twenty

Author	SHA1	Message	Date
Félix Malfait	b338a7a1d2	feat(settings): discovery hero rollout + ephemeral playground token (#21072 ) ## Summary Two intertwined streams of work: ### UI — discovery hero pattern, settings shell, AI/API redesign - Generalize `SettingsDiscoveryHeroCard` and use it on Layout, Data Model, Apps, AI, API/Webhooks, Members. Drops 4 per-page wrapper files (`SettingsObjectCoverImage`, `SettingsLayoutCoverImage`, `SettingsLayoutCustomizeVideoModal`, `SettingsDataModelVisualizeVideoModal`). Each page now supplies cover src, modal id, and tab list. - Modal: swap `<video>` placeholder for the Vimeo iframe pattern from `twenty-docs`, per-tab `vimeoId`. Drop the parallel border-bottom on the header (TabList draws its own baseline) and the grey background behind the video. Note: Vimeo's embed allowlist applies — the iframes load with the correct URL on `localhost` but the player itself requires the video owner to allow the dev/staging domains in Vimeo settings. - AI page rebuilt into a Cockpit pattern (Overview / Models / Skills / Tools / Usage). New `SettingsAiOverviewTab` with default Smart/Fast pickers, at-a-glance stats, and an MCP signpost that deep-links to `/settings/api-webhooks#mcp`. System Prompt link moved under Models. Advanced tab removed. - API & Webhooks now has 4 tabs (Playground / MCP / API Keys / Webhooks). Hero card above tabs. Playground tab inverted to "Core API" / "Metadata API" sections, each containing REST + GraphQL cards — schema is the meaningful axis, protocol is secondary. Hash deep-link sync delegated to the shared `TabListFromUrlOptionalEffect`. - Settings shell: unified drawer outer padding (kill `isSettings` branch), extract `CollapsibleNavigationDrawerSection`, add `iconColor` on settings nav items, fix Exit Settings button alignment, 880px content cap. ### Backend — strategy C: ephemeral playground token The legacy paste-your-API-key flow is replaced by an on-demand short-lived token scoped to the calling user's permissions. No shared "Playground" API key to manage or revoke. - New `JwtTokenTypeEnum.PLAYGROUND`. `PlaygroundTokenJwtPayload = Omit<AccessTokenJwtPayload, 'type' \| impersonation fields>` so any future ACCESS claim flows through automatically. - `AccessTokenService.generatePlaygroundToken` signs an access-shaped JWT with `type: PLAYGROUND` and a configurable short TTL. A shared private `resolveTokenSubject` helper parallelizes the user / workspace / userWorkspace lookups for both generators. - `JwtAuthStrategy.validateAccessToken` widened to accept `AccessTokenJwtPayload \| PlaygroundTokenJwtPayload`; impersonation gated on `payload.type === ACCESS` so the union narrows without `as unknown as` casts. The two branches in `validate()` collapse into one. - New `PLAYGROUND_TOKEN_EXPIRES_IN` config var (default `2h`). - New `generatePlaygroundToken` mutation (`WorkspaceAuthGuard`, no args, returns `AuthToken`). - Frontend `useOpenPlayground` hook centralizes mint → atom write → navigate, with Apollo `onError` snackbar and a "use cached PLAYGROUND token if still fresh" short-circuit (decodes via `jwt-decode`, checks both `type` AND `exp`). Old API_KEY tokens left in localStorage from the prior paste-form flow are rejected on `type` alone and force a re-mint — this is what was causing the "This API Key is revoked" symptom on stale browsers. ### Drive-by cleanups - `PlaygroundToken` DTO removed (identical shape to `AuthToken` already in use). - 5 `customize-sidebar.webm` imports and the dead placeholder pipeline removed. ## Test plan ### Discovery hero - [ ] `/settings/layout`, `/settings/data-model`, `/settings/applications`, `/settings/ai`, `/settings/api-webhooks`, `/settings/members` each render the discovery hero card with its illustration + play button + tabbed modal - [ ] Modal tabs show the correct Vimeo embed URL per tab; aspect ratio stays at 1440/900; no parallel border-bottom jog at the tab baseline - [ ] AI Overview tab shows Smart/Fast model pickers + stats grid + MCP signpost card; the MCP card lands on `/settings/api-webhooks#mcp` with the MCP tab active ### API playground (ephemeral token) - [ ] With an empty `playgroundApiKeyState` in localStorage, clicking REST or GraphQL playground card opens the playground and the cached token has `type: "PLAYGROUND"` with ~2h exp - [ ] Clicking the card again within the freshness window does not re-mint (`iat` / fingerprint stable across visits) - [ ] Planting a fake API_KEY-shaped JWT in localStorage and clicking the card forces a fresh mint (old token rejected on `type`) - [ ] `GET /rest/companies?limit=1` with the cached token returns 200 + real data - [ ] `POST /graphql { __typename }` returns 200 ### Settings shell - [ ] Settings nav matches main app drawer padding; sections collapse; Exit Settings button aligns with the workspace links above - [ ] Active nav items have a right-gap (cleaner active state) - [ ] Content area capped at 880px ### Verify - [ ] `npx nx typecheck twenty-front` passes - [ ] `npx nx typecheck twenty-server` passes - [ ] `npx nx lint:diff-with-main twenty-front` passes - [ ] `npx nx lint:diff-with-main twenty-server` passes	2026-06-01 14:16:02 +02:00
LazyBouy	88b77cb699	feat(server): opt-in FRONT_AUTO_BASE_URL for hostname-relative API URL (#20504 ) ## Problem `generateFrontConfig()` writes `window._env_.REACT_APP_SERVER_BASE_URL = process.env.SERVER_URL` unconditionally. The frontend then pins to that absolute URL. For self-hosted deployments reachable from multiple hostnames (Tailscale IP, LAN IP, internal DNS, SSH tunnel to localhost, public DNS), only the one matching `SERVER_URL` works — others hit CORS errors or unreachable hosts because the frontend tries to call the API at the configured URL, not the one the user came in via. The frontend already supports the right fallback: `packages/twenty-front/src/config/index.ts:20-21` reads `window._env_?.REACT_APP_SERVER_BASE_URL` and falls back to `getDefaultUrl()` (which uses `window.location`) when the env var is absent. But the server-side `generateFrontConfig` always populates `_env_`, so the fallback never runs. ## Fix One file: `packages/twenty-server/src/utils/generate-front-config.ts`. Add a `FRONT_AUTO_BASE_URL=true` opt-in (also triggered when `SERVER_URL` is unset entirely). When the toggle is on, inject `window._env_ = {}` so the frontend's existing `getDefaultUrl()` fallback resolves the origin from `window.location` at runtime. ## Backwards compatibility When `SERVER_URL` is set AND `FRONT_AUTO_BASE_URL` is unset (or anything other than `'true'`): unchanged — `REACT_APP_SERVER_BASE_URL: process.env.SERVER_URL` is injected exactly as before. The toggle is strictly additive. Existing single-hostname deployments are not affected. ## Use case Self-hosted Twenty reachable via: - `http://100.115.12.29` over Tailscale - `http://localhost:4440` over SSH tunnel - `http://twenty.internal` over LAN DNS - `http://crm.example.com` public With `FRONT_AUTO_BASE_URL=true`, all four paths work without rebuilds or per-hostname server processes. ## Test plan - [ ] `SERVER_URL=http://x.com` (toggle unset) → `<script>window._env_ = {"REACT_APP_SERVER_BASE_URL":"http://x.com"};</script>` (unchanged from main) - [ ] `SERVER_URL` unset → `<script>window._env_ = {};</script>` (new fallback path) - [ ] `SERVER_URL=http://x.com FRONT_AUTO_BASE_URL=true` → `<script>window._env_ = {};</script>` (toggle wins) - [ ] `FRONT_AUTO_BASE_URL=false SERVER_URL=http://x.com` → unchanged (only `'true'` triggers the toggle) --------- Co-authored-by: martmull <martmull@hotmail.fr>	2026-05-29 16:26:43 +00:00
Paul Rastoin	ebfaca5b3d	`EncryptedString` `PlaintextString` branded string types (#21001 ) ## Summary closes https://github.com/twentyhq/core-team-issues/issues/2464 Introduces compile-time branded types to distinguish encrypted ciphertext from plaintext strings, preventing mix-ups like the one fixed in #20819 — but at the type level rather in addition to the one existing at runtime. ### Branded string primitives - Created `EncryptedString` and `PlaintextString` as hard nominal brands using `z.string().brand(...)`, making them non-assignable to each other or to raw `string` - Created `isEncryptedString` type predicate to narrow `string` to `EncryptedString` based on the `enc:v2:` envelope prefix - Retyped `SecretEncryptionService`: `encryptVersioned` accepts `PlaintextString`, `decryptVersioned` returns `PlaintextString` ### Entity typing - Typed encrypted columns across entities: `SigningKeyEntity.privateKey`, `TwoFactorAuthenticationMethodEntity.secret`, `ApplicationRegistrationVariableEntity.encryptedValue`, `ApplicationVariableEntity.value` - Parameterized JSONB types for connected account connection parameters (`ImapSmtpCaldavParams<Pwd>`) with reusable aliases `EncryptedImapSmtpCaldavParams` / `DecryptedImapSmtpCaldavParams` - Typed DTOs (`CreateApplicationRegistrationVariableInput`, `UpdateApplicationRegistrationVariablePayload`, `UpdateApplicationVariableEntityInput`) with `PlaintextString` ### ApplicationVariable always-encrypt uniformization - Retyped `ApplicationVariableEntity.value` to `EncryptedString \| ''` — all values are now encrypted regardless of `isSecret` - Updated `ApplicationVariableEntityService` to always encrypt on write and always decrypt on read - Simplified `UpdateApplicationVariableActionHandlerService` by removing conditional encrypt/decrypt-on-isSecret-toggle logic - Added slow instance command (`2.9.0`) to backfill-encrypt existing `isSecret=false` plaintext rows and tighten the `CHECK` constraint ### ConfigStorageService refactor - Split `convertAndSecureValue` (which used `any`) into two well-typed methods: `convertAndDecrypt` and `convertAndEncrypt` - Introduced `isSensitiveStringValue` type predicate to narrow values before encryption/decryption ### What's next - Typeorm entity derivation to strictly type sitemap configuration as code + handler logic for encryption rotation - https://github.com/twentyhq/core-team-issues/issues/2465	2026-05-28 17:41:16 +02:00
Etienne	4a82cddad6	remove ai-model-preferences var env and config (#20859 ) Split the single AI_MODEL_PREFERENCES JSON config into 4 array configs and migrates existing workspace data.	2026-05-27 06:47:47 +00:00
Charles Bochet	91ce59d8e2	refactor(jwt): gate signing-key auto-rotation cron on SIGNING_KEY_ROTATION_DAYS (#20866 ) Only register the JWT signing-key rotation cron when `SIGNING_KEY_ROTATION_DAYS` is set, and move that variable to Advanced Settings.	2026-05-23 09:51:06 +00:00
neo773	323e66433e	lint: migrate prettier to oxfmt (#20783 ) Most changes are `implements` being unwrapped this is not a oxfmt regression Prettier in 3.7 (we're on 3.1) changed this behaviour prettier blog [post](https://prettier.io/blog/2025/11/27/3.7.0#change-18094) This unifies our linting tooling --------- Co-authored-by: github-actions <github-actions@twenty.com> Co-authored-by: Charles Bochet <charles@twenty.com>	2026-05-22 00:21:33 +02:00
martmull	127fb2a470	Increase size of tarball upload (#20767 ) - check size while reading stream instead of checking after reading all stream - move MAX_TARBALL_UPLOAD_SIZE_BYTES to config variables - increase MAX_TARBALL_UPLOAD_SIZE_BYTES default from 50Mb to 100Mb	2026-05-20 12:39:11 +00:00
Etienne	827f24df2b	fix(ai) - add ai model preferences fallback (#20704 ) Problem AI_MODEL_PREFERENCES, JSON env var is not supported + IS_CONFIG_VARIABLES_IN_DB_ENABLED=false in twenty cloud server -> No option to set AI_MODEL_PREFERENCES Solution AI_MODEL_PREFERENCES supports three override sources beyond the hardcoded code defaults, in priority order: - DB (IS_CONFIG_VARIABLES_IN_DB_ENABLED=true), the only writable source; admin-panel mutations persist here - ENV not usable in Twenty Cloud, which does not handle JSON-format env vars - Introduced in this PR --> File (AI_MODEL_PREFERENCES_STORAGE_PATH), a read-only startup fallback, the only viable override in Cloud/self-managed deployments where DB config is disabled and JSON env vars are unsupported.	2026-05-19 13:19:24 +00:00
