Enhance role-check system with stricter checks (#15392)
## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
This commit is contained in:
Félix Malfait
+111
@@ -0,0 +1,111 @@
|
||||
import { Module } from '@nestjs/common';
|
||||
import { TypeOrmModule } from '@nestjs/typeorm';
|
||||
|
||||
import { I18nModule } from 'src/engine/core-modules/i18n/i18n.module';
|
||||
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
|
||||
import { ViewFieldEntity } from 'src/engine/metadata-modules/view-field/entities/view-field.entity';
|
||||
import { ViewFilterGroupEntity } from 'src/engine/metadata-modules/view-filter-group/entities/view-filter-group.entity';
|
||||
import { ViewFilterEntity } from 'src/engine/metadata-modules/view-filter/entities/view-filter.entity';
|
||||
import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
|
||||
import { CreateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-field-permission.guard';
|
||||
import { CreateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-group-permission.guard';
|
||||
import { CreateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-filter-permission.guard';
|
||||
import { CreateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-group-permission.guard';
|
||||
import { CreateViewSortPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/create-view-sort-permission.guard';
|
||||
import { DeleteViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-field-permission.guard';
|
||||
import { DeleteViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-group-permission.guard';
|
||||
import { DeleteViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-filter-permission.guard';
|
||||
import { DeleteViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-group-permission.guard';
|
||||
import { DeleteViewPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-permission.guard';
|
||||
import { DeleteViewSortPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/delete-view-sort-permission.guard';
|
||||
import { DestroyViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-field-permission.guard';
|
||||
import { DestroyViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-filter-group-permission.guard';
|
||||
import { DestroyViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-filter-permission.guard';
|
||||
import { DestroyViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-group-permission.guard';
|
||||
import { DestroyViewPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-permission.guard';
|
||||
import { DestroyViewSortPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/destroy-view-sort-permission.guard';
|
||||
import { UpdateViewFieldPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-field-permission.guard';
|
||||
import { UpdateViewFilterGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-group-permission.guard';
|
||||
import { UpdateViewFilterPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-filter-permission.guard';
|
||||
import { UpdateViewGroupPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-group-permission.guard';
|
||||
import { UpdateViewPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-permission.guard';
|
||||
import { UpdateViewSortPermissionGuard } from 'src/engine/metadata-modules/view-permissions/guards/update-view-sort-permission.guard';
|
||||
import { ViewAccessService } from 'src/engine/metadata-modules/view-permissions/services/view-access.service';
|
||||
import { ViewEntityLookupService } from 'src/engine/metadata-modules/view-permissions/services/view-entity-lookup.service';
|
||||
import { ViewSortEntity } from 'src/engine/metadata-modules/view-sort/entities/view-sort.entity';
|
||||
import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
|
||||
import { ViewService } from 'src/engine/metadata-modules/view/services/view.service';
|
||||
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
|
||||
|
||||
@Module({
|
||||
imports: [
|
||||
TypeOrmModule.forFeature([
|
||||
ViewEntity,
|
||||
ViewFieldEntity,
|
||||
ViewFilterEntity,
|
||||
ViewFilterGroupEntity,
|
||||
ViewGroupEntity,
|
||||
ViewSortEntity,
|
||||
]),
|
||||
I18nModule,
|
||||
PermissionsModule,
|
||||
WorkspaceCacheStorageModule,
|
||||
],
|
||||
providers: [
|
||||
ViewService,
|
||||
ViewEntityLookupService,
|
||||
ViewAccessService,
|
||||
UpdateViewPermissionGuard,
|
||||
DeleteViewPermissionGuard,
|
||||
DestroyViewPermissionGuard,
|
||||
CreateViewFieldPermissionGuard,
|
||||
UpdateViewFieldPermissionGuard,
|
||||
DeleteViewFieldPermissionGuard,
|
||||
DestroyViewFieldPermissionGuard,
|
||||
CreateViewFilterPermissionGuard,
|
||||
UpdateViewFilterPermissionGuard,
|
||||
DeleteViewFilterPermissionGuard,
|
||||
DestroyViewFilterPermissionGuard,
|
||||
CreateViewFilterGroupPermissionGuard,
|
||||
UpdateViewFilterGroupPermissionGuard,
|
||||
DeleteViewFilterGroupPermissionGuard,
|
||||
DestroyViewFilterGroupPermissionGuard,
|
||||
CreateViewGroupPermissionGuard,
|
||||
UpdateViewGroupPermissionGuard,
|
||||
DeleteViewGroupPermissionGuard,
|
||||
DestroyViewGroupPermissionGuard,
|
||||
CreateViewSortPermissionGuard,
|
||||
UpdateViewSortPermissionGuard,
|
||||
DeleteViewSortPermissionGuard,
|
||||
DestroyViewSortPermissionGuard,
|
||||
],
|
||||
exports: [
|
||||
ViewService,
|
||||
ViewEntityLookupService,
|
||||
ViewAccessService,
|
||||
UpdateViewPermissionGuard,
|
||||
DeleteViewPermissionGuard,
|
||||
DestroyViewPermissionGuard,
|
||||
CreateViewFieldPermissionGuard,
|
||||
UpdateViewFieldPermissionGuard,
|
||||
DeleteViewFieldPermissionGuard,
|
||||
DestroyViewFieldPermissionGuard,
|
||||
CreateViewFilterPermissionGuard,
|
||||
UpdateViewFilterPermissionGuard,
|
||||
DeleteViewFilterPermissionGuard,
|
||||
DestroyViewFilterPermissionGuard,
|
||||
CreateViewFilterGroupPermissionGuard,
|
||||
UpdateViewFilterGroupPermissionGuard,
|
||||
DeleteViewFilterGroupPermissionGuard,
|
||||
DestroyViewFilterGroupPermissionGuard,
|
||||
CreateViewGroupPermissionGuard,
|
||||
UpdateViewGroupPermissionGuard,
|
||||
DeleteViewGroupPermissionGuard,
|
||||
DestroyViewGroupPermissionGuard,
|
||||
CreateViewSortPermissionGuard,
|
||||
UpdateViewSortPermissionGuard,
|
||||
DeleteViewSortPermissionGuard,
|
||||
DestroyViewSortPermissionGuard,
|
||||
],
|
||||
})
|
||||
export class ViewPermissionsModule {}
|
||||
Reference in New Issue
Block a user