Commit Graph

149 Commits

Author SHA1 Message Date
Abdullah. 793dc3d6fc Remove dependency on lodash.pick. (#15213)
Fixes [Dependabot Alert
85](https://github.com/twentyhq/twenty/security/dependabot/85) -
prototype pollution in lodash.

Added a shared pick helper (with unit tests) in twenty-shared and
refactored front-end/server code to import { pick } from the shared
barrel instead of lodash.pick.

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: martmull <martmull@hotmail.fr>
2025-10-21 08:19:49 +00:00
Abdullah. 75ddafec03 chore (security): bump up the axios version in server to resolve a couple dependabot alerts. (#15128)
Fixes [Dependabot Alert
283](https://github.com/twentyhq/twenty/security/dependabot/283) and
[Dependabot Alert
284](https://github.com/twentyhq/twenty/security/dependabot/284) - Axios
vulnerable to Denial-of-Service (DoS) due to missing data size
validation.
2025-10-16 13:39:09 +02:00
Antoine Moreaux bc2070410c chore(dependencies): remove unused dependencies from package.json and… (#14914)
… yarn.lock
2025-10-06 14:38:44 +00:00
Antoine Moreaux db7fe8b327 chore(dependencies): upgrade @nestjs/devtools-integration to v0.2.1… (#14912)
… and update peer dependencies
2025-10-06 15:14:57 +02:00
Antoine Moreaux 143d5b8061 chore(dependencies): bump @node-saml/node-saml to 5.1.0 and `@node-… (#14911)
…saml/passport-saml` to ^5.1.0 in `yarn.lock` and `package.json`
2025-10-06 15:14:02 +02:00
Antoine Moreaux 5623364c4b chore(dependencies): remove unused Monaco Editor packages (#14913) 2025-10-06 15:11:34 +02:00
martmull 31b73c3580 esBuild serverless (#14886)
Use [esbuild](https://esbuild.github.io/) to Build serverless entire
folder instead of just the src/index.ts file. Application serverless
folders can contain code organized in folders

## Small example

This now works:

<img width="1330" height="686" alt="image"
src="https://github.com/user-attachments/assets/e0639517-492d-4b64-8722-18bbe94dacb0"
/>
2025-10-06 10:47:42 +02:00
Antoine Moreaux d4160bf064 feat(redis): add support for dedicated queue client configuration (#14840)
Fix https://github.com/twentyhq/core-team-issues/issues/452
Fix https://github.com/twentyhq/core-team-issues/issues/923

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
2025-10-02 19:14:12 +02:00
Omar Eltomy 2af20a4cf0 Add UTC timezone label to CRON trigger form (#14674)
- Added 'Cron will be triggered at UTC time' notice below trigger
interval dropdown
- Positioned correctly between dropdown and expression field to match
design
- Only shows when Custom CRON option is selected

---------

Co-authored-by: Félix Malfait <felix@twenty.com>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
2025-09-24 19:45:56 +02:00
neo773 a1ad8e3a1e Outbound message domains (#14557)
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-09-24 10:33:04 +02:00
Abdul Rahman 216d72b5d7 AI SDK v5 migration (#14549)
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-09-22 22:13:43 +02:00
Arik Chakma 9a2766feae feat: rich text email body (#14482)
Co-authored-by: Raphaël Bosi <71827178+bosiraphael@users.noreply.github.com>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-09-21 16:55:34 +02:00
Abdul Rahman 172cc12a82 feat: Add xAI models support (#14523) 2025-09-16 17:55:11 +02:00
Félix Malfait 30a2164980 First Application POC (#14382)
Quick proof of concept for twenty-apps + twenty-cli, with local
development / hot reload

Let's discuss it!



https://github.com/user-attachments/assets/c6789936-cd5f-4110-a265-863a6ac1af2d
2025-09-10 15:12:38 +02:00
martmull a722d97724 14066 extensibility add coretriggerroute table (#14241)
This Pr 
- adds a `route` table to the core schema
- adds a controller to trigger route

For now, we need to add a `/s/<workspace_id>` prefix to all routes

We plan to create a custom domain table in order to let the users create
subdomains for their workspace, and so to link their routes to a
subdomain. Thank to that, we will be able to identify workspace_id from
domain name, and the prefix could be `/s`. If we create a native
dedicated subdomain for routes for each workspaces, the prefix could be
completely removed!