Paul Rastoin	57f13c9b92	`[CONNECTED_ACCOUNT_BREAKING_CHANGE]` Encrypt `ConnectedAccount` `connectionParameters` (#20673 ) # Introduction Prevent any cross user `connectedAccount` `connectionParamaters` leak Also encrypt in db all `connectionParameters` password Never return any password through `DTO` anymore The settings now allow update mutation without providing the password in edition mode Verified all `connectionParameters.password` interaction ## Integration tests - Added more coverage for both failing and successful paths - Introduced a new env var that allow bypass the provider connection test ## Legacy connected Account decryption support Stop allowing non encrypted decryption on `accessToken` and `refreshToken`, only allow legacy decryption on refactored `connectionParameters` ## Upsert ownership Completely got rid of the connected workspace schema context which is legacy Also now a user can only upsert a connected account for him only.. ## New UI <img width="1770" height="1852" alt="image" src="https://github.com/user-attachments/assets/55c1dc89-42ff-4084-95e2-cc5f9e23753b" /> If in edition the password is by default disabled It needs to be selected as being edited to be enabled ## Next - Refactor tool permissions flag not to include connected accounts - Remove the legacy connected standard object - Refactor and improve connected account resolver auth	2026-05-19 12:56:44 +00:00
Charles Bochet	72ce77864e	feat(server): Enterprise cron that rotates the current JWT signing key (#20612 ) ## Summary Adds a daily Enterprise-only cron that rotates the current ES256 JWT signing key once it has been current for `SIGNING_KEY_ROTATION_DAYS`. Manual rotation from the admin panel is unaffected. ### Behaviour - `SIGNING_KEY_ROTATION_DAYS` is opt-in: when unset, the cron is a no-op. - Rotation flips `isCurrent` and clears the previous key's `privateKey` in the same transaction, then inserts the new `isCurrent=true` row. - The previous key's row is kept (`revokedAt` stays `null`) so its `publicKey` can keep verifying tokens it signed until they expire; only the encrypted `privateKey` is wiped since it can no longer be used to sign. - No auto-revocation — revoking a key remains a manual admin action, reserved for leak / emergency response. - The cron is also a no-op when `EnterprisePlanService.isValid()` is `false`. ### Wiring - `JwtKeyManagerService.rotateCurrent()` - `SigningKeyRotationService.rotateIfDue()` (reads `SIGNING_KEY_ROTATION_DAYS`, skips when unset) - `RotateSigningKeysCronJob` (Enterprise-gated, rethrows on failure) registered in `JwtModule` - `RotateSigningKeysCronCommand` registered with `cron:register:all` - `ROTATE_SIGNING_KEYS_CRON_PATTERN = '15 3 * * *'` (daily, no-op until threshold) Operator documentation lives in #20611 (docs PR).	2026-05-19 10:41:04 +00:00
Charles Bochet	45bea6f991	feat(secret-encryption): drop APP_SECRET from approved-access-domain validation and session cookies (#20580 ) ## Summary Continues retiring `APP_SECRET` as a hot signing secret (after the TOTP migration in #20577). This PR moves the last two cryptographic uses of `APP_SECRET` off it: 1. Approved-access-domain validation tokens — was a one-shot `sha256(JSON.stringify({id, domain, key: APP_SECRET}))` HMAC with no built-in expiry. Now a JWT signed by the workspace `signingKey` with a 7-day expiry and claims bound to `approvedAccessDomainId`, `workspaceId`, and `domain`. 2. Express-session cookie signing — was `sha256(APP_SECRET \|\| 'SESSION_STORE_SECRET')`. Now `HKDF(ENCRYPTION_KEY, info='twenty:hmac:v1:session-cookie')` with `FALLBACK_ENCRYPTION_KEY` supported for rotation. ### Approved-access-domain — strict cutover - `ApprovedAccessDomainService.mintValidationToken` issues a JWT via `JwtWrapperService.signAsyncOrThrow` (workspace `signingKey`, asymmetric ES256 with kid-based rotation built in). - `validateApprovedAccessDomain` verifies the JWT, asserts `type === APPROVED_ACCESS_DOMAIN`, cross-checks `claim.approvedAccessDomainId` against the URL's `approvedAccessDomainId`, then re-checks `domain` and `workspaceId` against the stored row. Any failure maps to `APPROVED_ACCESS_DOMAIN_VALIDATION_TOKEN_INVALID`. - No legacy fallback: any pending invitation link minted with the old SHA hash will fail validation and must be re-sent. Volume is small and admins can re-issue from settings — this is the cleanest cutover. ### Session cookies — bridged cutover - `resolveSessionCookieSecretsOrThrow` returns an array `[HKDF(ENCRYPTION_KEY), HKDF(FALLBACK_ENCRYPTION_KEY)?, sha256(APP_SECRET \|\| 'SESSION_STORE_SECRET')?]`. - `express-session` signs new cookies with the first secret and verifies against any entry, so in-flight cookies signed under the legacy SHA keep verifying until `maxAge` (30 min) expires. - New `deriveInstanceHmacKey` HKDF utility uses a dedicated `twenty:hmac:v1:` info prefix — distinct from the AEAD subkey prefix `twenty:enc:v2:` — so HMAC and encryption subkeys can never collide for the same raw `ENCRYPTION_KEY`. - TODO comment marks the legacy slot for removal post-2.5. ### Notes on rotation behaviour - Rotating `ENCRYPTION_KEY` while keeping the old value in `FALLBACK_ENCRYPTION_KEY` keeps cookies signed under either key verifying. New cookies sign under the new key. After all in-flight cookies expire (≤30 min), the fallback slot can be dropped from env. - Rotating the workspace `signingKey` (already supported by `JwtKeyManagerService`) keeps already-issued approved-access-domain JWTs verifying via `kid` until their 7-day expiry. ## Test plan - [x] Unit tests for `ApprovedAccessDomainService` cover: happy path, JWT verify failure, wrong token type, JWT id ≠ input id, JWT-claimed domain ≠ row, missing row, already-validated row. - [x] Unit tests for `resolveSessionCookieSecretsOrThrow` cover: throws without keys, primary order (`ENCRYPTION_KEY` → APP_SECRET fallback), `FALLBACK_ENCRYPTION_KEY` placement, empty-string vars treated as unset, legacy slot omitted when `APP_SECRET` missing, HKDF domain separation across purposes. - [x] `nx lint:diff-with-main twenty-server` — clean. - [x] Full test surface across approved-access-domain, secret-encryption, session-storage — 78/78 pass. - [ ] CI green. - [ ] Manual smoke: boot with a dummy `ENCRYPTION_KEY`, confirm sign-in succeeds (session cookie works), create + validate an approved-access-domain end-to-end through the UI.	2026-05-15 08:47:46 +00:00
Weiko	a47e1e0e5e	Fix time consuming search ilike fallback (#20544 ) ## Context When the tsvector full-text search returns 0 hits on the first page, SearchService falls back to ILIKE '%word%' over searchVector::text. The leading wildcard makes the GIN index unusable, so it seq-scans the table. On large searchable custom objects (e.g. a workspace with ~500k rows in _logs) a single fallback can take 2–3s, multiplied across all searchable objects in one request. ## Implementation Wrap the fallback query in a tiny TypeORM transaction and apply a Postgres per-statement timeout via set_config('statement_timeout', ms, true) (= SET LOCAL). On timeout, Postgres throws 57014 (QUERY_CANCELED); we catch it, warn-log with workspace/object context, and return [] for that object ## Note This PR bounds the slow fallback and doesn't make it fast. The right structural fix is to let the fallback use an index. Since tsvector does not work with certain language (which is the reason why the ILIKE fallback was implemented in the first place), we should probably use the pg_trgm extension instead (@FelixMalfait) --------- Co-authored-by: Charles Bochet <charles@twenty.com>	2026-05-14 10:00:33 +00:00
Charles Bochet	7fa136f305	feat(twenty-server): migrate remaining at-rest encryption sites to versioned envelope (#20550 ) ## Summary Second PR in the encryption key rotation series. The previous PR (#20528) introduced `ENCRYPTION_KEY` + the versioned `enc:v2:<keyId>:<base64>` envelope inside `SecretEncryptionService` and migrated `ConnectedAccountTokenEncryptionService` as the first consumer. This PR routes every remaining at-rest encryption site through the versioned envelope so that `ENCRYPTION_KEY` (and the future `FALLBACK_ENCRYPTION_KEY`) actually covers them. The legacy unprefixed CTR ciphertext remains readable as a fallback during the rollout window — every migrated read site uses `decryptVersioned`, which transparently delegates to the legacy CTR decrypt when it sees an unprefixed payload. ### Service migrations - `ApplicationVariableEntityService` (#8) — workspace-scoped. HKDF info is bound to each row's `workspaceId`. A new `decryptAndMaskVersioned` helper lands on `SecretEncryptionService` for the resolver display path. - `ApplicationRegistrationVariableService` (#7) + consumers — instance-scoped. Registration variables are server-level config readable by every workspace that installs the application, so HKDF info is `instance`. Updated consumers: - `LogicFunctionExecutorService.buildServerVariableEnvMap` - `ConnectionProviderService.getClientCredentials` - `LogicFunctionExecutorService.buildEnvVar` (#9) — workspace-scoped. Each variable's `workspaceId` is threaded into `decryptVersioned`, so per-workspace HKDF contexts are honoured at execution time. - `UpdateApplicationVariableActionHandlerService` (workspace-migration runner) — threads `workspaceId` through the secret/non-secret toggle. - `JwtKeyManagerService` (#3) — instance-scoped. Signing keys are shared across the JWKS. - `ConfigStorageService` (#6) — instance-scoped sensitive STRING config variables. ### Slow instance commands (2.5.0) Each migrated site has a paired backfill that re-encrypts existing rows into the v2 envelope before the column is constrained: \| timestamp \| command \| scope \| CHECK constraint \| \|---\|---\|---\|---\| \| `1798000005000` \| encrypt-application-variable \| workspaceId \| `"isSecret" = false OR value = '' OR value LIKE 'enc:v2:%'` \| \| `1798000006000` \| encrypt-application-registration-variable \| instance \| `"encryptedValue" = '' OR value LIKE 'enc:v2:%'` \| \| `1798000007000` \| encrypt-signing-key-private-keys \| instance \| `"privateKey" IS NULL OR value LIKE 'enc:v2:%'` \| \| `1798000008000` \| encrypt-sensitive-config-storage \| instance \| _none_ — heterogeneous jsonb column \| All backfills are idempotent (the SELECT filter skips rows already in v2 form) and run before their respective `up()` adds the CHECK constraint. Every `down()` deliberately stops at dropping the CHECK constraint — they intentionally do not re-introduce plaintext on rollback. ### Tests - Unit specs for each new slow command cover the v2 upgrade path, the idempotency invariant, and the instance vs workspace HKDF scope. - New `JwtKeyManagerService` spec asserts `decryptVersioned`/`encryptVersioned` are called without `workspaceId` (instance scope). - Updated existing specs for `ApplicationVariableEntityService`, `ConfigStorageService`, and `buildEnvVar` to assert the versioned API and the workspace HKDF context plumbing. - New `SecretEncryptionService.decryptAndMaskVersioned` cases in the service spec. - Updated the `applicationRegistrationVariable` integration spec to assert the column now stores `enc:v2:<keyId>:<base64>` instead of raw legacy CTR. ### Out of scope (future PRs) - `PostgresCredentialsService` — bespoke `jwtWrapperService.generateAppSecret`–derived key + `encryptText`/`decryptText` from `auth.util.ts`; deserves its own migration. - `SimpleSecretEncryptionUtil` (TOTP) — entirely different `aes-256-cbc` `iv:enc` format; deserves its own migration. ## Test plan - [x] `npx nx typecheck twenty-server` - [x] `npx nx lint:diff-with-main twenty-server` (oxlint + prettier) - [x] Local jest run for `secret-encryption \| connected-account-token \| application-variable \| application-registration-variable \| build-env-var \| jwt-key-manager \| config-storage \| encrypt-application-variable \| encrypt-application-registration-variable \| encrypt-signing-key \| encrypt-sensitive-config-storage` — 17 suites, 106 tests pass. - [x] Local jest run for `upgrade \| instance-command` — 12 suites, 86 tests pass. - [ ] CI green - [ ] Manual review of CHECK constraint shapes by a server reviewer (each one matches `enc:v2:%` rather than `enc:v_:%` since none of the migrated columns can legitimately hold `enc:v1:` ciphertext).	2026-05-14 06:10:52 +00:00
