[permissions] QA fixes (#13698)

In this PR - Introduction of readableFields and updatableFields in objectMetadataItem selector to ease filtering from a developer experience perspective ( + to help developers think to do it). In discussion @lucasbordeau @charlesBochet - Remove non-updatable field from CSV import process (@etiennejouan) - QA fix / Non-readable fields should not show on show page - QA fix / It should not be offered to create a kanban view on a non-readable field - QA fix / It should not be offered to create view groups on a non-readable field - QA fix / Rating field should have a readonly mode --------- Co-authored-by: Charles Bochet <charles@twenty.com>
2025-08-07 18:21:59 +02:00
parent 258f21a4be
commit ee19ee5119
120 changed files with 1211 additions and 943 deletions
@@ -1,6 +1,6 @@
 import { Entity } from '@microsoft/microsoft-graph-types';
 import { isDefined } from 'class-validator';
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import {
  DataSource,
  DataSourceOptions,
@@ -34,7 +34,7 @@ export class WorkspaceDataSource extends DataSource {
  featureFlagMapVersion: string;
  featureFlagMap: FeatureFlagMap;
  rolesPermissionsVersion: string;
-  permissionsPerRoleId: ObjectRecordsPermissionsByRoleId;
+  permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated;
  dataSourceWithOverridenCreateQueryBuilder: WorkspaceDataSource;

  constructor(
@@ -43,7 +43,7 @@ export class WorkspaceDataSource extends DataSource {
    featureFlagMapVersion: string,
    featureFlagMap: FeatureFlagMap,
    rolesPermissionsVersion: string,
-    permissionsPerRoleId: ObjectRecordsPermissionsByRoleId,
+    permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated,
  ) {
    super(options);
    this.internalContext = internalContext;
@@ -235,7 +235,9 @@ export class WorkspaceDataSource extends DataSource {
    this.rolesPermissionsVersion = rolesPermissionsVersion;
  }

-  setRolesPermissions(permissionsPerRoleId: ObjectRecordsPermissionsByRoleId) {
+  setRolesPermissions(
+    permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated,
+  ) {
    this.permissionsPerRoleId = permissionsPerRoleId;
  }

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { EntityManager } from 'typeorm';
 import { EntityPersistExecutor } from 'typeorm/persistence/EntityPersistExecutor';
 import { PlainObjectToDatabaseEntityTransformer } from 'typeorm/query-builder/transformer/PlainObjectToDatabaseEntityTransformer';
@@ -75,7 +75,7 @@ describe('WorkspaceEntityManager', () => {
  let mockDataSource: WorkspaceDataSource;
  let mockPermissionOptions: {
    shouldBypassPermissionChecks: boolean;
-    objectRecordsPermissions?: ObjectRecordsPermissions;
+    objectRecordsPermissions?: ObjectsPermissionsDeprecated;
  };

  beforeEach(() => {
@@ -331,8 +331,7 @@ describe('WorkspaceEntityManager', () => {
        isFieldPermissionsEnabled: true,
        operationType: 'update',
        objectMetadataMaps: mockInternalContext.objectMetadataMaps,
-        objectRecordsPermissions:
-          mockPermissionOptions.objectRecordsPermissions,
+        objectsPermissions: mockPermissionOptions.objectRecordsPermissions,
        selectedColumns: [],
        allFieldsSelected: false,
        updatedColumns: [],
@@ -366,8 +365,7 @@ describe('WorkspaceEntityManager', () => {
        operationType: 'delete',
        isFieldPermissionsEnabled: true,
        objectMetadataMaps: mockInternalContext.objectMetadataMaps,
-        objectRecordsPermissions:
-          mockPermissionOptions.objectRecordsPermissions,
+        objectsPermissions: mockPermissionOptions.objectRecordsPermissions,
        selectedColumns: [],
        allFieldsSelected: false,
        updatedColumns: [],
@@ -1,5 +1,5 @@
 import isEmpty from 'lodash.isempty';
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
  DeleteResult,
@@ -58,7 +58,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g

 type PermissionOptions = {
  shouldBypassPermissionChecks?: boolean;
-  objectRecordsPermissions?: ObjectRecordsPermissions;
+  objectRecordsPermissions?: ObjectsPermissionsDeprecated;
 };

