houseassassin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(twenty-orm): migrate 23 grandfathered entities to WorkspaceScopedRepository (#20987)

Browse Source 
## Summary

Follow-up to #20953. Migrates 23 of the 30 entities that were left in
`WORKSPACE_SCOPED_EXEMPTIONS` last time, so the lint rule's
workspaceId-enforcement default now covers most of the core/metadata
schema.

### Migrated (23 entities, 88 files, 22 commits)

| Family | Entities |
|---|---|
| Trivial caches | `NavigationMenuItem`, `Skill`, `DataSource`,
`Webhook`, `CommandMenuItem`, `IndexMetadata` |
| Views | `View`, `ViewField`, `ViewFieldGroup`, `ViewFilter`,
`ViewFilterGroup`, `ViewGroup`, `ViewSort` |
| Layouts | `PageLayout`, `PageLayoutTab`, `PageLayoutWidget` |
| Roles & permissions | `Role`, `RoleTarget`, `PermissionFlag`,
`ObjectPermission`, `FieldPermission`, `RowLevelPermissionPredicate`,
`RowLevelPermissionPredicateGroup` |

For each entity: swap `@InjectRepository(X)` →
`@InjectWorkspaceScopedRepository(X)` (and the field type →
`WorkspaceScopedRepository<X>`); rewrite every call site to pass
`workspaceId` as the first arg (stripped from `where`/criteria — the
wrapper throws if you include it now); register
`provideWorkspaceScopedRepository(X)` in every owning NestJS module;
update affected spec providers to
`getWorkspaceScopedRepositoryToken(X)`.

### Rule update

- `ApplicationRegistrationVariableEntity` was misclassified — moved to
`STRUCTURAL_EXEMPTIONS` (no `workspaceId` column; it's keyed on
`applicationRegistrationId` at the instance level).
- 22 of the 23 migrated entities removed from
`WORKSPACE_SCOPED_EXEMPTIONS` entirely (zero remaining raw
`@InjectRepository` sites).
- `RoleTargetEntity` also removed; one call site in
`user-workspace.service.ts` keeps a raw injection with an
`eslint-disable` + reason because `softRemove(...)` is not on the
wrapper API yet (the migration would require threading `workspaceId`
through `deleteUserWorkspace`'s three callers).

### Still exempted (7 entities, follow-up PRs)

| Entity | Why deferred |
|---|---|
| `ApplicationEntity` | ~50 sites with several cross-workspace lookups
by id (auth, OAuth, file-storage, cleanup) |
| `CalendarChannelEntity` / `MessageChannelEntity` | Use
`.increment(...)` (not on wrapper) and
`repository.manager.transaction(...)` — wrapper needs to grow
`.increment` + the transaction sites need `withManager` or dual-inject |
| `FieldMetadataEntity` / `ObjectMetadataEntity` | The metadata services
`extends TypeOrmQueryService<X>` and `super(rawRepo)` — requires
dual-inject or reworking the inheritance |
| `KeyValuePairEntity` | Allows `workspaceId: IsNull()` for
instance-level config; wrapper rejects null |
| `UpgradeMigrationEntity` | Same — instance-level + cross-workspace
ledger |