Etienne	fcd2d586ee	chore(billing) - remove feature flag (#20531 ) - remove feature flag - remove old enforce cap usage logic	2026-05-13 18:52:29 +02:00
Charles Bochet	e0b4c9918b	feat(twenty-server): introduce ENCRYPTION_KEY env var with versioned envelope (#20528 ) ## Summary - Adds `ENCRYPTION_KEY` (primary) and `FALLBACK_ENCRYPTION_KEY` (decrypt-only fallback for rotation) env vars to twenty-server, with backward-compatible fallback to `APP_SECRET` when `ENCRYPTION_KEY` is unset. - Introduces a versioned ciphertext envelope `enc:v2:<keyId>:<base64>` using AES-256-GCM with HKDF-SHA256 derived per-context keys. The 8-hex `keyId` fingerprint lets every row identify which physical key encrypted it, so rotation routes directly to primary or fallback without trial decryption; GCM's auth tag gives true integrity (legacy CTR has none). - Migrates `ConnectedAccountTokenEncryptionService` to the new envelope and plumbs `workspaceId` through every caller, so per-workspace HKDF context binds each row to its tenant. The remaining encryption sites (`jwt-key-manager`, `config-storage`, `postgres-credentials`, `application-variable`, TOTP) stay on the legacy unprefixed CTR path and will be migrated in follow-up PRs. The operator-facing rotation runbook is out of scope here. ### Format details `enc:v{N}:{keyId}:{base64}` — `N=2` is the only version produced by new writes (`v1` exists for backward-compatible decryption of existing connected-account rows). `keyId = sha256(rawKey).slice(0,4).toString('hex')`. The CHECK constraint on `core.connectedAccount.{accessToken,refreshToken}` is relaxed from `LIKE 'enc:v1:%'` to `LIKE 'enc:v_:%'` so both versions pass. ### Key resolution \| `ENCRYPTION_KEY` \| `FALLBACK_ENCRYPTION_KEY` \| `APP_SECRET` \| Encrypt with \| Decrypt try order \| \|---\|---\|---\|---\|---\| \| set \| set \| (any) \| `ENCRYPTION_KEY` \| match `keyId` → primary → fallback \| \| set \| unset \| (any) \| `ENCRYPTION_KEY` \| match `keyId` → primary \| \| unset \| set \| set \| `APP_SECRET` \| match `keyId` → `APP_SECRET` → fallback \| \| unset \| unset \| set \| `APP_SECRET` \| match `keyId` → `APP_SECRET` \| \| unset \| unset \| unset \| startup error \| n/a \| ## Test plan - [x] `npx nx typecheck twenty-server` — clean - [x] `npx jest 'secret-encryption\|connected-account-token-encryption\|connected-account-refresh-tokens\|encrypt-connected-account-tokens\|connection-provider-oauth-flow'` — 87 tests pass - [x] New `secret-encryption.service.versioned.spec.ts` covers: key resolution table (no-key error, APP_SECRET fallback, ENCRYPTION_KEY precedence), v2 round-trip with/without workspaceId, GCM tamper rejection, workspaceId-mismatch rejection, keyId-based primary→fallback routing, missing-key error names the fingerprint, v1 legacy decryption, no-prefix legacy decryption, malformed envelope rejection. - [x] Updated `connected-account-token-encryption.service.spec.ts` covers workspaceId binding and HKDF context isolation. - [x] Updated slow instance command spec verifies workspaceId is threaded through encryption and the relaxed `enc:v_:%` LIKE pattern matches both v1 and v2. - [ ] Manual E2E: connect a Gmail account on a freshly deployed instance with `APP_SECRET` only → confirm `core.connectedAccount.accessToken` is `enc:v2:<keyId>:<base64>`. - [ ] Manual E2E: rotate — set `ENCRYPTION_KEY=<new>` and `FALLBACK_ENCRYPTION_KEY=<old APP_SECRET>`, restart, confirm pre-rotation rows still decrypt and new rows carry the new `keyId`. - [ ] Manual E2E: missing key — set `ENCRYPTION_KEY=<new>` without the fallback, confirm decrypt error names the old `keyId` so the operator can identify the missing key.	2026-05-13 16:15:54 +00:00
Félix Malfait	4da8878697	feat: add email forwarding message channel (#19535 ) ## Summary - Add email forwarding as a new message channel type, allowing users to forward emails from addresses like `support@mycompany.com` into Twenty - Inbound emails arrive via S3 (SES → S3 bucket), are polled by a cron job, parsed, routed to the correct workspace/channel, and persisted as messages - Dedicated settings page at `/settings/accounts/new-email-forwarding` where users provide their source email handle and receive a unique forwarding address - Forwarding channels bypass the IMAP/mailbox sync state machine — they skip cron-driven sync, relaunch, and message-list-fetch lifecycle stages - Forwarding address section shown at the top of the Emails settings page so users can find/copy their addresses after initial setup - Tab names for forwarding channels display the user-provided handle (e.g. `support@mycompany.com`) instead of the internal routing address - Shared utilities extracted from IMAP driver: `extractThreadId`, `extractParticipants`, `extractAddresses` to avoid code duplication - Uses the existing S3 bucket (STORAGE_S3_*) with `inbound-email/` prefix — no separate bucket needed - Feature gated behind `isEmailForwardingEnabled` client config (requires `INBOUND_EMAIL_DOMAIN` + S3 storage) ## New backend modules - `InboundEmailS3ClientProvider` — lazy-initialized S3 client using existing storage config - `InboundEmailStorageService` — S3 operations (get, move to processed/unmatched/failed) - `InboundEmailParserService` — RFC 822 parsing via `postal-mime`, builds `MessageWithParticipants` - `InboundEmailImportService` — orchestrates download → parse → route → persist → archive - `MessagingInboundEmailPollCronJob` — polls S3 `incoming/` prefix, enqueues import jobs - `CreateEmailForwardingChannelInput` DTO — accepts user-provided `handle` ## New frontend components - `SettingsAccountsNewEmailForwardingChannel` — dedicated page with handle input form + forwarding address result - `SettingsAccountsEmailForwardingSection` — forwarding address list on the Emails settings page - `useConnectedAccountHandleMap` — shared hook for account ID → handle lookup - `useCreateEmailForwardingChannel` — mutation hook accepting handle parameter ## Test plan - [x] 17 unit tests for inbound email import service (all outcomes: imported, unmatched, loop_dropped, unconfigured, parse_failed, persist_failed) - [x] 16 tests for `computeSyncStatus` including EMAIL_FORWARDING cases - [x] 11 tests for `extractEnvelopeRecipient` utility - [x] TypeScript typechecks pass for both twenty-server and twenty-front - [x] Lint passes for both packages - [ ] Manual: create forwarding channel, verify forwarding address generated - [ ] Manual: send email to forwarding address, verify it appears in Twenty https://claude.ai/code/session_01KpyF6p4cUEnuaT4h8DP5Pm --------- Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Copilot Autofix powered by AI <223894421+github-code-quality[bot]@users.noreply.github.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com> Co-authored-by: neo773 <62795688+neo773@users.noreply.github.com> Co-authored-by: neo773 <neo773@protonmail.com>	2026-05-09 11:00:57 +02:00
Etienne	9fc5be1c4c	Billing - Migrate from Stripe metering (#20298 ) Overall strategy 1. Introduce “Billing V2” behind a workspace flag Gate the new model with FeatureFlagKey.IS_BILLING_V2_ENABLED so existing workspaces stay on the old behavior until they’re migrated or explicitly on V2. 2. Replace workflow metered SKUs with a resource-credit product Conceptually, billable “workflow execution” usage is not the primary subscription line item anymore. Add a RESOURCE_CREDIT product (and keep WORKFLOW_NODE_EXECUTION as deprecated for the transition). Usage and limits are expressed through credit buckets (e.g. price metadata like credit_amount), so one product can represent pooled credits instead of a narrow workflow-only meter. 3. Migrate subscriptions in two layers Schema/catalog: persist extra price metadata (instance upgrade) so the server knows credit amounts and can match Stripe prices to the new model. Per workspace: the registered workspace command upgrade:2-2:migrate-to-billing-v2 finds subscriptions that still have WORKFLOW_NODE_EXECUTION, swaps those items to the right RESOURCE_CREDIT prices (using existing Stripe schedule + BillingSubscriptionUpdateService stack), then treats the workspace as V2 (flag). Workspaces without that legacy item or without a subscription are skipped. 4. Unify subscription lifecycle + usage on the server 5. Refresh the product surface in Settings Test : - [x] Subscribe v1 + Update subscribe + Migrate - [x] Subscribe v2 + Update subscribe	2026-05-07 15:42:11 +00:00
Félix Malfait	4f938aa097	feat(app): infrastructure for pre-installed apps (#19973 ) PR 1 of 2. Follow-up PR ships the Exa app, sets it as a default pre-installed app, and removes the current `WebSearchTool` / `WebSearchService` / `ExaDriver`. This PR adds the plumbing; no user-visible change yet. ## Summary - Server admins can declare a list of npm app packages to auto-install on every new workspace and backfill onto existing workspaces via CLI. - Server-level secrets (like Exa's API key) live on the `ApplicationRegistration` (one row per server, encrypted) and are injected into logic function execution env at runtime. No more per-workspace storage of global secrets. - A generic `POST /app/billing/charge` endpoint lets app logic functions emit workspace usage events for metered features. Exa uses it in PR 2; future apps (call recorder, etc.) reuse it. - `LogicFunctionToolProvider` tool name prefix changes `logic_function_` → `app_`. Shorter, accurate (they come from installed apps). ## What's in this PR Logic function executor — server-level variables - `LogicFunctionExecutorService.getExecutionEnvVariables` now resolves env vars in the order: hardcoded defaults → `ApplicationRegistrationVariable[]` (server-level) → `ApplicationVariable[]` (workspace-level override). The manifest `serverVariables` schema has existed; this closes the loop. Config - `PRE_INSTALLED_APPS` — comma-separated list of npm packages. Default: empty. \`PreInstalledAppsService\` (new module) - \`onApplicationBootstrap()\` — fetches each package's manifest from the app registry CDN, upserts an \`ApplicationRegistration\`, and seeds declared \`serverVariables\` from matching env vars (e.g. \`EXA_API_KEY\` env → encrypted registration variable). - \`installOnWorkspace(workspaceId)\` — installs all pre-installed apps on a single workspace. Tolerates per-app failures. Auto-install on new workspace activation - \`WorkspaceService.prefillCreatedWorkspaceRecords\` invokes \`installOnWorkspace\` after prefilling standard records. Non-blocking on failure. Backfill CLI command - \`install-pre-installed-apps\` — iterates active and suspended workspaces, installs pre-installed apps that aren't yet installed. Idempotent. Run after changing \`PRE_INSTALLED_APPS\`. App billing endpoint - \`POST /app/billing/charge\`. Authenticated via \`APPLICATION_ACCESS\` token (already injected into logic function execution env as \`DEFAULT_APP_ACCESS_TOKEN\`). Body: \`{ creditsUsedMicro, quantity, unit, operationType, resourceContext? }\`. Emits \`USAGE_RECORDED\` with \`applicationId\` as \`resourceId\`. Generic — reusable by any app. Tool name prefix - \`LogicFunctionToolProvider.buildLogicFunctionToolName\` now produces \`app_<name>\` instead of \`logic_function_<name>\`. Only affects tools sourced from logic functions; other tool providers unchanged. ## Stats - 16 files, +501 / −2 - 7 new files (1 command, 1 service × 2, 1 controller, 1 DTO, 2 modules) - Typecheck: 7 