Here the follow up ticket to do that ->
https://github.com/twentyhq/twenty/issues/14240
2025-09-02 11:24:59 +02:00
Charles Bochet 1607f5ab41 Add dagrejs on server (#14152) 2025-08-29 15:17:53 +02:00
neo773 44916afcdd fix extract-message-util preserve line break for multi line HTML text (#13983)
Upon more testing with titan email I found emails with multi line text
did not preserve line break in HTML, this fixes it.
2025-08-20 07:49:05 +02:00
Félix Malfait 3c0f3fd2ae Run yarn dedupe and upgrade TS (#13853)
Upgrading TS to the latest version, and cleaning up packages with yarn
dedupe
2025-08-12 15:18:59 +02:00
Félix Malfait 8b59fcaea7 Remove preconstruct, update wyw (#13844)
To simplify our setup, moving back to Vite to build twenty-shared.

Also upgrading wyw

---------

Co-authored-by: prastoin <paul@twenty.com>
2025-08-12 12:43:35 +02:00
Félix Malfait af2dace71c chore: scope package.json deps to packages (#13835)
- Move dev-only types to devDependencies
- Move frontend-only deps from root to twenty-front
- Add website-only deps to twenty-website
- Fix react-phone-number-input patch path

CI should validate.
2025-08-12 07:15:20 +02:00
Charles Bochet b55a48139c Remove hoisting on server (#13821)
Testing a different approach to fix broken buildPackageJson on server
build

How i have tested:

A. Local contributor setup
- run yarn
- build server
- run yarn workspace focus
- run server on dist

B. self-host
- docker build

Note: I think the dependencies I have added are suboptimized as the
image went from 2GB to 3.5GB. We might need to be more accurate
2025-08-11 15:58:05 +02:00
Félix Malfait 033bedde0a Upgrade NX (#13758)
Upgrade from NX18 to NX21
2025-08-08 10:38:12 +02:00
Paul Rastoin 5476164a28 Expect node 24.5.0 (#13734)
Unless I'm mistaken the project does not run with node `24.0.0`
Switching to node `24.5.0` ( as defined in vscode node runtime
requirements in https://github.com/twentyhq/twenty/pull/13730 ) seems to
fix the issue
```ts
Successfully compiled: 2897 files with swc (188.32ms)
(node:77006) [DEP0190] DeprecationWarning: Passing args to a child process with shell option true can lead to security vulnerabilities, as the arguments are not escaped, only concatenated.
(Use `node --trace-deprecation ...` to show where the warning was created)
Watching for file changes.

/Users/paulrastoin/ws/twenty/node_modules/buffer-equal-constant-time/index.js:37
var origSlowBufEqual = SlowBuffer.prototype.equal;
                                  ^
TypeError: Cannot read properties of undefined (reading 'prototype')
```

Updating engines so local constraint suggest a functional node version
2025-08-07 16:22:28 +00:00
Félix Malfait 05c6805f0a Upgrade to Node 24 (#13730)
As described in title
2025-08-07 17:02:12 +02:00
Charles Bochet d62a1e0b5a Re add graphql middlware (#13644) 2025-08-05 15:57:37 +02:00
Félix Malfait d3fc1cd837 Remove unused dependencies (#13611)
Cleaning up unused dependencies
2025-08-04 22:44:24 +02:00
Antoine Moreaux 23353e31e6 feat(domain-manager): refactor custom domain validation and improve c… (#13388) 2025-08-01 09:01:27 +02:00
Antoine Moreaux 11abe5440b feat(ai): add mcp-metadata (#13150)
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-07-16 21:32:32 +02:00
neo773 3e8fa3120d feat: CalDav Driver (#13170)
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
2025-07-15 17:41:23 +02:00
Paul Rastoin 3c5595e4ff Nitpick: psl types (#12925)
Close https://github.com/twentyhq/twenty/issues/12917
2025-06-27 14:31:27 +02:00
Abdul Rahman 65df511179 feat: Add AI Agent workflow action node (#12650)
https://github.com/user-attachments/assets/8593e488-cb00-4fd2-b903-5ba5766e0254

