houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Enhance role-check system with stricter checks (#15392)

Browse Source 
## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.
This commit is contained in:
Félix Malfait
2025-11-07 15:37:17 +01:00
committed by GitHub
parent 44d6ec2594
commit cff17db6cb
306 changed files with 13863 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/metadata-modules/view-group/controllers/view-group.controller.ts
+6
View File
@@ -31,6 +31,9 @@ import {
import { ViewGroupRestApiExceptionFilter } from 'src/engine/metadata-modules/view-group/filters/view-group-rest-api-exception.filter';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { CreateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard';
import { DeleteViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard';
import { UpdateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-group-permission.guard';
@Controller('rest/metadata/viewGroups')
@UseGuards(WorkspaceAuthGuard)
@@ -80,6 +83,7 @@ export class ViewGroupController {
}
@Post()
@UseGuards(CreateViewGroupPermissionGuard)
async create(
@Body() input: CreateViewGroupInput,
@AuthWorkspace() workspace: WorkspaceEntity,
@@ -104,6 +108,7 @@ export class ViewGroupController {
}
@Patch(':id')
@UseGuards(UpdateViewGroupPermissionGuard)
async update(
@Param('id') id: string,
@Body() input: UpdateViewGroupInput,
@@ -137,6 +142,7 @@ export class ViewGroupController {
}
@Delete(':id')
@UseGuards(DeleteViewGroupPermissionGuard)
async delete(
@Param('id') id: string,
@AuthWorkspace() workspace: WorkspaceEntity,
packages/twenty-server/src/engine/metadata-modules/view-group/dtos/inputs/update-view-group.input.ts
+1 -1
View File
@@ -1,5 +1,6 @@
import { Field, InputType } from '@nestjs/graphql';
import { Type } from 'class-transformer';
import {
IsBoolean,
IsNotEmpty,
@@ -9,7 +10,6 @@ import {
IsUUID,
ValidateNested,
} from 'class-validator';
import { Type } from 'class-transformer';
import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
packages/twenty-server/src/engine/metadata-modules/view-group/exceptions/view-group.exception.ts
+6 -4
View File
@@ -1,5 +1,6 @@
import { type MessageDescriptor } from '@lingui/core';
import { msg } from '@lingui/core/macro';
import { assertUnreachable } from 'twenty-shared/utils';
import { CustomException } from 'src/utils/custom-exception';
@@ -17,6 +18,7 @@ export class ViewGroupException extends CustomException {
export enum ViewGroupExceptionCode {
VIEW_GROUP_NOT_FOUND = 'VIEW_GROUP_NOT_FOUND',
INVALID_VIEW_GROUP_DATA = 'INVALID_VIEW_GROUP_DATA',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export enum ViewGroupExceptionMessageKey {
@@ -25,6 +27,7 @@ export enum ViewGroupExceptionMessageKey {
VIEW_GROUP_NOT_FOUND = 'VIEW_GROUP_NOT_FOUND',
INVALID_VIEW_GROUP_DATA = 'INVALID_VIEW_GROUP_DATA',
FIELD_METADATA_ID_REQUIRED = 'FIELD_METADATA_ID_REQUIRED',
VIEW_NOT_FOUND = 'VIEW_NOT_FOUND',
}
export const generateViewGroupExceptionMessage = (
@@ -42,8 +45,10 @@ export const generateViewGroupExceptionMessage = (
return `Invalid view group data${id ? ` for view group id: ${id}` : ''}`;
case ViewGroupExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return 'FieldMetadataId is required';
case ViewGroupExceptionMessageKey.VIEW_NOT_FOUND:
return `View${id ? ` (id: ${id})` : ''} not found`;
default:
return 'unknown';
assertUnreachable(key);
}
};
@@ -57,8 +62,5 @@ export const generateViewGroupUserFriendlyExceptionMessage = (
return msg`ViewId is required to create a view group.`;
case ViewGroupExceptionMessageKey.FIELD_METADATA_ID_REQUIRED:
return msg`FieldMetadataId is required to create a view group.`;
default: {
return msg`unknown`;
}
}
};
packages/twenty-server/src/engine/metadata-modules/view-group/resolvers/view-group.resolver.ts
+12 -15
View File
@@ -17,6 +17,10 @@ import {
} from 'src/engine/metadata-modules/view-group/exceptions/view-group.exception';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { CreateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard';
import { DeleteViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard';
import { DestroyViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-group-permission.guard';
import { UpdateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-group-permission.guard';
import { ViewGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/view/utils/view-graphql-api-exception.filter';
@Resolver(() => ViewGroupDTO)