pre-existing errors, zero new - Prettier clean ## Behavior deltas - \`PRE_INSTALLED_APPS\` default = empty: existing servers see no change on merge. - \`ApplicationRegistrationVariable\` is now read by the executor: apps that were using manifest \`serverVariables\` but expecting them to be ignored by the executor will now see them injected. No apps ship with \`isTool: true\` logic functions today, so this is latent — first consumer is Exa in PR 2. - Tool prefix: currently no logic-function tools are named \`logic_function_\` in any production flow. The prefix change affects only future tools emitted by \`LogicFunctionToolProvider\`. ## Risks - CDN unavailability at startup: if the app registry CDN is down, \`ensureRegistrationsExist\` logs warnings but doesn't block server start. Installation on new workspaces during this window will find no registrations and log a non-blocking error. Backfill command can retry after CDN recovers. - Cold-start overhead: \`ensureRegistrationsExist\` is called once per process on bootstrap. Current configurable default is empty, so zero overhead. When an admin sets \`PRE_INSTALLED_APPS\`, they accept one HTTP call per package at boot. - Server-level variables flow*: \`ApplicationRegistrationVariable.encryptedValue\` is shared by all workspaces of a server. Appropriate for a single-tenant Exa key. Not appropriate for per-tenant keys — those go in workspace-level \`ApplicationVariable\` and override. ## Test plan - [ ] \`npx nx typecheck twenty-server\` passes (verified: 7 pre-existing unrelated errors, zero new) - [ ] Set \`PRE_INSTALLED_APPS=@twenty-apps/hello-world\` (or any real npm-published app), \`HELLO_WORLD_API_KEY=xxx\`, restart server: \`ApplicationRegistration\` row is upserted, \`ApplicationRegistrationVariable\` for HELLO_WORLD_API_KEY is populated (encrypted). - [ ] Create a new workspace: the app is auto-installed, \`ApplicationEntity\` row created, \`LogicFunctionEntity\` rows created. - [ ] Existing workspace: run \`yarn nx run twenty-server:command install-pre-installed-apps\`: apps install across all workspaces, idempotent on re-run. - [ ] Trigger a logic function that reads \`process.env.HELLO_WORLD_API_KEY\`: value resolves from the server-level \`ApplicationRegistrationVariable\`. - [ ] Log a charge from the handler: \`POST /app/billing/charge\` with \`Authorization: Bearer \$DEFAULT_APP_ACCESS_TOKEN\` body \`{creditsUsedMicro: 1000, quantity: 1, unit: "INVOCATION", operationType: "WEB_SEARCH"}\` → returns \`{success: true}\`, \`USAGE_RECORDED\` event emitted with correct \`resourceId=applicationId\`. - [ ] Tool name generated by \`LogicFunctionToolProvider\` starts with \`app_\`. ## What's NOT in this PR (PR 2 scope) - The Exa app itself (\`packages/twenty-apps/...\` directory) - Removing \`WebSearchTool\`, \`WebSearchService\`, \`ExaDriver\`, \`web-search\` module - Removing \`WEB_SEARCH_DRIVER\` config var - Removing the current \`exa_web_search\` entry in \`ActionToolProvider\` - Chat preload list updated to \`app_exa_web_search\` - Frontend \`getToolDisplayMessage\` branch for \`app_exa_web_search\` - Setting \`PRE_INSTALLED_APPS\` default to include \`@twenty-apps/exa\` --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-23 21:59:00 +02:00
Paul Rastoin	b1838b3090	Retrieve ai catalog at bootstrap (#20005 ) # Introduction Migrating from build injection to a runtime bootstrap injection of the ai catalog that are dynamic to the env we're deploying to	2026-04-23 17:00:35 +00:00
Félix Malfait	0c929e7903	refactor(tool-provider): rename web_search to exa_web_search, drop XOR toggle (#19969 ) ## Summary - Today `WEB_SEARCH_PREFER_NATIVE` forces a mutual exclusion: either the custom Exa tool preloads as `web_search` or the SDK-native `web_search` binds. Same name, different backends. - This PR lets them coexist. Custom Exa becomes `exa_web_search`; native keeps `web_search`. The model picks based on tool descriptions. - `WEB_SEARCH_PREFER_NATIVE` and `shouldUseNativeSearch()` are deleted. Exa enablement follows `WEB_SEARCH_DRIVER` (existing). Native enablement follows the agent's `modelConfiguration.webSearch.enabled` (existing). ## Key changes Config / service - Deleted `WEB_SEARCH_PREFER_NATIVE` (config-variables.ts) - Deleted `WebSearchService.shouldUseNativeSearch()` - `WebSearchService.isEnabled()` unchanged — still gates Exa availability Custom tool rename - `ActionToolProvider.toolMap`: `'web_search'` → `'exa_web_search'` - Descriptor name matches - `WebSearchTool.description` rewritten to position Exa as structured/entity-aware, complementary to native Native tool binder - `NativeToolBinder.bind()` drops the `shouldUseNativeSearch` gate. Per-agent `modelConfiguration.webSearch.enabled` (inside `getNativeModelTools`) stays authoritative. Chat - Preload list now always includes `exa_web_search` — `ActionToolProvider` silently skips the descriptor when Exa is disabled, so `getToolsByName` degrades gracefully - Native tools always attempted; returns empty ToolSet when the model doesn't support them - `directTools = { ...preloadedTools, ...nativeSearchTools }` — both present when both enabled - `billNativeWebSearchUsage` called unconditionally (the function already short-circuits on count ≤ 0) Workflow agent - Same unconditional billing pattern - `WebSearchService` dependency removed System prompt - Dropped the special-cased `web_search` branch. Preloaded tools list uniformly now. Frontend - `exa_web_search` reuses the same "Searching the web for X" display as native - Test coverage added ## Billing isolation (verified) - `countNativeWebSearchCallsFromSteps` counts `toolName === 'web_search'` only. After the rename, only native calls match. Exa calls (`exa_web_search`) are billed separately via `WebSearchService.emitUsageEvent` inside `search()`. - No double-billing path. ## Behavior deltas (intended) \| Scenario \| Before \| After \| \|---\|---\|---\| \| Anthropic model + Exa enabled + PREFER_NATIVE=true \| native only \| both \| \| Anthropic + Exa enabled + PREFER_NATIVE=false \| Exa only (as `web_search`) \| both \| \| Non-native model + Exa enabled \| Exa as `web_search` \| Exa as `exa_web_search` \| \| Any model + Exa disabled + native supported \| native only \| native only \| \| Workflow agent with `webSearch.enabled=true` + Anthropic + Exa enabled \| native only \| both \| ## Known regression (accepted) Customers who set `WEB_SEARCH_PREFER_NATIVE=false` to force Exa-only will now also see native `web_search` if the model supports it. There's no chat-level kill switch after this PR. Per discussion, this is accepted — future model-level capability gating (in the model JSON) will be the right place for that control. ## Stats - 10 files, +63 / −73 (net deletion) - Typecheck clean (server: 7 pre-existing unrelated, front: 13 pre-existing unrelated — zero new either side) - Prettier clean ## Test plan - [ ] `npx nx typecheck twenty-server` and `npx nx typecheck twenty-front` pass - [ ] With Anthropic + Exa enabled: chat shows both `web_search` and `exa_web_search` in preloaded list; model can call either - [ ] With Anthropic + Exa disabled: chat shows only native `web_search` - [ ] With non-native model + Exa enabled: chat shows only `exa_web_search` - [ ] Workflow agent with `modelConfiguration.webSearch.enabled=true` + Exa enabled: both available - [ ] Billing: native calls billed via `billNativeWebSearchUsage`; Exa calls billed via `WebSearchService.emitUsageEvent`; no double-billing - [ ] Frontend: `exa_web_search` renders "Searching the web for X" the same as `web_search` Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-22 14:57:44 +02:00
Etienne	e68842c268	Billing - fixes (#19867 ) - Uniformize credit formating : In UI, 1$=1credit. In BE 1 UI credit = 1_000_000 BE "crédits" - Add crédit rollover information + Link to documentation + Documentation update <img width="291" height="317" alt="Screenshot 2026-04-17 at 18 22 59" src="https://github.com/user-attachments/assets/2519fb9f-159d-4c85-95f4-a6e005a8a1a3" /> <img width="848" height="763" alt="Screenshot 2026-04-17 at 14 12 20" src="https://github.com/user-attachments/assets/a3cc0874-f275-49ea-819f-305ec314bdfe" /> <img width="797" height="757" alt="Screenshot 2026-04-17 at 14 12 13" src="https://github.com/user-attachments/assets/9048409b-d5a2-435a-b735-70370705e668" /> - Enable direct top-up (or subscription if in trial) from AI chat <img width="333" height="215" alt="Screenshot 2026-04-17 at 22 52 00" src="https://github.com/user-attachments/assets/7a20c627-2806-4bcf-a037-b45752232be9" /> <img width="457" height="769" alt="Screenshot 2026-04-17 at 22 51 41" src="https://github.com/user-attachments/assets/d2a90c1b-271f-4fe9-8891-baeb2fabb86d" /> - Inform users if credit limit is reached - Banner <img width="1130" height="127" alt="Screenshot 2026-04-17 at 19 15 11" src="https://github.com/user-attachments/assets/30723e5e-c07e-462f-8eb8-e08f52bbab1c" />	2026-04-20 08:43:02 +00:00
Félix Malfait	b292a93376	fix(server): honor X-Forwarded-* via configurable trust proxy (#19824 ) ## The bug Pasting `https://<workspace>.twenty.com/mcp` into an MCP client (Claude connector, etc.) fails discovery. Curl shows why: ```bash $ curl -si https://twentyfortwenty.twenty.com/.well-known/oauth-protected-resource HTTP/2 200 ... { \"resource\": \"http://{workspace}.twenty.com/mcp\", \"authorization_servers\": [\"http://twentyfortwenty.twenty.com\"], ... } ``` The response advertises `http://` even though the request came in on `https://`. RFC 9728 / RFC 8707 require the client to validate that the advertised `resource` matches the URL it connected to, so strict MCP clients reject the mismatch and OAuth never starts. ## Why request.protocol returns \"http\" Per [Express docs](https://expressjs.com/en/guide/behind-proxies.html), `request.protocol` returns the socket-level protocol unless `app.set('trust proxy', ...)` is configured. In our deployment: ``` client -- https --> Cloudflare -- https --> ingress-nginx -- http --> NestJS pod ``` TLS is terminated at the edge. The upstream TCP connection into the pod is plain HTTP, and nginx sets `X-Forwarded-Proto: https` for the pod to read. Without a `trust proxy` setting, Express ignores `X-Forwarded-Proto` and `request.protocol === 'http'`. `main.ts` currently has no `app.set('trust proxy', ...)