 export class WorkspaceEntityManager extends EntityManager {
@@ -130,7 +130,7 @@ export class WorkspaceEntityManager extends EntityManager {
    queryRunner?: QueryRunner,
    options: {
      shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
    } = {
      shouldBypassPermissionChecks: false,
      objectRecordsPermissions: {},
@@ -198,7 +198,7 @@ export class WorkspaceEntityManager extends EntityManager {
    conflictPathsOrOptions: string[] | UpsertOptions<Entity>,
    permissionOptions?: {
      shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
    },
    selectedColumns: string[] | '*' = '*',
  ): Promise<InsertResult> {
@@ -387,7 +387,7 @@ export class WorkspaceEntityManager extends EntityManager {
    operationType: OperationType;
    permissionOptions?: {
      shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
    };
    selectedColumns: string[];
    updatedColumns?: string[];
@@ -404,8 +404,7 @@ export class WorkspaceEntityManager extends EntityManager {
    validateOperationIsPermittedOrThrow({
      entityName,
      operationType,
-      objectRecordsPermissions:
-        permissionOptions?.objectRecordsPermissions ?? {},
+      objectsPermissions: permissionOptions?.objectRecordsPermissions ?? {},
      objectMetadataMaps: this.internalContext.objectMetadataMaps,
      selectedColumns,
      allFieldsSelected: false,
@@ -1,7 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';

-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { EntitySchema, Repository } from 'typeorm';

@@ -256,8 +256,11 @@ export class WorkspaceDatasourceFactory {
    workspaceId,
  }: {
    workspaceId: string;
-  }): Promise<CacheResult<string, ObjectRecordsPermissionsByRoleId>> {
-    return getFromCacheWithRecompute<string, ObjectRecordsPermissionsByRoleId>({
+  }): Promise<CacheResult<string, ObjectsPermissionsByRoleIdDeprecated>> {
+    return getFromCacheWithRecompute<
+      string,
+      ObjectsPermissionsByRoleIdDeprecated
+    >({
      workspaceId,
      getCacheData: () =>
        this.workspacePermissionsCacheStorageService.getRolesPermissions(
@@ -310,7 +313,7 @@ export class WorkspaceDatasourceFactory {
  }: {
    workspaceDataSource: WorkspaceDataSource;
    cachedRolesPermissionsVersion: string;
-    cachedRolesPermissions: ObjectRecordsPermissionsByRoleId;
+    cachedRolesPermissions: ObjectsPermissionsByRoleIdDeprecated;
  }): Promise<void> {
    this.updateWorkspaceDataSourceIfNeeded({
      workspaceDataSource,
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
  DeepPartial,
  FindManyOptions,
@@ -20,7 +20,7 @@ describe('WorkspaceRepository', () => {
  let mockEntityManager: jest.Mocked<WorkspaceEntityManager>;
  let mockInternalContext: WorkspaceInternalContext;
  let mockFeatureFlagMap: FeatureFlagMap;
-  let mockObjectRecordsPermissions: ObjectRecordsPermissions;
+  let mockObjectRecordsPermissions: ObjectsPermissionsDeprecated;
  let mockQueryRunner: QueryRunner;

  beforeEach(() => {
@@ -1,8 +1,8 @@
 import { isNonEmptyString } from '@sniptt/guards';
 import isEmpty from 'lodash.isempty';
 import {
-  ObjectRecordsPermissions,
-  RestrictedFields,
+  ObjectsPermissionsDeprecated,
+  RestrictedFieldsPermissions,
 } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { QueryExpressionMap } from 'typeorm/query-builder/QueryExpressionMap';
@@ -35,25 +35,27 @@ export type OperationType =
  | 'restore'
  | 'soft-delete';

-export const validateOperationIsPermittedOrThrow = ({
-  entityName,
-  operationType,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  selectedColumns,
-  isFieldPermissionsEnabled,
-  allFieldsSelected,
-  updatedColumns,
-}: {
+type ValidateOperationIsPermittedOrThrowArgs = {
  entityName: string;
  operationType: OperationType;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
  objectMetadataMaps: ObjectMetadataMaps;
  selectedColumns: string[] | '*';
  isFieldPermissionsEnabled?: boolean;
  allFieldsSelected: boolean;
  updatedColumns: string[];
-}) => {
+};
+
+export const validateOperationIsPermittedOrThrow = ({
+  entityName,
+  operationType,
+  objectsPermissions,
+  objectMetadataMaps,
+  selectedColumns,
+  isFieldPermissionsEnabled,
+  allFieldsSelected,
+  updatedColumns,
+}: ValidateOperationIsPermittedOrThrowArgs) => {
  const objectMetadataIdForEntity =
    objectMetadataMaps.idByNameSingular[entityName];

