Enhance role-check system with stricter checks (#15392)

## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
2025-11-07 15:37:17 +01:00
parent 44d6ec2594
commit cff17db6cb
306 changed files with 13863 additions and 976 deletions
@@ -0,0 +1,101 @@
+import {
+  ForbiddenError,
+  NotFoundError,
+  UserInputError,
+} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';
+import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
+
+describe('permissionGraphqlApiExceptionHandler', () => {
+  it('should throw ForbiddenError for PERMISSION_DENIED', () => {
+    const exception = new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      ForbiddenError,
+    );
+  });
+
+  it('should throw ForbiddenError for role-related forbidden cases', () => {
+    const exception = new PermissionsException(
+      'Cannot update self',
+      PermissionsExceptionCode.CANNOT_UPDATE_SELF_ROLE,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      ForbiddenError,
+    );
+  });
+
+  it('should throw UserInputError for INVALID_ARG', () => {
+    const exception = new PermissionsException(
+      'Invalid argument',
+      PermissionsExceptionCode.INVALID_ARG,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      UserInputError,
+    );
+  });
+
+  it('should throw UserInputError for permission validation errors', () => {
+    const exception = new PermissionsException(
+      'Empty field permission',
+      PermissionsExceptionCode.EMPTY_FIELD_PERMISSION_NOT_ALLOWED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      UserInputError,
+    );
+  });
+
+  it('should throw NotFoundError for ROLE_NOT_FOUND', () => {
+    const exception = new PermissionsException(
+      'Role not found',
+      PermissionsExceptionCode.ROLE_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      NotFoundError,
+    );
+  });
+
+  it('should throw NotFoundError for metadata not found cases', () => {
+    const exception = new PermissionsException(
+      'Object metadata not found',
+      PermissionsExceptionCode.OBJECT_METADATA_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      NotFoundError,
+    );
+  });
+
+  it('should rethrow exception for METHOD_NOT_ALLOWED', () => {
+    const exception = new PermissionsException(
+      'Method not allowed',
+      PermissionsExceptionCode.METHOD_NOT_ALLOWED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      exception,
+    );
+  });
+
+  it('should rethrow exception for internal error codes', () => {
+    const exception = new PermissionsException(
+      'Default role not found',
+      PermissionsExceptionCode.DEFAULT_ROLE_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      exception,
+    );
+  });
+});