` call anywhere. ## Why this only surfaced now `grep -rn request.protocol` finds three pre-existing call sites — `RestApiMetadataService`, `OpenApiService`, `RouteTriggerService`. All three wrap it in `getServerUrl({ serverUrlEnv: SERVER_URL, serverUrlFallback: \`${request.protocol}://${request.get('host')}\` })`, which returns `SERVER_URL` whenever it's non-empty. In production `SERVER_URL` is always set (e.g. \`api.twenty.com\`), so the \`request.protocol\` branch is effectively dead code there. #19755 introduced the first call site that uses `request.protocol` unconditionally — the OAuth discovery controller has to echo the request host, because the whole point is supporting multiple paste-able origins (workspace subdomains, custom domains, etc.). That's why this is the first \"wrong protocol\" bug anyone has seen in our app. ## The fix One line in `main.ts`: ```ts app.set('trust proxy', twentyConfigService.get('TRUST_PROXY')); ``` Backed by a new `TRUST_PROXY` env var with a default. `request.protocol` then honors `X-Forwarded-Proto`, `request.ip` honors `X-Forwarded-For`, etc. OAuth discovery URLs come out on the right scheme, and any future `request.protocol` callers Just Work. ## Why this needs to be configurable (not hardcoded) Twenty is open-source and deployed in at least three distinct topologies: 1. Kubernetes with ingress (us, enterprise self-hosters) — TLS terminated upstream, needs `trust proxy` on. 2. Self-host behind a user-supplied reverse proxy (Caddy, Traefik, nginx — our [recommended setup](https://twenty.com/developers/section/self-hosting)) — same as above, needs `trust proxy` on. 3. Self-host with NestJS exposed directly to the internet — no upstream proxy, needs `trust proxy` off (otherwise any curl with `X-Forwarded-For: 1.2.3.4` spoofs `request.ip`, poisoning rate-limiters and audit logs). There is no single static value that's correct for all three. Express makes this a setting for exactly this reason — we follow suit. ## Why the default is `'loopback, linklocal, uniquelocal'` Shorthand for loopback (127/8, ::1), link-local (169.254/16, fe80::/10), and unique-local (10/8, 172.16/12, 192.168/16, fc00::/7). In practical terms: trust peers coming from private networks; don't trust the public internet. This default is correct for shapes 1 and 2 (cloud, proxied self-host) because the ingress/proxy peer is always a private-network IP in every sane deployment. For shape 3 (directly exposed), the default is still safe because public clients have public IPs, which are not in any of those ranges — so `X-Forwarded-For` from an attacker on the internet is ignored. The only way to be bitten is the exotic case where a public client reaches NestJS through a private-network hop that isn't a proxy (e.g. a NAT appliance that forwards to the pod on a private IP and blindly appends headers). Narrow attack surface, and an operator running that kind of setup is expected to configure `TRUST_PROXY=false` explicitly. \"Safer than the naïve `true`, more useful than `false`\" — this matches what Rails, Django, and many other frameworks recommend for Kubernetes-style deployments. ## Why an env var instead of hardcoded - Rejecting hardcoded `true`: would expose shape-3 self-hosters to IP spoofing without a way to opt out. - Rejecting hardcoded `false`: would leave cloud + shape-2 self-hosters broken, same bug as today. - Accepting string-typed env (not boolean): Express's `trust proxy` accepts booleans, hop counts (`1`, `2`), IP ranges (`'10.0.0.0/8'`), and named CIDRs (`'loopback'`). A boolean would hide that flexibility; operators occasionally need the richer values. The string maps 1:1 onto what Express accepts. ## Deployment matrix \| Deployment \| Default works? \| Override needed? \| \|---\|---\|---\| \| Cloud (us, K8s + nginx ingress + Cloudflare) \| ✓ \| — \| \| Self-host behind reverse proxy (recommended) \| ✓ \| — \| \| Self-host exposed directly on public IP \| ✓ (public IPs not in private ranges) \| Optional: `TRUST_PROXY=false` for strictness \| \| Local dev (direct, no proxy) \| ✓ (no `X-Forwarded-*` headers arrive) \| — \| \| Exotic: multi-hop through non-sanitizing private-network middlebox \| Risky \| `TRUST_PROXY=false` \| ## Related - Blocks MCP connector OAuth on `<ws>.twenty.com` / custom domains. After deploy: `curl -s https://<ws>.twenty.com/.well-known/oauth-protected-resource \| jq .resource` should return `https://...` (not `http://...`). - Fixes latent issue in `RestApiMetadataService`, `OpenApiService`, `RouteTriggerService` fallback paths (pre-existing but dead in production because `SERVER_URL` is always set — no behavior change there). ## Test plan - [x] `tsc --noEmit` clean - [ ] After deploy: `curl -s https://twentyfortwenty.twenty.com/.well-known/oauth-protected-resource` returns `https://` URLs - [ ] After deploy: MCP connector in Claude successfully completes OAuth against `https://<ws>.twenty.com/mcp` - [ ] No change in `request.ip` logging behavior on cloud (nginx-ingress peer is already private-network, was already being trusted implicitly by every framework layer that wasn't `request.protocol`) 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-18 06:03:30 +02:00
Weiko	5cd8b7899d	shouldIncludeRecordPageLayouts deprecation (#19774 ) ## Context Deprecating shouldIncludeRecordPageLayouts in preparation for page layout release. See new workspace with standard page layout from standard app <img width="570" height="682" alt="Screenshot 2026-04-16 at 18 35 23" src="https://github.com/user-attachments/assets/bf7fa621-d40d-4c29-8d96-537c58b3eb40" />	2026-04-17 11:32:10 +00:00
Félix Malfait	455022f652	Add ClickHouse-backed metered credit cap enforcement (#19586 ) ## Summary Implements a ClickHouse-backed polling system to enforce metered-credit caps for workflow executions, replacing reliance on Stripe billing alerts. The system re-evaluates tier caps against live pricing on every poll cycle, allowing price/tier changes to propagate immediately without recreating Stripe alert objects. ## Key Changes - BillingUsageCapService: New service that queries ClickHouse for current-period credit usage and evaluates whether a subscription has reached its metered-credit allowance (tier cap + credit balance) - `isClickHouseEnabled()`: Checks if ClickHouse is configured - `getCurrentPeriodCreditsUsed()`: Sums creditsUsedMicro from usageEvent table for a workspace within a billing period - `evaluateCap()`: Determines if usage has reached the allowance by reading live pricing from the subscription - EnforceUsageCapJob: Cron job that polls all active subscriptions and updates `hasReachedCurrentPeriodCap` on metered items - Runs every 2 minutes to keep cap enforcement in sync with live usage - Supports shadow mode (log-only) via `BILLING_USAGE_CAP_CLICKHOUSE_ENABLED` flag for safe rollout - Continues processing after per-subscription errors with detailed logging - EnforceUsageCapCronCommand: CLI command to register the enforcement cron job - MeteredCreditService: Extracted `extractMeteredPricingInfoFromSubscription()` as a pure function for callers that already hold the subscription with pricing loaded, avoiding redundant DB queries - Configuration: Added `BILLING_USAGE_CAP_CLICKHOUSE_ENABLED` flag to control enforcement mode (active vs. shadow) - Constants: Added `METERED_OPERATION_TYPES` to define which operation types count toward the metered product's credit cap ## Implementation Details - The service queries ClickHouse for the sum of `creditsUsedMicro` in the current billing period, matching Stripe meter semantics - Pricing is re-read on every evaluation, so tier changes propagate within one poll cycle without Stripe alert recreation - The cron job only updates the database when the cap state actually changes (no-op if already in the correct state) - Shadow mode allows safe validation before enabling enforcement; transitions are logged but not persisted - Comprehensive test coverage for both the service and cron job, including error handling and state transitions https://claude.ai/code/session_01VksTSrYLXJVCPVBQhQdBTe --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-04-13 21:17:41 +02:00
Charles Bochet	c8f5ecb2b6	Add APPLICATION_LOG_DRIVER=CONSOLE to twenty-app-dev container (#19600 ) ## Summary - Enable application log console output in the `twenty-app-dev` Docker image by adding `APPLICATION_LOG_DRIVER=CONSOLE` to the Dockerfile ENV block - Rename `APPLICATION_LOG_DRIVER_TYPE` to `APPLICATION_LOG_DRIVER` and `ApplicationLogDriverType` to `ApplicationLogDriver` for consistency with all other driver config variables (`EMAIL_DRIVER`, `LOGGER_DRIVER`, `CAPTCHA_DRIVER`, etc.) - Add `APPLICATION_LOG_DRIVER` to `.env.example`	2026-04-12 11:55:38 +02:00
Félix Malfait	4c57352450	Improve sensitive config variable masking and editing UX (#19578 ) ## Summary This PR enhances the handling of sensitive configuration variables by improving masking logic and user experience when editing them. It adds metadata-aware masking for dynamically marked sensitive variables and clears sensitive values when entering edit mode. ## Key Changes - Backend masking improvements: Updated `maskSensitiveValue()` to accept metadata parameter, enabling masking of variables marked as sensitive via metadata (not just predefined masking config). Sensitive non-string values are masked as `******`. - Edit mode UX: When editing a sensitive variable, the value field is now cleared on entering edit mode to prevent exposing masked values and ensure users intentionally provide new secret values. - Form state tracking: Enhanced `useConfigVariableForm()` hook to accept an `isEditing` parameter and properly track value changes for sensitive variables during edit operations. - Input placeholder**: Updated placeholder text for sensitive variable inputs to show `Enter a new secret value` instead of the generic database storage message, providing clearer intent to users. ## Implementation Details - The `maskSensitiveValue()` method now checks both predefined masking configurations and runtime metadata to determine if a value should be masked - Sensitive string values use LAST_N_CHARS strategy (4 characters), while non-string values are masked uniformly - The form's `hasValueChanged` flag is set to true when editing sensitive variables to ensure proper validation and submission handling https://claude.ai/code/session_01JiTckmuVJMQWpJ7TUGwsqb --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-04-11 22:07:05 +02:00
Charles Bochet	36fbfca069	Add application-logs module with driver pattern for logic function log persistence (#19486 ) ## Summary - Introduces a new `application-logs` core module with a driver pattern (disabled/console/clickhouse) to capture and persist logic function execution logs - Adds a ClickHouse `applicationLog` table with per-line log storage, 30-day TTL, and `ORDER BY (workspaceId, timestamp, applicationId, logicFunctionId)` - Surfaces application logs in the existing frontend audit logs table as a new "Application Logs" source with dedicated columns (Function, Timestamp, Level, Message, Execution ID) ## Details Write path: `LogicFunctionExecutorService.handleExecutionResult()` parses the multi-line log string from driver output into individual `{ timestamp, level, message }` entries, generates an execution UUID, and passes them to `ApplicationLogsService.writeLogs()` which delegates to the configured driver. Driver pattern: Follows the exception-handler module style (Symbol injection token + `forRootAsync` dynamic module). Three drivers: - `DISABLED` (default) — no-op, prevents information leaking - `CONSOLE` — structured stdout logging with level-based `console.` calls - `CLICKHOUSE` — inserts rows into the `applicationLog` ClickHouse table Read path: Extends the existing event-logs module by adding `APPLICATION_LOG` to the `EventLogTable` enum, table name mapping, and normalization logic. Config*: New `APPLICATION_LOG_DRIVER_TYPE` environment variable (default: `DISABLED`).	2026-04-09 14:35:24 +00:00
Félix Malfait	6073bb6706	Fix AI model registry staleness on self-hosted instances (#19427 ) ## Summary Fixes #19422. Self-hosted users hitting "No AI models are available" after configuring API keys via the admin panel were victims of a stale `AiModelRegistryService` cache. Only the four `addAiProvider` / `removeAiProvider` / `addModelToProvider` / `removeModelFromProvider` mutations called `refreshRegistry()` — setting an API key through `set/update/deleteDatabaseConfigVariable` left the registry pointing at the pre-mutation provider state. Rather than patch each mutation site (and re-introduce the same class of bug on the next one), the registry now invalidates lazily based on the LLM config-group hash, mirroring the pattern `WebSearchDriverFactory` already uses via `DriverFactoryBase`. Any mutation to an LLM-tagged config variable is picked up automatically on the next read — callers never have to remember to refresh. - Extracted `getConfigGroupHash` into a shared util reused by both `DriverFactoryBase` and `AiModelRegistryService` (and switched the hash to `JSON.stringify` so object-typed config vars like `AI_PROVIDERS` actually contribute meaningfully). - `AiModelRegistryService` gates all internal `Map` access behind private getters that call `ensureFresh()`, so future read paths can't accidentally observe stale state. Build path uses underscored backing fields directly to avoid recursing. - Dropped the now-redundant `refreshRegistry()` public method and its four call sites in `admin-panel.resolver.ts`. ## Test plan - [x] `nx typecheck twenty-server` passes - [x] Existing admin-panel + ai-models specs pass (79 tests) - [ ] Manual: on a self-hosted instance, set `OPENAI_API_KEY` (or another provider key) via the admin panel `setDatabaseConfigVariable` mutation and confirm AI features work without a server restart - [ ] Manual: existing flows (`addAiProvider`, `addModelToProvider`, etc.) still pick up new providers on the next read 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-04-08 22:32:05 +02:00