---------

Co-authored-by: Antoine Moreaux <moreaux.antoine@gmail.com>
Co-authored-by: martmull <martmull@hotmail.fr>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Baptiste Devessier <baptiste@devessier.fr>
Co-authored-by: Joseph Chiang <josephj6802@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: Guillim <guillim@users.noreply.github.com>
Co-authored-by: Raphaël Bosi <71827178+bosiraphael@users.noreply.github.com>
Co-authored-by: Lucas Bordeau <bordeau.lucas@gmail.com>
Co-authored-by: Marie <51697796+ijreilly@users.noreply.github.com>
Co-authored-by: Naifer <161821705+omarNaifer12@users.noreply.github.com>
Co-authored-by: prastoin <paul@twenty.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions <github-actions@twenty.com>
Co-authored-by: Thomas Trompette <thomas.trompette@sfr.fr>
Co-authored-by: Etienne <45695613+etiennejouan@users.noreply.github.com>
Co-authored-by: Ajay A Adsule <103304466+AjayAdsule@users.noreply.github.com>
Co-authored-by: bosiraphael <raphael.bosi@gmail.com>
Co-authored-by: Charles Bochet <charles@twenty.com>
Co-authored-by: Marty <91310557+real-marty@users.noreply.github.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Paul Rastoin <45004772+prastoin@users.noreply.github.com>
Co-authored-by: Weiko <corentin@twenty.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
Co-authored-by: nitin <142569587+ehconitin@users.noreply.github.com>
2025-06-22 21:42:04 +02:00
Félix Malfait 322c8a1852 Upgrade to Node22 (#12488)
BlocknoteJS requires an ESM module where our server is CJS, this forced
us to pin the server-util version, which led us to force the resolution
of several packages, leading to bugs downstream.

From Node 22.12 Node supports requiring ESM modules (available from Node
22.0 with a flag). So I upgrade the module.
I picked Node 22 and not Node 23 or Node 24 because 22 is the LTS and we
don't plan to change node versions frequently.

If you remain on Node 18, things should still mostly work, except if you
edit a Rich Text field.

I also starting changing the default runtime for Serverless Functions
which isn't directly related. This means new serverless functions will
be created on Node 22, but we will still need another PR to migrate
existing serverless functions before September (end of support by AWS).

(In this PR I also remove the upgrade commands from 0.43 since they rely
on Blocknote and I didn't want to have to deal with this)

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2025-06-06 18:35:30 +02:00
Félix Malfait b481abbb0f Begin refactoring AI module (#12464)
Cleaning up to prepare for a few tests
2025-06-05 12:28:42 +02:00
Charles Bochet a4f190b913 Fix datasource race condition on migrate (#12350) 2025-05-28 13:31:02 +02:00
Paul Rastoin 97d4ec96af Fix view filter update and deletion propagation (#12082)
# Introduction

Diff description: ~500 tests and +500 additions

close https://github.com/twentyhq/core-team-issues/issues/731

## What has been done here
In a nutshell on a field metadata type ( `SELECT MULTI_SELECT` ) update,
we will be browsing all `ViewFilters` in a post hook searching for some
referencing related updated `fieldMetadata` select. In order to update
or delete the `viewFilter` depending on the associated mutations.

## How to test:
- Add FieldMetadata `SELECT | MULTI_SELECT` to an existing or a new
`objectMetadata`
- Create a filtered view on created `fieldMetadata` with any options you
would like
- Remove some options ( in the best of the world some that are selected
by the filter ) from the `fieldMetadata` settings page
- Go back to the filtered view, removed or updated options should have
been hydrated in the `displayValue` and the filtered data should make
sense

## All filtered options are deleted edge case
If an update implies that a viewFilter does not have any existing
related options anymore, then we remove the viewFilter