@@ -83,8 +85,7 @@ export const validateOperationIsPermittedOrThrow = ({
    ? getColumnNameToFieldMetadataIdMap(objectMetadata)
    : {};

-  const permissionsForEntity =
-    objectRecordsPermissions[objectMetadataIdForEntity];
+  const permissionsForEntity = objectsPermissions[objectMetadataIdForEntity];

  switch (operationType) {
    case 'select':
@@ -174,19 +175,21 @@ export const validateOperationIsPermittedOrThrow = ({
  }
 };

-export const validateQueryIsPermittedOrThrow = ({
-  expressionMap,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  shouldBypassPermissionChecks,
-  isFieldPermissionsEnabled,
-}: {
+type ValidateQueryIsPermittedOrThrowArgs = {
  expressionMap: QueryExpressionMap;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
  objectMetadataMaps: ObjectMetadataMaps;
  shouldBypassPermissionChecks: boolean;
  isFieldPermissionsEnabled?: boolean;
-}) => {
+};
+
+export const validateQueryIsPermittedOrThrow = ({
+  expressionMap,
+  objectsPermissions,
+  objectMetadataMaps,
+  shouldBypassPermissionChecks,
+  isFieldPermissionsEnabled,
+}: ValidateQueryIsPermittedOrThrowArgs) => {
  if (shouldBypassPermissionChecks) {
    return;
  }
@@ -232,7 +235,7 @@ export const validateQueryIsPermittedOrThrow = ({
  validateOperationIsPermittedOrThrow({
    entityName: mainEntity,
    operationType: operationType as OperationType,
-    objectRecordsPermissions,
+    objectsPermissions,
    objectMetadataMaps,
    selectedColumns,
    isFieldPermissionsEnabled,
@@ -247,7 +250,7 @@ const validateReadFieldPermissionOrThrow = ({
  columnNameToFieldMetadataIdMap,
  allFieldsSelected,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
  selectedColumns: string[] | '*';
  columnNameToFieldMetadataIdMap: Record<string, string>;
  allFieldsSelected?: boolean;
@@ -290,7 +293,7 @@ const validateUpdateFieldPermissionOrThrow = ({
  updatedColumns,
  columnNameToFieldMetadataIdMap,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
  updatedColumns: string[];
  columnNameToFieldMetadataIdMap: Record<string, string>;
 }) => {
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
  DeleteQueryBuilder,
  DeleteResult,
@@ -29,14 +29,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceDeleteQueryBuilder<
  T extends ObjectLiteral,
 > extends DeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
  private shouldBypassPermissionChecks: boolean;
  private internalContext: WorkspaceInternalContext;
  private authContext?: AuthContext;
  private featureFlagMap?: FeatureFlagMap;
  constructor(
    queryBuilder: DeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
    internalContext: WorkspaceInternalContext,
    shouldBypassPermissionChecks: boolean,
    authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceDeleteQueryBuilder<
    try {
      validateQueryIsPermittedOrThrow({
        expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
        objectMetadataMaps: this.internalContext.objectMetadataMaps,
        shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
        isFieldPermissionsEnabled:
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
  EntityTarget,
@@ -35,7 +35,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceInsertQueryBuilder<
  T extends ObjectLiteral,
 > extends InsertQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
  private shouldBypassPermissionChecks: boolean;
  private internalContext: WorkspaceInternalContext;
  private authContext?: AuthContext;
@@ -47,7 +47,7 @@ export class WorkspaceInsertQueryBuilder<

  constructor(
    queryBuilder: InsertQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
    internalContext: WorkspaceInternalContext,
    shouldBypassPermissionChecks: boolean,
    authContext?: AuthContext,
@@ -104,7 +104,7 @@ export class WorkspaceInsertQueryBuilder<
    try {
      validateQueryIsPermittedOrThrow({
        expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
        objectMetadataMaps: this.internalContext.objectMetadataMaps,
        shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
        isFieldPermissionsEnabled:
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { EntityTarget, ObjectLiteral, SelectQueryBuilder } from 'typeorm';
 import { QueryDeepPartialEntity } from 'typeorm/query-builder/QueryPartialEntity';