neo773	fda3eabb5f	introduce MESSAGING_MESSAGES_GET_BATCH_SIZE as config variable (#19455 ) makes`MESSAGING_MESSAGES_GET_BATCH_SIZE` configurable for self hosters /closes #19147	2026-04-08 14:47:04 +00:00
Thomas Trompette	e048d03872	Improve workflow crons efficiency (#19381 ) Optimize workflow cron jobs: partition workspaces and use raw queries - Split all 3 workflow cron jobs (WorkflowRunEnqueueCronJob, WorkflowHandleStaledRunsCronJob, WorkflowCleanWorkflowRunsCronJob) to process only 1/10th of workspaces per invocation using minute-based partitioning, reducing per-run load - Replace ORM repository + workspace context loading with raw SQL queries in WorkflowRunEnqueueCronJob and WorkflowHandleStaledRunsCronJob, avoiding costly cache/metadata hydration for a simple existence check	2026-04-07 14:09:11 +00:00
Félix Malfait	ea572975d8	feat: generic web search driver abstraction with Exa support and billing (#19341 ) ## Summary - Introduces a pluggable `WebSearchDriver` abstraction (interface, factory, service, module) so web search is no longer tied to native provider tools (Anthropic/OpenAI) - Exa is the first driver implementation with support for category-filtered search (company, people, news, research paper, etc.) — particularly useful for CRM workflows - Per-query billing for both Exa ($0.007/query) and native provider surcharges ($0.01/query for Anthropic/OpenAI) via the existing `USAGE_RECORDED` pipeline - New config variables: `WEB_SEARCH_DRIVER` (EXA/DISABLED), `EXA_API_KEY`, `WEB_SEARCH_PREFER_NATIVE` (default false — prefers Exa over native when both available) - `WEB_SEARCH` operation type added for usage tracking and Stripe metering ### Architecture ``` WebSearchDriver (interface) ├── ExaDriver — Exa neural search with category support └── DisabledDriver — throws when search is disabled WebSearchDriverFactory (extends DriverFactoryBase) └── creates driver based on WEB_SEARCH_DRIVER config WebSearchService (facade) ├── search(query, options?, billingContext?) ├── isEnabled() └── emits USAGE_RECORDED events per query WebSearchTool (Tool implementation) └── registered in ActionToolProvider, available via tool catalog ``` ### Native search billing gap fixed Anthropic and OpenAI both charge $0.01/search on top of token costs. The token costs were already billed, but the per-call surcharge was not. Added `countNativeWebSearchCallsFromSteps` utility + `billNativeWebSearchUsage` to `AiBillingService`, wired into both chat and workflow agent paths. ## Test plan - [ ] Set `WEB_SEARCH_DRIVER=EXA` + `EXA_API_KEY=...` and verify AI chat can search the web - [ ] Verify category parameter works (ask about a specific company/person) - [ ] Set `WEB_SEARCH_DRIVER=DISABLED` and verify search tool is not exposed - [ ] Set `WEB_SEARCH_PREFER_NATIVE=true` with Anthropic model and verify native search is used - [ ] Verify usage events are emitted in ClickHouse for both Exa and native search paths - [ ] Verify existing billing tests pass (`npx jest ai-billing.service.spec.ts`) Made with [Cursor](https://cursor.com) --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>	2026-04-06 12:02:46 +02:00
Charles Bochet	81f10c586f	Add workspace DDL lock env var and maintenance mode UI (#19130 ) ## Summary - Add `WORKSPACE_SCHEMA_DDL_LOCKED` env-only boolean config variable that blocks all workspace schema DDL changes when set to `true`. This is intended for hot upgrades where logical replication cannot handle DDL changes. Enforced at two chokepoints: - `WorkspaceMigrationRunnerService.run` — blocks all metadata-driven DDL (object/field/index CRUD, app sync/uninstall, standard app sync, upgrade commands) - `WorkspaceDataSourceService.createWorkspaceDBSchema` / `deleteWorkspaceDBSchema` — blocks workspace creation (sign-up) and hard deletion. Uses a dedicated `WorkspaceDataSourceException` (not ForbiddenException) - Add maintenance mode feature with Admin Panel UI and user-facing banner: - Backend: `MaintenanceModeService` stores maintenance window (startAt, endAt, optional link) in `core.keyValuePair` as `CONFIG_VARIABLE`. Validates endAt > startAt. Uses `GraphQLISODateTime` scalar for date fields. Exposed via `clientConfig` REST endpoint and admin GraphQL mutations (`setMaintenanceMode`, `clearMaintenanceMode`) - Admin Panel: New "Maintenance Mode" section in Health tab with UTC datetime pickers and activate/deactivate controls - Banner: `InformationBannerMaintenance` displayed at the top of `DefaultLayout` for all users, using Temporal API for timezone-aware formatting with an optional "Learn more" link These two features are independent — the DDL lock is controlled via env var for operational use, while maintenance mode is a UI notification mechanism controlled from the admin panel.	2026-04-02 10:17:04 +00:00
martmull	fe1377f18b	Provide applicatiion assets (#18973 ) - improve backend - improve frontend <img width="1293" height="824" alt="image" src="https://github.com/user-attachments/assets/7a4633f1-85cd-4126-b058-dbeae6ba2218" />	2026-03-30 10:53:31 +02:00
Félix Malfait	895bb58fc6	feat: add S3 presigned URL redirect for file downloads (#18864 ) ## Summary - When `STORAGE_S3_PRESIGNED_URL_BASE` is configured, the file controller returns a 302 redirect to a presigned S3 URL instead of proxying every byte through the server. This eliminates server bandwidth and CPU overhead for S3-backed deployments. - For local storage or S3 without a public endpoint, behavior is unchanged (stream + pipe with security headers). - Added `getPresignedUrl` to the `StorageDriver` interface (required method returning `string \| null`), with implementations in S3Driver (uses a separate presign client with the public endpoint), LocalDriver (returns `null`), and ValidatedStorageDriver (path traversal protection + delegation). - Added a unified `getFileResponseById` method in `FileService` that performs a single DB lookup and returns either a redirect URL or a stream, avoiding double lookups. - Extracted `getContentDisposition` from the header util so both the proxy path and presigned URL path share the same inline/attachment allowlist. - Added MinIO service to `docker-compose.dev.yml` (optional `s3` profile) for local S3 testing. - Documented S3 presigned URL setup, CORS, and `nosniff` requirements in the self-hosting docs. ## Test plan - [x] All 63 unit tests pass across 5 test suites (util, S3 driver, validated driver, file storage service, controller) - [x] `npx nx typecheck twenty-server` passes - [ ] Manual E2E test with MinIO: `docker compose --profile s3 up -d`, configure S3 env vars, verify `curl -I` returns 302 with `Location` header pointing to MinIO - [ ] Verify local storage (no `STORAGE_S3_PRESIGNED_URL_BASE`) still streams files with 200 + security headers - [ ] Verify public assets endpoint still proxies (no redirect) Made with [Cursor](https://cursor.com)	2026-03-25 16:15:15 +01:00
Félix Malfait	908aefe7c1	feat: replace hardcoded AI model constants with JSON seed catalog (#18818 ) ## Summary - Replaces per-provider TypeScript constant files (`openai-models.const.ts`, `anthropic-models.const.ts`, etc.) with a single `ai-providers.json` catalog as the source of truth - Adds runtime model discovery via AI SDK for self-hosted providers, with `models.dev` enrichment for pricing/capabilities - Introduces composite model IDs (`provider/modelId`) for canonical, conflict-free identification - Simplifies provider configuration: API keys are injected from environment variables (e.g., `OPENAI_API_KEY`) - Adds admin panel UI for provider management (add/remove/test), model discovery, recommended model configuration, and default fast/smart model selection per workspace - Removes deprecated config variables (`AI_DISABLED_MODEL_IDS`, `AUTO_ENABLE_NEW_AI_MODELS`, etc.) - Adds database migration for composite model ID format ## Test plan - [ ] Server typecheck passes - [ ] Frontend typecheck passes - [ ] Server unit tests pass - [ ] Frontend unit tests pass - [ ] CI pipeline green - [ ] Admin panel AI tab loads correctly - [ ] Provider discovery works for configured providers - [ ] Model recommendation toggles persist - [ ] Default fast/smart model selection works Made with [Cursor](https://cursor.com)	2026-03-21 16:03:58 +01:00
Félix Malfait	c6f11d8adb	fix: migrate driver modules to DriverFactoryBase lazy-loading pattern (#18731 ) ## Summary - Migrates `LogicFunctionModule`, `CodeInterpreterModule`, and `CaptchaModule` from the `forRootAsync` + injection token pattern to the `DriverFactoryBase` lazy-loading pattern (matching `EmailModule` and `FileStorageModule`) - Fixes #18724 where `LOGIC_FUNCTION_TYPE` was not respected in worker processes because the driver was created at module boot time before the DB config cache was loaded - Removes `isEnvOnly` from `LOGIC_FUNCTION_TYPE`, `CODE_INTERPRETER_TYPE`, `CAPTCHA_DRIVER`, `IS_MULTIWORKSPACE_ENABLED`, and `FRONTEND_URL` — these can now be safely configured via the database at runtime ## How it works Each migrated module now uses a `DriverFactory` (extending `DriverFactoryBase`) instead of a module-level async factory + Symbol injection token: 1. Lazy creation: `getCurrentDriver()` creates the driver on first call, after `DatabaseConfigDriver.onModuleInit()` has loaded the DB cache 2. Auto-recreation: If config changes in the DB, the next `getCurrentDriver()` call detects the key mismatch and creates a new driver instance 3. Unified config: Both server and worker read from the same database — driver config only needs to be set once ### Files deleted (old pattern) - `logic-function-module.factory.ts`, `logic-function-drivers.module.ts`, `logic-function-driver.constants.ts` - `code-interpreter-module.factory.ts` - `captcha.module-factory.ts`, `captcha-driver.constants.ts` ### Files created (new pattern) - `logic-function-driver.factory.ts` - `code-interpreter-driver.factory.ts` - `captcha-driver.factory.ts` Net: -150 lines ## Test plan - [x] `npx nx typecheck twenty-server` passes - [x] `npx nx lint:diff-with-main twenty-server` passes - [ ] Integration tests pass (`npx nx run twenty-server:test:integration:with-db-reset`) - [ ] Verify logic functions execute in workflow runs (the original bug) - [ ] Verify code interpreter works in workflow code steps - [ ] Verify captcha validation works on sign-up (when captcha is configured) Made with [Cursor](https://cursor.com)	2026-03-18 16:00:45 +01:00
Charles Bochet	5dfdc1d81d	refactor: consolidate database query timeout config variables (#18670 ) ## Summary - Removes the redundant `DATABASE_STATEMENT_TIMEOUT_MS` config variable (default 15s) from `ConfigVariables` - Updates the core TypeORM datasource to use `PG_DATABASE_PRIMARY_TIMEOUT_MS` (default 10s) for its `query_timeout`, aligning it with the workspace datasource which already uses this variable - This consolidates two separate env vars that controlled the same concern (database query timeout) into a single one	2026-03-16 15:10:38 +01:00