## Test plan

- [x] `npx nx typecheck twenty-server` — clean
- [x] `npx nx lint twenty-server` — clean (0/0)
- [x] All 10 affected unit specs pass (115 tests) — api-key, agent-role,
permissions, workspace-roles-permissions-cache, view-filter-group,
workflow-version-step-operations, two-factor-authentication (service +
resolver), user-workspace, file
- [ ] Server integration tests in CI
This commit is contained in:
Félix Malfait
2026-05-28 20:46:21 +02:00
committed by GitHub
parent 865ca697ca
commit f4ead89956
99 changed files with 1037 additions and 663 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts
+2
View File
@@ -44,6 +44,8 @@ import { ApiKeyController } from './controllers/api-key.controller';
WorkspaceApiKeyMapCacheService,
GenerateApiKeyCommand,
provideWorkspaceScopedRepository(ApiKeyEntity),
provideWorkspaceScopedRepository(RoleEntity),
provideWorkspaceScopedRepository(RoleTargetEntity),
],
controllers: [ApiKeyController],
exports: [
packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts
+5 -4
View File
@@ -13,6 +13,8 @@ import { ApiKeyService } from 'src/engine/core-modules/api-key/services/api-key.
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
import { STANDARD_ROLE } from 'src/engine/workspace-manager/twenty-standard-application/constants/standard-role.constant';
type GenerateApiKeyCommandOptions = {
@@ -33,8 +35,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
constructor(
@InjectRepository(WorkspaceEntity)
private readonly workspaceRepository: Repository<WorkspaceEntity>,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
private readonly apiKeyService: ApiKeyService,
private readonly twentyConfigService: TwentyConfigService,
) {
@@ -104,9 +106,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
return;
}
const adminRole = await this.roleRepository.findOne({
const adminRole = await this.roleRepository.findOne(workspace.id, {
where: {
workspaceId: workspace.id,
universalIdentifier: STANDARD_ROLE.admin.universalIdentifier,
},
});
packages/twenty-server/src/engine/core-modules/api-key/services/__tests__/api-key.service.spec.ts
+2 -2
View File
@@ -1,5 +1,5 @@
import { Test, type TestingModule } from '@nestjs/testing';
import { getDataSourceToken, getRepositoryToken } from '@nestjs/typeorm';
import { getDataSourceToken } from '@nestjs/typeorm';
import { IsNull } from 'typeorm';
@@ -101,7 +101,7 @@ describe('ApiKeyService', () => {
useValue: mockRoleTargetService,
},
{
provide: getRepositoryToken(RoleTargetEntity),
provide: getWorkspaceScopedRepositoryToken(RoleTargetEntity),
useValue: mockroleTargetRepository,
},
{
packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts
+17 -18
View File
@@ -1,8 +1,7 @@
import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { isDefined } from 'twenty-shared/utils';
import { In, IsNull, Not, Repository } from 'typeorm';
import { In, IsNull, Not } from 'typeorm';
import { ApiKeyEntity } from 'src/engine/core-modules/api-key/api-key.entity';
import {
@@ -23,10 +22,10 @@ import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/works
@Injectable()
export class ApiKeyRoleService {
constructor(
@InjectRepository(RoleTargetEntity)
private readonly roleTargetRepository: Repository<RoleTargetEntity>,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleTargetEntity)
private readonly roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
@InjectWorkspaceScopedRepository(ApiKeyEntity)
private readonly apiKeyRepository: WorkspaceScopedRepository<ApiKeyEntity>,
@@ -141,8 +140,8 @@ export class ApiKeyRoleService {
);
}
const role = await this.roleRepository.findOne({
where: { id: roleId, workspaceId },
const role = await this.roleRepository.findOne(workspaceId, {
where: { id: roleId },
});
if (!role) {
@@ -159,13 +158,15 @@ export class ApiKeyRoleService {
);
}
const existingRoleTarget = await this.roleTargetRepository.findOne({
where: {
apiKeyId,
roleId,
workspaceId,
const existingRoleTarget = await this.roleTargetRepository.findOne(
workspaceId,
{
where: {
apiKeyId,
roleId,
},
},
});
);
return {
roleToAssignIsSameAsCurrentRole: Boolean(existingRoleTarget),
@@ -183,10 +184,9 @@ export class ApiKeyRoleService {
return new Map();
}
const roleTargets = await this.roleTargetRepository.find({
const roleTargets = await this.roleTargetRepository.find(workspaceId, {
where: {
apiKeyId: In(apiKeyIds),
workspaceId,
},
relations: ['role'],
});
@@ -209,10 +209,9 @@ export class ApiKeyRoleService {
roleId: string,
workspaceId: string,
): Promise<ApiKeyEntity[]> {
const roleTargets = await this.roleTargetRepository.find({
const roleTargets = await this.roleTargetRepository.find(workspaceId, {
where: {
roleId,
workspaceId,
apiKeyId: Not(IsNull()),
},
});
packages/twenty-server/src/engine/core-modules/application/application.module.ts
+1
View File
@@ -39,6 +39,7 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
ApplicationService,
WorkspaceFlatApplicationMapCacheService,
provideWorkspaceScopedRepository(AgentEntity),
provideWorkspaceScopedRepository(CommandMenuItemEntity),
],
})
export class ApplicationModule {}
packages/twenty-server/src/engine/core-modules/application/application.service.ts
+4 -4
View File
@@ -43,8 +43,8 @@ export class ApplicationService {
private readonly agentRepository: WorkspaceScopedRepository<AgentEntity>,
@InjectRepository(FrontComponentEntity)
private readonly frontComponentRepository: Repository<FrontComponentEntity>,
@InjectRepository(CommandMenuItemEntity)
private readonly commandMenuItemRepository: Repository<CommandMenuItemEntity>,
@InjectWorkspaceScopedRepository(CommandMenuItemEntity)
private readonly commandMenuItemRepository: WorkspaceScopedRepository<CommandMenuItemEntity>,
@InjectRepository(ObjectMetadataEntity)
private readonly objectMetadataRepository: Repository<ObjectMetadataEntity>,
@InjectRepository(ApplicationVariableEntity)
@@ -206,8 +206,8 @@ export class ApplicationService {
this.frontComponentRepository.find({
where: { applicationId: application.id, workspaceId },
}),
this.commandMenuItemRepository.find({
where: { applicationId: application.id, workspaceId },
this.commandMenuItemRepository.find(workspaceId, {
where: { applicationId: application.id },
}),
this.objectMetadataRepository.find({
where: { applicationId: application.id, workspaceId },
packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.service.ts
+5
View File
@@ -51,6 +51,8 @@ export class UserWorkspaceService extends TypeOrmQueryService<UserWorkspaceEntit
private readonly userWorkspaceRepository: Repository<UserWorkspaceEntity>,
@InjectRepository(UserEntity)
private readonly userRepository: Repository<UserEntity>,
// softRemove is not supported by WorkspaceScopedRepository.
// eslint-disable-next-line twenty/prefer-workspace-scoped-repository
@InjectRepository(RoleTargetEntity)
private readonly roleTargetRepository: Repository<RoleTargetEntity>,
private readonly roleValidationService: RoleValidationService,
@@ -311,6 +313,9 @@ export class UserWorkspaceService extends TypeOrmQueryService<UserWorkspaceEntit
return await this.userWorkspaceRepository.count({ where: { userId } });
}
// TODO migrate roleTargetRepository to WorkspaceScopedRepository once workspaceId
// is threaded through all deleteUserWorkspace callers (user.service.ts does not
// currently have it at the call site).
async deleteUserWorkspace({
userWorkspaceId,
softDelete = false,