@@ -51,6 +55,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(CreateViewGroupPermissionGuard)
async createCoreViewGroup(
@Args('input') createViewGroupInput: CreateViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -75,6 +80,7 @@ export class ViewGroupResolver {
}
@Mutation(() => [ViewGroupDTO])
@UseGuards(CreateViewGroupPermissionGuard)
async createManyCoreViewGroups(
@Args('inputs', { type: () => [CreateViewGroupInput] })
createViewGroupInputs: CreateViewGroupInput[],
@@ -100,6 +106,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(UpdateViewGroupPermissionGuard)
async updateCoreViewGroup(
@Args('input') updateViewGroupInput: UpdateViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -125,6 +132,7 @@ export class ViewGroupResolver {
}
@Mutation(() => ViewGroupDTO)
@UseGuards(DeleteViewGroupPermissionGuard)
async deleteCoreViewGroup(
@Args('input') deleteViewGroupInput: DeleteViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -142,15 +150,11 @@ export class ViewGroupResolver {
});
}
const deletedViewGroup = await this.viewGroupService.delete(
deleteViewGroupInput.id,
workspaceId,
);
return deletedViewGroup;
return this.viewGroupService.delete(deleteViewGroupInput.id, workspaceId);
}
@Mutation(() => ViewGroupDTO)
@UseGuards(DestroyViewGroupPermissionGuard)
async destroyCoreViewGroup(
@Args('input') destroyViewGroupInput: DestroyViewGroupInput,
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
@@ -162,19 +166,12 @@ export class ViewGroupResolver {
);
if (isWorkspaceMigrationV2Enabled) {
const destroyedViewGroup = await this.viewGroupV2Service.destroyOne({
return await this.viewGroupV2Service.destroyOne({
destroyViewGroupInput,
workspaceId,
});
return destroyedViewGroup;
}
const destroyedViewGroup = await this.viewGroupService.destroy(
destroyViewGroupInput.id,
workspaceId,
);
return destroyedViewGroup;
return this.viewGroupService.destroy(destroyViewGroupInput.id, workspaceId);
}
}
packages/twenty-server/src/engine/metadata-modules/view-group/services/tests/view-group.service.spec.ts
+8 -2
View File
@@ -308,12 +308,18 @@ describe('ViewGroupService', () => {
const id = 'view-group-id';
const workspaceId = 'workspace-id';
jest.spyOn(viewGroupService, 'findById').mockResolvedValue(mockViewGroup);
jest
.spyOn(viewGroupRepository, 'findOne')
.mockResolvedValue(mockViewGroup);
jest.spyOn(viewGroupRepository, 'delete').mockResolvedValue({} as any);
const result = await viewGroupService.destroy(id, workspaceId);
expect(viewGroupService.findById).toHaveBeenCalledWith(id, workspaceId);
expect(viewGroupRepository.findOne).toHaveBeenCalledWith({
where: { id, workspaceId },
relations: ['workspace', 'view'],
withDeleted: true,
});
expect(viewGroupRepository.delete).toHaveBeenCalledWith(id);
expect(result).toEqual(mockViewGroup);
});
packages/twenty-server/src/engine/metadata-modules/view-group/services/view-group.service.ts
+8 -1
View File
@@ -169,7 +169,14 @@ export class ViewGroupService {
}
async destroy(id: string, workspaceId: string): Promise<ViewGroupEntity> {
const viewGroup = await this.findById(id, workspaceId);
const viewGroup = await this.viewGroupRepository.findOne({
where: {
id,
workspaceId,
},
relations: ['workspace', 'view'],
withDeleted: true,
});
if (!isDefined(viewGroup)) {
throw new ViewGroupException(
packages/twenty-server/src/engine/metadata-modules/view-group/view-group.module.ts
+6 -1
View File
@@ -3,21 +3,26 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
import { ViewGroupController } from 'src/engine/metadata-modules/view-group/controllers/view-group.controller';
import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
import { ViewGroupResolver } from 'src/engine/metadata-modules/view-group/resolvers/view-group.resolver';
import { ViewGroupV2Service } from 'src/engine/metadata-modules/view-group/services/view-group-v2.service';
import { ViewGroupService } from 'src/engine/metadata-modules/view-group/services/view-group.service';
import { ViewPermissionsModule } from 'src/engine/metadata-modules/view-permissions/view-permissions.module';
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
@Module({
imports: [
TypeOrmModule.forFeature([ViewGroupEntity]),
TypeOrmModule.forFeature([ViewGroupEntity, ViewEntity]),
WorkspaceCacheStorageModule,
FeatureFlagModule,
PermissionsModule,
WorkspaceMigrationV2Module,
WorkspaceManyOrAllFlatEntityMapsCacheModule,
ViewPermissionsModule,
],
controllers: [ViewGroupController],
providers: [ViewGroupService, ViewGroupV2Service, ViewGroupResolver],