Charles Bochet	0379aea0b1	fix: split tsvector migration, add configurable DB timeout, reorder 1.19 commands (#18614 ) ## Summary - Split tsvector migration into individual per-field transactions: each tsvector field now runs in its own `workspaceMigrationRunnerService.run()` call (its own DB transaction). Since STORED generated columns trigger full table rewrites, a timeout on one large table (e.g. `timelineActivity`) no longer rolls back the others. Each field has its own idempotency check, so the migration is fully resumable. - Add configurable `DATABASE_STATEMENT_TIMEOUT_MS` env var (default 15000ms): controls the `query_timeout` on the core datasource globally, allowing operators to raise it for long-running upgrade commands without code changes. - Reorder 1.19 upgrade commands: move `fixRoleAndAgentUniversalIdentifiersCommand` first so that subsequent commands see corrected universal identifiers.	2026-03-13 12:59:31 +01:00
Marie	c1da7be6d7	Billing for self-hosts (#18075 ) ## Summary Implements enterprise licensing and per-seat billing for self-hosted environments, with Stripe as the single source of truth for subscription data. ### Components - twenty-website hosts the private key to sign `ENTERPRISE_KEY` and `ENTERPRISE_VALIDITY_TOKEN`. It communicates with Stripe to emit the daily `ENTERPRISE_VALIDITY_TOKEN` if the subscription is active, based on the user's Stripe subscription ID stored in `ENTERPRISE_KEY`. - Stripe is the single source of truth for subscription data (status, seats, billing). - The client (twenty-server + DB + workers) saves `ENTERPRISE_KEY` in the `keyValuePair` table (or `.env` if `IS_CONFIG_VARIABLES_IN_DB_ENABLED` is false) and the daily-renewed `ENTERPRISE_VALIDITY_TOKEN` in the `appToken` table. `ENTERPRISE_VALIDITY_TOKEN` is verified client-side using a public key to grant access to enterprise features (RLS, SSO, audit logs, etc.). ### Flow 1. When requesting an upgrade to an enterprise plan (from Enterprise in settings), the user is shown a modal to choose monthly/yearly billing, then redirected to Stripe to enter payment details. After checkout, they land on twenty-website where they are exposed to their `ENTERPRISE_KEY`, which they paste in the UI. It is saved in the `keyValuePair` table. On activation, a first `ENTERPRISE_VALIDITY_TOKEN` with 30-day validity is stored in the `appToken` table. 2. Every day, a cron job runs and does two things: - Refreshes the validity token: communicates with twenty-website to get a new `ENTERPRISE_VALIDITY_TOKEN` with 30-day validity if the Stripe subscription is still active. If the subscription is in cancellation, the emitted token has a validity equal to the cancellation date. If it's no longer valid, the token is not replaced. The cron only needs to run every 30 days in practice, but runs daily so it's resilient to occasional failures. - Reports seat count: counts active (non-soft-deleted) `UserWorkspace` entries and sends the count to twenty-website, which updates the Stripe subscription quantity with proration. Seats are also reported on first activation. If the subscription is canceled or scheduled for cancellation, the seat update is skipped. 3. `ENTERPRISE_VALIDITY_TOKEN` is verified server-side via a public key to grant access to enterprise features. ### Key concepts Three distinct checks are exposed as GraphQL fields on `Workspace`: \| Field \| Meaning \| \|---\|---\| \| `hasValidEnterpriseKey` \| Has any valid enterprise key (signed JWT or legacy plain string) \| \| `hasValidSignedEnterpriseKey` \| `ENTERPRISE_KEY` is a properly signed JWT (billing portal makes sense) \| \| `hasValidEnterpriseValidityToken` \| `ENTERPRISE_VALIDITY_TOKEN` is present and not expired (expiration depends on signed token payload, not on "expiresAt" on appToken table which is only indicative) \| Feature access is gated by `isValid()` = `hasValidEnterpriseValidityToken \|\| hasValidEnterpriseKey` (to support both new and legacy keys during transition). After transition isValid() = hasValidEnterpriseValidityToken ### Frontend states The Enterprise settings page handles multiple states: - No key: show "Get Enterprise" with checkout modal - Orphaned validity token (token valid but no signed key): prompt user to set a valid enterprise key - Active/trialing but no validity token: show subscription status with a "Reload validity token" action - Active/trialing: show full subscription info, billing portal access, cancel option - Cancellation scheduled: show cancellation date, billing portal - Canceled: show billing history link and option to start a new subscription - Past due / Incomplete: prompt to update payment or restart ### Temporary retro-compatibility: legacy plain-text keys Previously, enterprise features were gated by a simple check: any non-empty string in `ENTERPRISE_KEY` granted access. With this PR, we transition to a controlled system relying on signed JWTs. To avoid breaking existing self-hosted users: - Legacy plain-text keys still grant access to enterprise features. `hasValidEnterpriseKey` returns `true` for both signed JWTs and plain strings, and `isValid()` checks `hasValidEnterpriseKey` as a fallback when no validity token is present. - A deprecation banner is shown at the top of the app when `hasValidEnterpriseKey` is `true` but `hasValidSignedEnterpriseKey` is `false`, informing the user that their key format is deprecated and they should activate a new signed key. - No billing portal or subscription management is available for legacy keys since there is no Stripe subscription to manage. This retro-compatibility will be removed in a future version. At that point, `isValid()` will only check `hasValidEnterpriseValidityToken`. ### Edge cases - Air-gapped / production environments: for self-hosted clients that block external traffic (or for our own production), provide a long-lived `ENTERPRISE_VALIDITY_TOKEN` (e.g. 99 years) directly in the `appToken` table, with no `ENTERPRISE_KEY`. The daily cron will skip the refresh (no enterprise key to authenticate with), but the pre-seeded validity token will be used to grant feature access. No billing or seat reporting occurs in this mode. - `IS_CONFIG_VARIABLES_IN_DB_ENABLED` is false: if the user tries to activate an enterprise key but DB config writes are disabled, the backend returns a clear error asking them to add `ENTERPRISE_KEY` to their `.env` file manually. - Canceled subscriptions: the `/seats` endpoint skips Stripe updates for canceled or cancellation-scheduled subscriptions to avoid Stripe API errors. ### How to test - launch twenty-website on a different url (eg localhost:1002) - add ENTERPRISE_API_URL=http://localhost:3002/api/enterprise (or else) in your server .env - ask me for twenty-website's .env file content (STRIPE_SECRET_KEY; STRIPE_ENTERPRISE_MONTHLY_PRICE_ID;STRIPE_ENTERPRISE_YEARLY_PRICE_ID; ENTERPRISE_JWT_PRIVATE_KEY; ENTERPRISE_JWT_PUBLIC_KEY; NEXT_PUBLIC_WEBSITE_URL) - visit Admin panel / enterprise	2026-03-12 15:07:53 +01:00
Félix Malfait	f0c83434a7	feat: default code interpreter and logic function to Disabled in production (#18559 ) ## Summary For security reasons, the code interpreter and logic function drivers now default based on `NODE_ENV`: - Production (`NODE_ENV=production` or unset): Default to Disabled - Development (`NODE_ENV=development`): Default to LOCAL for convenience This ensures self-hosted production deployments don't accidentally run user-provided code without explicit configuration. ## Changes ### Config (`config-variables.ts`) - `CODE_INTERPRETER_TYPE`: Disabled in prod, LOCAL in dev - `LOGIC_FUNCTION_TYPE`: Disabled in prod, LOCAL in dev ### Documentation (`setup.mdx`) - Added Security Defaults section explaining NODE_ENV-based behavior - Fixed variable names: `SERVERLESS_TYPE` → `LOGIC_FUNCTION_TYPE`, `SERVERLESS_LAMBDA_` → `LOGIC_FUNCTION_LAMBDA_` - Added Code Interpreter section with available drivers (Disabled, Local, E2B) ### Environment files - `.env.example`: Updated to `LOGIC_FUNCTION_TYPE` with comments - `.env.test`: Added `LOGIC_FUNCTION_TYPE=LOCAL` for logic function integration tests Made with [Cursor](https://cursor.com) --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>	2026-03-11 17:54:55 +01:00
martmull	d9b3507866	Run vulnerable operation in isolated environment (#18523 ) When driver = LAMBDA: - run esbuild ts transpilation on dedicated lambda - run yarn install on app dependencies on a dedicated lambda	2026-03-11 14:08:47 +00:00
Felipe	5ab3eeb830	fix: throw clear error on invalid LOG_LEVELS (#18495 ) Fixes #18356 ## Summary Setting `LOG_LEVELS=debug,info,error,warn` crashes with `TypeError: logLevels.map is not a function` because `CastToLogLevelArray` silently returns `undefined` for invalid levels. Now it throws a clear error message listing the invalid levels and valid options: ``` Invalid log level(s): info. Valid levels are: log, error, warn, debug, verbose ``` ## Changes - Throw descriptive `Error` when invalid log levels are provided instead of returning `undefined` - Updated tests to verify the error message ## Test plan - [x] All 8 existing tests passing - [x] `"toto"` → throws `Invalid log level(s): toto. Valid levels are: log, error, warn, debug, verbose` - [x] `"verbose,error,toto"` → throws listing only `toto` as invalid - [x] Valid levels (`log,error,warn,debug,verbose`) continue working as before	2026-03-09 15:41:15 +00:00
Charles Bochet	9d57bc39e5	Migrate from ESLint to OxLint (#18443 ) ## Summary Fully replaces ESLint with OxLint across the entire monorepo: - Replaced all ESLint configs (`eslint.config.mjs`) with OxLint configs (`.oxlintrc.json`) for every package: `twenty-front`, `twenty-server`, `twenty-emails`, `twenty-ui`, `twenty-shared`, `twenty-sdk`, `twenty-zapier`, `twenty-docs`, `twenty-website`, `twenty-apps/`, `create-twenty-app` - Migrated custom lint rules* from ESLint plugin format to OxLint JS plugin system (`@oxlint/plugins`), including `styled-components-prefixed-with-styled`, `no-hardcoded-colors`, `sort-css-properties-alphabetically`, `graphql-resolvers-should-be-guarded`, `rest-api-methods-should-be-guarded`, `max-consts-per-file`, and Jotai-related rules - Migrated custom rule tests from ESLint `RuleTester` + Jest to `oxlint/plugins-dev` `RuleTester` + Vitest - Removed all ESLint dependencies from `package.json` files and regenerated lockfiles - Updated Nx targets (`lint`, `lint:diff-with-main`, `fmt`) in `nx.json` and per-project `project.json` to use `oxlint` commands with proper `dependsOn` for plugin builds - Updated CI workflows (`.github/workflows/ci-.yaml`) — no more ESLint executor - Updated IDE setup: replaced `dbaeumer.vscode-eslint` with `oxc.oxc-vscode` extension, configured `source.fixAll.oxc` and format-on-save with Prettier - Replaced all `eslint-disable` comments* with `oxlint-disable` equivalents across the codebase - Updated docs (`twenty-docs`) to reference OxLint instead of ESLint - Renamed `twenty-eslint-rules` package to `twenty-oxlint-rules` ### Temporarily disabled rules (tracked in `OXLINT_MIGRATION_TODO.md`) \| Rule \| Package \| Violations \| Auto-fixable \| \|------\|---------\|-----------\|-------------\| \| `twenty/sort-css-properties-alphabetically` \| twenty-front \| 578 \| Yes \| \| `typescript/consistent-type-imports` \| twenty-server \| 3814 \| Yes \| \| `twenty/max-consts-per-file` \| twenty-server \| 94 \| No \| ### Dropped plugins (no OxLint equivalent) `eslint-plugin-project-structure`, `lingui/`, `@stylistic/`, `import/order`, `prefer-arrow/prefer-arrow-functions`, `eslint-plugin-mdx`, `@next/eslint-plugin-next`, `eslint-plugin-storybook`, `eslint-plugin-react-refresh`. Partial coverage for `jsx-a11y` and `unused-imports`. ### Additional fixes (pre-existing issues exposed by merge) - Fixed `EmailThreadPreview.tsx` broken import from main rename (`useOpenEmailThreadInSidePanel`) - Restored truthiness guard in `getActivityTargetObjectRecords.ts` - Fixed `AgentTurnResolver` return types to match entity (virtual `fileMediaType`/`fileUrl` are resolved via `@ResolveField()`) ## Test plan - [x] `npx nx lint twenty-front` passes - [x] `npx nx lint twenty-server` passes - [x] `npx nx lint twenty-docs` passes - [x] Custom oxlint rules validated with Vitest: `npx nx test twenty-oxlint-rules` - [x] `npx nx typecheck twenty-front` passes - [x] `npx nx typecheck twenty-server` passes - [x] CI workflows trigger correctly with `dependsOn: ["twenty-oxlint-rules:build"]` - [x] IDE linting works with `oxc.oxc-vscode` extension	2026-03-06 01:03:50 +01:00
