPermission.has(requiredPermission)) {
fieldsByPermission.set(requiredPermission, []);
}
fieldsByPermission.get(requiredPermission)!.push(field);
}
const userHasPermission =
for (const [permission, fields] of fieldsByPermission.entries()) {
const hasPermission =
await this.permissionsService.userHasWorkspaceSettingPermission({
userWorkspaceId,
workspaceId,
setting: PermissionFlagType.WORKSPACE,
setting: permission,
apiKeyId: apiKey,
});
if (!userHasPermission) {
if (!hasPermission) {
const fieldsList = fields.join(', ');
throw new PermissionsException(
PermissionsExceptionMessage.PERMISSION_DENIED,
PermissionsExceptionCode.PERMISSION_DENIED,
{
userFriendlyMessage: msg`You do not have permission to manage workspace settings. Please contact your workspace administrator.`,
userFriendlyMessage: msg`You do not have permission to update these fields: ${fieldsList}. Please contact your workspace administrator.`,
},
);
}
packages/twenty-server/src/engine/core-modules/workspace/workspace.resolver.ts
+13 -5
View File
@@ -59,6 +59,8 @@ import { AuthApiKey } from 'src/engine/decorators/auth/auth-api-key.decorator';
import { AuthUserWorkspaceId } from 'src/engine/decorators/auth/auth-user-workspace-id.decorator';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { CustomPermissionGuard } from 'src/engine/guards/custom-permission.guard';
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
import { PublicEndpointGuard } from 'src/engine/guards/public-endpoint.guard';
import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
import { UserAuthGuard } from 'src/engine/guards/user-auth.guard';
@@ -112,7 +114,7 @@ export class WorkspaceResolver {
}
@Mutation(() => WorkspaceEntity)
@UseGuards(UserAuthGuard, WorkspaceAuthGuard)
@UseGuards(UserAuthGuard, WorkspaceAuthGuard, NoPermissionGuard)
async activateWorkspace(
@Args('data') data: ActivateWorkspaceInput,
@AuthUser() user: UserEntity,
@@ -122,7 +124,7 @@ export class WorkspaceResolver {
}
@Mutation(() => WorkspaceEntity)
@UseGuards(WorkspaceAuthGuard)
@UseGuards(WorkspaceAuthGuard, CustomPermissionGuard)
async updateWorkspace(
@Args('data') data: UpdateWorkspaceInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -307,8 +309,11 @@ export class WorkspaceResolver {
}
@ResolveField(() => [ViewDTO])
async views(@Parent() workspace: WorkspaceEntity): Promise<ViewDTO[]> {
return this.viewService.findByWorkspaceId(workspace.id);
async views(
@Parent() workspace: WorkspaceEntity,
@AuthUserWorkspaceId() userWorkspaceId: string | undefined,
): Promise<ViewDTO[]> {
return this.viewService.findByWorkspaceId(workspace.id, userWorkspaceId);
}
@Query(() => PublicWorkspaceDataOutput)
@@ -379,7 +384,10 @@ export class WorkspaceResolver {
}
@Mutation(() => DomainValidRecords, { nullable: true })
@UseGuards(WorkspaceAuthGuard)
@UseGuards(
WorkspaceAuthGuard,
SettingsPermissionsGuard(PermissionFlagType.WORKSPACE),
)
async checkCustomDomainValidRecords(
@AuthWorkspace() workspace: WorkspaceEntity,
): Promise<DomainValidRecords | undefined> {