@@ -27,14 +27,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSelectQueryBuilder<
  T extends ObjectLiteral,
 > extends SelectQueryBuilder<T> {
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectRecordsPermissions: ObjectsPermissionsDeprecated;
  shouldBypassPermissionChecks: boolean;
  internalContext: WorkspaceInternalContext;
  authContext?: AuthContext;
  featureFlagMap?: FeatureFlagMap;
  constructor(
    queryBuilder: SelectQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
    internalContext: WorkspaceInternalContext,
    shouldBypassPermissionChecks: boolean,
    authContext?: AuthContext,
@@ -322,7 +322,7 @@ export class WorkspaceSelectQueryBuilder<

    validateQueryIsPermittedOrThrow({
      expressionMap: this.expressionMap,
-      objectRecordsPermissions: this.objectRecordsPermissions,
+      objectsPermissions: this.objectRecordsPermissions,
      objectMetadataMaps: this.internalContext.objectMetadataMaps,
      shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
      isFieldPermissionsEnabled,
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
  EntityTarget,
  InsertQueryBuilder,
@@ -28,7 +28,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSoftDeleteQueryBuilder<
  T extends ObjectLiteral,
 > extends SoftDeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
  private shouldBypassPermissionChecks: boolean;
  private internalContext: WorkspaceInternalContext;
  private authContext?: AuthContext;
@@ -36,7 +36,7 @@ export class WorkspaceSoftDeleteQueryBuilder<

  constructor(
    queryBuilder: SoftDeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
    internalContext: WorkspaceInternalContext,
    shouldBypassPermissionChecks: boolean,
    authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
    try {
      validateQueryIsPermittedOrThrow({
        expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
        objectMetadataMaps: this.internalContext.objectMetadataMaps,
        shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
        isFieldPermissionsEnabled:
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
  EntityTarget,
@@ -34,7 +34,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceUpdateQueryBuilder<
  T extends ObjectLiteral,
 > extends UpdateQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
  private shouldBypassPermissionChecks: boolean;
  private internalContext: WorkspaceInternalContext;
  private authContext?: AuthContext;
@@ -50,7 +50,7 @@ export class WorkspaceUpdateQueryBuilder<

  constructor(
    queryBuilder: UpdateQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
    internalContext: WorkspaceInternalContext,
    shouldBypassPermissionChecks: boolean,
    authContext?: AuthContext,
@@ -88,7 +88,7 @@ export class WorkspaceUpdateQueryBuilder<

      validateQueryIsPermittedOrThrow({
        expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
        objectMetadataMaps: this.internalContext.objectMetadataMaps,
        shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
        isFieldPermissionsEnabled:
@@ -194,7 +194,7 @@ export class WorkspaceUpdateQueryBuilder<

        validateQueryIsPermittedOrThrow({
          expressionMap: fakeExpressionMapToValidatePermissions,
-          objectRecordsPermissions: this.objectRecordsPermissions,
+          objectsPermissions: this.objectRecordsPermissions,
          objectMetadataMaps: this.internalContext.objectMetadataMaps,
          shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
          isFieldPermissionsEnabled:
@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
  DeepPartial,
  DeleteResult,
@@ -40,7 +40,7 @@ export class WorkspaceRepository<
  private readonly internalContext: WorkspaceInternalContext;
  private shouldBypassPermissionChecks: boolean;
  private featureFlagMap: FeatureFlagMap;
-  public readonly objectRecordsPermissions?: ObjectRecordsPermissions;
+  public readonly objectRecordsPermissions?: ObjectsPermissionsDeprecated;
  private authContext?: AuthContext;
  declare manager: WorkspaceEntityManager;

@@ -50,7 +50,7 @@ export class WorkspaceRepository<
    manager: WorkspaceEntityManager,
    featureFlagMap: FeatureFlagMap,
    queryRunner?: QueryRunner,
-    objectRecordsPermissions?: ObjectRecordsPermissions,
+    objectRecordsPermissions?: ObjectsPermissionsDeprecated,
    shouldBypassPermissionChecks = false,
    authContext?: AuthContext,
  ) {