Félix Malfait	0e89c96170	feat: add npm and tarball app distribution with upgrade mechanism (#18358 ) ## Summary - npm + tarball app distribution: Apps can be installed from the npm registry (public or private) or uploaded as `.tar.gz` tarballs, with `AppRegistrationSourceType` tracking the origin - Upgrade mechanism: `AppUpgradeService` checks for newer versions, supports rollback for npm-sourced apps, and a cron job runs every 6 hours to update `latestAvailableVersion` on registrations - Security hardening: Tarball extraction uses path traversal protection, and `enableScripts: false` in `.yarnrc.yml` disables all lifecycle scripts during `yarn install` to prevent RCE - Frontend: "Install from npm" and "Upload tarball" modals, upgrade button on app detail page, blue "Update" badge on installed apps table when a newer version is available - Marketplace catalog sync: Hourly cron job syncs a hardcoded catalog index into `ApplicationRegistration` entities - Integration tests: Coverage for install, upgrade, tarball upload, and catalog sync flows ## Backend changes \| Area \| Files \| \|------\|-------\| \| Entity & migration \| `ApplicationRegistrationEntity` (sourceType, sourcePackage, latestAvailableVersion), `ApplicationEntity` (applicationRegistrationId), migration \| \| Services \| `AppPackageResolverService`, `ApplicationInstallService`, `AppUpgradeService`, `MarketplaceCatalogSyncService` \| \| Cron jobs \| `MarketplaceCatalogSyncCronJob` (hourly), `AppVersionCheckCronJob` (every 6h) \| \| REST endpoint \| `AppRegistrationUploadController` — tarball upload with secure extraction \| \| Resolver \| `MarketplaceResolver` — simplified `installMarketplaceApp` (removed redundant `sourcePackage` arg) \| \| Security \| `.yarnrc.yml` — `enableScripts: false` to block postinstall RCE \| ## Frontend changes \| Area \| Files \| \|------\|-------\| \| Modals \| `SettingsInstallNpmAppModal`, `SettingsUploadTarballModal`, `SettingsAppModalLayout` \| \| Hooks \| `useUploadAppTarball`, `useInstallMarketplaceApp` (cleaned up) \| \| Upgrade UI \| `SettingsApplicationVersionContainer`, `SettingsApplicationDetailAboutTab` \| \| Badge \| `SettingsApplicationTableRow` — blue "Update" tag, `SettingsApplicationsInstalledTab` — fetches registrations for version comparison \| \| Styling \| Migrated to Linaria (matching main) \| ## Test plan - [ ] Install an app from npm via the "Install from npm" modal - [ ] Upload a `.tar.gz` tarball via the "Upload tarball" modal - [ ] Verify upgrade badge appears when `latestAvailableVersion > version` - [ ] Verify upgrade flow from app detail page - [ ] Run integration tests: `app-distribution.integration-spec.ts`, `marketplace-catalog-sync.integration-spec.ts` - [ ] Verify `enableScripts: false` blocks postinstall scripts during yarn install Made with [Cursor](https://cursor.com)	2026-03-05 10:34:08 +01:00
martmull	d021f7e369	Fix self host application (#18292 ) - Fixes self host application - add new telemetry information - add serverId to identify a server instance - remove .twenty from git tracking - tree-shake "twenty-sdk" usage in built logic functions and front components - fix "twenty-sdk" version usage - fix twenty-zapier cli --------- Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>	2026-03-02 12:06:05 +01:00
Félix Malfait	012d819557	OAuth Client — Unified ApplicationRegistration, OAuth server, and frontend (#18267 ) ## Summary Consolidates three separate PRs (#18260, #18261, #18262) into a single unified branch with all review feedback addressed: ### New features - ApplicationRegistration entity — server-level registration for OAuth apps with encrypted server variables - OAuth 2.0 server — authorization code, client credentials, refresh token grants with PKCE support - OAuth discovery endpoint — `.well-known/oauth-authorization-server` metadata - Frontend UI — app registration details page with credential management, redirect URI editing, and server variable configuration - CLI integration — `twenty dev` auto-registers apps and stores OAuth credentials locally - Authorize consent screen — OAuth consent page at `/authorize` showing requested scopes ### Review feedback addressed Renames (PR #18260): - `appRegistration` → `applicationRegistration` (entity, tables, files, imports, GraphQL types) - `appRegistrationVariable` → `applicationRegistrationVariable` - `clientId` → `oAuthClientId`, `clientSecretHash` → `oAuthClientSecretHash`, `redirectUris` → `oAuthRedirectUris`, `scopes` → `oAuthScopes` Security fixes (PR #18261): - Fixed redirect URI validation bypass when `oAuthRedirectUris` is an empty array - Fixed workspace isolation in `clientCredentialsGrant` — now uses `find()` with explicit handling for multiple installations - Added error logging in refresh token `catch` block instead of silently swallowing Code quality (PR #18262): - Split `VersionDistributionEntry` into its own file (one export per file) - Split GraphQL queries and mutations into individual files with a shared fragment - Removed unused `OAuth` entry from `AuthProviderEnum` - Added loading state to `handleRotateSecret` - Removed 27 narration-style comments from test files - Added proper guards (`PublicEndpointGuard`, `NoPermissionGuard`) to controllers and resolvers ## Test plan - [ ] Verify `twenty dev` registers an app and stores OAuth credentials - [ ] Test OAuth authorization code flow end-to-end (authorize → token → API call) - [ ] Test client credentials grant - [ ] Verify redirect URI validation rejects requests when no URIs are registered - [ ] Verify app registration detail page renders correctly - [ ] Test secret rotation with loading state - [ ] Verify server variable editing and saving - [ ] Run `npx nx database:reset twenty-server` to validate migration Closes #18260, #18261, #18262 Made with [Cursor](https://cursor.com) --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>	2026-02-28 14:07:49 +01:00
Félix Malfait	9a3852bf04	feat: add two-layer AI model availability filtering (#18170 ) ## Summary - Admin-level filtering: New AI tab in admin panel with server-wide model availability controls (whitelist/blacklist via `AI_AUTO_ENABLE_NEW_MODELS`, `AI_DISABLED_MODEL_IDS`, `AI_ENABLED_MODEL_IDS` config variables). Dedicated `setAdminAiModelEnabled` mutation replaces frontend config-variable manipulation. Filter dropdown to show/hide unconfigured and deprecated models. - Workspace-level filtering: Per-workspace controls with "Use best models only" mode (curated list backed by `isRecommended` flag), or custom whitelist/blacklist. Separate Smart/Fast model selectors with "Best (...)" virtual options. - Security enforcement: Both layers enforced at every backend execution point — workspace update, agent create/update, chat execution. Model ID validated against known models before config mutation. All admin endpoints protected by `AdminPanelGuard`. ## Changes ### Backend (`twenty-server`) - New config variables for admin-level model filtering - `AiModelRegistryService`: `getAllModelsWithStatus()`, `setModelAdminEnabled()` with model ID validation, `isModelAdminAllowed()` - `AdminPanelResolver`: `getAdminAiModels` query, `setAdminAiModelEnabled` mutation - `WorkspaceEntity`: new fields (`autoEnableNewAiModels`, `disabledAiModelIds`, `enabledAiModelIds`, `useRecommendedModels`) - `WorkspaceService`: model validation on `smartModel`/`fastModel` updates - `AgentResolver`: model availability checks on create/update - `isModelAllowedByWorkspace` centralized utility - `isRecommended` flag on model definitions - Two TypeORM migrations ### Frontend (`twenty-front`) - New `SettingsAdminAI` component with search, filter dropdown (unconfigured/deprecated), and model toggle cards - AI tab added to admin panel navigation - `useWorkspaceAiModelAvailability` hook for workspace-level filtering - `SettingsAIModelsTab` redesigned: merged sections, "Use best models only" toggle, conditional available models list - `getModelIcon`/`getModelProviderLabel` shared utilities with GraphQL enum casing normalization - Updated generated GraphQL types and mock data ## Test plan - [ ] Toggle models on/off in admin panel AI tab and verify they appear/disappear in workspace settings - [ ] Enable "Use best models only" in workspace settings and verify only recommended models are selectable - [ ] Disable recommended mode and verify whitelist/blacklist toggles work correctly - [ ] Verify deprecated models hidden by default, shown greyed out when filter enabled - [ ] Verify unconfigured models hidden by default, shown disabled when filter enabled - [ ] Try setting a disabled model as Smart/Fast model — should be rejected - [ ] Try creating an agent with a disabled model — should be rejected - [ ] Verify admin panel AI tab requires admin access Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-02-24 10:14:24 +01:00
Félix Malfait	41f09c5a4c	Add AI model pricing, Bedrock provider, and InferenceProvider/ModelFamily split (#18155 ) ## Summary - Model pricing overhaul: All model constants updated with accurate pricing in dollars per 1M tokens, including cached input rates, cache creation rates, and tiered >200k context pricing - New providers: Added Google (Gemini 3.x), Mistral, and AWS Bedrock as inference providers. Bedrock serves Claude Opus 4.6 and Sonnet 4.6 via AWS, with proper credential handling following the existing S3/SES pattern - InferenceProvider/ModelFamily split: Refactored `ModelProvider` into two orthogonal enums — `InferenceProvider` (who serves the model: auth, SDK, metadata format) and `ModelFamily` (who created it: token counting semantics). This eliminates growing `\|\|` chains for token normalization checks like `excludesCachedTokens` - Billing improvements: Reasoning tokens charged at output rate, cache token discounts applied accurately, real errors thrown to Sentry on billing failures ## Test plan - [x] All existing unit tests updated and passing (23 tests across 3 test files) - [x] Lint passes for both twenty-server and twenty-front - [ ] CI checks pass Made with [Cursor](https://cursor.com) --------- Co-authored-by: Cursor <cursoragent@cursor.com>	2026-02-22 14:39:04 +01:00
neo773	7de565f70c	Prevent SSRF via IMAP/SMTP/CalDAV (#17973 ) Prevents leaking of internal services by filtering out private IPs, same way we do for webhooks	2026-02-18 22:15:10 +01:00
Félix Malfait	3216b634a3	feat: improve AI chat - system prompt, tool output, context window display (#17769 ) ⚠️ AI-generated PR — not ready for review ⚠️ cc @FelixMalfait --- ## Changes ### System prompt improvements - Explicit skill-before-tools workflow to prevent the model from calling tools without loading the matching skill first - Data efficiency guidance (default small limits, use filters) - Pluralized `load_skill` → `load_skills` for consistency with `load_tools` ### Token usage reduction - Output serialization layer: strips null/undefined/empty values from tool results - Lowered default `find_` limit from 100 → 10, max from 1000 → 100 ### System object tool generation - System objects (calendar events, messages, etc.) now generate AI tools - Only workflow-related and favorite-related objects are excluded ### Context window display fix - Bug: UI compared cumulative tokens (sum of all turns) against single-request context window → showed 100% after a few turns - Fix*: Track `conversationSize` (last step's `inputTokens`) which represents the actual conversation history size sent to the model - New `conversationSize` column on thread entity with migration ### Workspace AI instructions - Support for custom workspace-level AI instructions --------- Co-authored-by: claude[bot] <41898282+claude[bot]@users.noreply.github.com>	2026-02-09 14:26:02 +01:00

1 2 3

132 Commits