houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance role-check system with stricter checks (#15392)

Browse Source 
## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.
This commit is contained in:
Félix Malfait
2025-11-07 15:37:17 +01:00
committed by GitHub
parent 44d6ec2594
commit cff17db6cb
306 changed files with 13863 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/metadata-modules/view-field/controllers/view-field.controller.ts
+6
View File
@@ -32,6 +32,9 @@ import {
import { ViewFieldRestApiExceptionFilter } from 'src/engine/metadata-modules/view-field/filters/view-field-rest-api-exception.filter';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { CreateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard';
import { DeleteViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard';
import { UpdateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-field-permission.guard';
@Controller('rest/metadata/viewFields')
@UseGuards(WorkspaceAuthGuard)
@@ -81,6 +84,7 @@ export class ViewFieldController {
}
@Patch(':id')
@UseGuards(UpdateViewFieldPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewFieldInput['update'],
@@ -122,6 +126,7 @@ export class ViewFieldController {
}
@Post()
@UseGuards(CreateViewFieldPermissionGuard)
async create(
@Body() input: CreateViewFieldInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -161,6 +166,7 @@ export class ViewFieldController {
}
@Delete(':id')
@UseGuards(DeleteViewFieldPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-field/exceptions/view-field.exception.ts
+4
View File
@@ -17,6 +17,7 @@ export class ViewFieldException extends CustomException {
export enum ViewFieldExceptionCode {
VIEW_FIELD_NOT_FOUND = 'VIEW_FIELD_NOT_FOUND',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
INVALID_VIEW_FIELD_DATA = 'INVALID_VIEW_FIELD_DATA',
}
@@ -24,6 +25,7 @@ export enum ViewFieldExceptionMessageKey {
WORKSPACE_ID_REQUIRED = 'WORKSPACE_ID_REQUIRED',
VIEW_ID_REQUIRED = 'VIEW_ID_REQUIRED',
VIEW_FIELD_NOT_FOUND = 'VIEW_FIELD_NOT_FOUND',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
INVALID_VIEW_FIELD_DATA = 'INVALID_VIEW_FIELD_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_FIELD_ALREADY_EXISTS = 'VIEW_FIELD_ALREADY_EXISTS',
@@ -40,6 +42,8 @@ export const generateViewFieldExceptionMessage = (
return 'ViewId is required';
case ViewFieldExceptionMessageKey.VIEW_FIELD_NOT_FOUND:
return `View field${id ? ` (id: ${id})` : ''} not found`;
case ViewFieldExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
case ViewFieldExceptionMessageKey.INVALID_VIEW_FIELD_DATA:
return `Invalid view field data${id ? ` for view field id: ${id}` : ''}`;
case ViewFieldExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
packages/twenty-server/src/engine/metadata-modules/view-field/resolvers/view-field.resolver.ts
+11 -11
View File
@@ -18,6 +18,10 @@ import {
} from 'src/engine/metadata-modules/view-field/exceptions/view-field.exception';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { CreateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard';
import { DeleteViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard';
import { DestroyViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-field-permission.guard';
import { UpdateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-field-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewFieldDTO)
@@ -47,6 +51,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(UpdateViewFieldPermissionGuard)
async updateCoreViewField(
@Args('input') updateViewFieldInput: UpdateViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -72,6 +77,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(CreateViewFieldPermissionGuard)
async createCoreViewField(
@Args('input') createViewFieldInput: CreateViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -96,6 +102,7 @@ export class ViewFieldResolver {
}
@Mutation(() => [ViewFieldDTO])
@UseGuards(CreateViewFieldPermissionGuard)
async createManyCoreViewFields(
@Args('inputs', { type: () => [CreateViewFieldInput] })
createViewFieldInputs: CreateViewFieldInput[],
@@ -121,6 +128,7 @@ export class ViewFieldResolver {
}
@Mutation(() => ViewFieldDTO)
@UseGuards(DeleteViewFieldPermissionGuard)
async deleteCoreViewField(
@Args('input') deleteViewFieldInput: DeleteViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -137,15 +145,12 @@ export class ViewFieldResolver {
workspaceId,
});
}
const deletedViewField = await this.viewFieldService.delete(
deleteViewFieldInput.id,
workspaceId,
);
return deletedViewField;
return this.viewFieldService.delete(deleteViewFieldInput.id, workspaceId);
}
@Mutation(() => ViewFieldDTO)
@UseGuards(DestroyViewFieldPermissionGuard)
async destroyCoreViewField(
@Args('input') destroyViewFieldInput: DestroyViewFieldInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -163,11 +168,6 @@ export class ViewFieldResolver {
});
}
const deletedViewField = await this.viewFieldService.destroy(
destroyViewFieldInput.id,
workspaceId,
);
return deletedViewField;
return this.viewFieldService.destroy(destroyViewFieldInput.id, workspaceId);
}
}
packages/twenty-server/src/engine/metadata-modules/view-field/services/tests/view-field.service.spec.ts
+8 -2
View File
@@ -513,12 +513,18 @@ describe('ViewFieldService', () => {
const id = 'view-field-id';
const workspaceId = 'workspace-id';
jest.spyOn(viewFieldService, 'findById').mockResolvedValue(mockViewField);
jest
.spyOn(viewFieldRepository, 'findOne')
.mockResolvedValue(mockViewField);
jest.spyOn(viewFieldRepository, 'delete').mockResolvedValue({} as any);
const result = await viewFieldService.destroy(id, workspaceId);
expect(viewFieldService.findById).toHaveBeenCalledWith(id, workspaceId);
expect(viewFieldRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: ['workspace', 'view'],
withDeleted: true,
});
expect(viewFieldRepository.delete).toHaveBeenCalledWith(id);
expect(result).toBeDefined();
});
packages/twenty-server/src/engine/metadata-modules/view-field/services/view-field.service.ts
+9 -1
View File
@@ -205,6 +205,7 @@ export class ViewFieldService {
ViewFieldExceptionCode.VIEW_FIELD_NOT_FOUND,
);
}
const viewId = existingViewField.viewId;
if (this.updatesPosition(updateData)) {
@@ -257,7 +258,14 @@ export class ViewFieldService {
}
async destroy(id: string, workspaceId: string): Promise<ViewFieldEntity> {
const viewField = await this.findById(id, workspaceId);
const viewField = await this.viewFieldRepository.findOne({
where: {
id,
workspaceId,
},
relations: ['workspace', 'view'],
withDeleted: true,
});
if (!isDefined(viewField)) {
throw new ViewFieldException(
packages/twenty-server/src/engine/metadata-modules/view-field/view-field.module.ts
+4
View File
@@ -3,11 +3,13 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewFieldController } from 'src/engine/metadata-modules/view-field/controllers/view-field.controller';
import { ViewFieldEntity } from 'src/engine/metadata-modules/view-field/entities/view-field.entity';
import { ViewFieldResolver } from 'src/engine/metadata-modules/view-field/resolvers/view-field.resolver';
import { ViewFieldV2Service } from 'src/engine/metadata-modules/view-field/services/view-field-v2.service';
import { ViewFieldService } from 'src/engine/metadata-modules/view-field/services/view-field.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@@ -17,8 +19,10 @@ import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspa
TypeOrmModule.forFeature([ViewFieldEntity, ViewEntity]),
WorkspaceCacheStorageModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceMigrationV2Module,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
ViewPermissionsModule,
],
controllers: [ViewFieldController],
providers: [ViewFieldService, ViewFieldResolver, ViewFieldV2Service],