## Testing
```sh 
PASS  test/integration/metadata/suites/field-metadata/update-one-field-metadata-related-record.integration-spec.ts (27 s)
  update-one-field-metadata-related-record
    SELECT
      ✓ should delete related view filter if all select field options got deleted (2799 ms)
      ✓ should update related multi selected options view filter (1244 ms)
      ✓ should update related solo selected option view filter (1235 ms)
      ✓ should handle partial deletion of selected options in view filter (1210 ms)
      ✓ should handle reordering of options while maintaining view filter values (1487 ms)
      ✓ should handle no changes update of options while maintaining existing view filter values (1174 ms)
      ✓ should handle adding new options while maintaining existing view filter (1174 ms)
      ✓ should update display value with options label if less than 3 options are selected (1249 ms)
      ✓ should throw error if view filter value is not a stringified JSON array (1300 ms)
    MULTI_SELECT
      ✓ should delete related view filter if all select field options got deleted (1127 ms)
      ✓ should update related multi selected options view filter (1215 ms)
      ✓ should update related solo selected option view filter (1404 ms)
      ✓ should handle partial deletion of selected options in view filter (1936 ms)
      ✓ should handle reordering of options while maintaining view filter values (1261 ms)
      ✓ should handle no changes update of options while maintaining existing view filter values (1831 ms)
      ✓ should handle adding new options while maintaining existing view filter (1610 ms)
      ✓ should update display value with options label if less than 3 options are selected (1889 ms)
      ✓ should throw error if view filter value is not a stringified JSON array (1365 ms)

Test Suites: 1 passed, 1 total
Tests:       18 passed, 18 total
Snapshots:   18 passed, 18 total
Time:        27.039 s
```
## Out of scope
- We should handle ViewFilter validation when extracting its definition
from the metadata
https://github.com/twentyhq/core-team-issues/issues/1009

## Concerns
- Are we able through the api to update an RATING fieldMetadata ? ( if
yes than that's an issue and we should handle RATING the same way than
for SELECT and MULTI_SELECT )
- It's not possible to group a view from a MULTI_SELECT field

The above points create a double nor a triple "lecture" to the post hook
effect:
- ViewGroup -> only SELECT
- VIewFilter -> only SELECT || MULTI_SELECT
- Rating nothing
I think we should determine the scope of all of that

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
2025-05-28 10:22:28 +00:00
Félix Malfait 7b78b64bca Update clickhouse tables (#11905)
Following a discussion with @Bonapara - changing the base tables
2025-05-07 09:39:18 +02:00
nitin a15b87649a Twenty config core implementation (#11595)
closes https://github.com/twentyhq/core-team-issues/issues/760

---------

Co-authored-by: Charles Bochet <charlesBochet@users.noreply.github.com>
Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-04-26 09:21:59 +02:00
Félix Malfait 93c2ba153b Add clickhouse prod migration command (#11695)
Add a missing command to launch clickhouse migrations the same way we
launch postgres migrations
2025-04-23 13:02:00 +02:00
Félix Malfait 24873d0c1d Remove versions from package.json (#11658)
Now the source of truth for the version is set during the build process.
We set it as an environment variable from the tags.
We could add it back to the package.json during the build process (from
the git tag), but there is not use for it at the moment since it's not
npm packages.
2025-04-19 23:03:06 +02:00
Antoine Moreaux 587281a541 feat(analytics): add clickhouse (#11174) 2025-04-16 16:33:10 +00:00
martmull 82fa71c2cd Update canary package versions (#11543)
as title
2025-04-11 16:48:41 +02:00
Weiko 3357f93415 Bump 0.51.0-canary (#11329) 2025-04-02 09:23:17 +02:00
Etienne 391392dd87 set up metrics collecting with open telemetry (#11236)
Done :  
- move metrics and health cache services from health module to metrics
module
- refactor metrics counter from specific method to set up from enum keys
- add OpenTelemetry (Otel) instrumentation for metrics
- set up Otel SDK to send metrics to Otel collector

To do later : 
- implement Otel instrumentation for traces + plug Sentry on top
2025-03-28 08:45:24 +01:00
Charles Bochet ca9c070945 Fix activity (#11015)
Deprecating unused states and making sure that the ActivityRichText
editor loads when activity.bodyV2 is present
2025-03-19 10:45:11 +01:00
Félix Malfait d0c31d3f71 Fix missing translations for advanced mode toggle (#10931)
Advanced mode toggle was in `twenty-ui` which doesn't support Lingui.

I removed lingui from the global package json and moved it to the local
package.json instead to prevent that kind of error from happening again
2025-03-17 10:09:07 +01:00
Marie 37d7c0c994 Bump version to 0.44.0-canary (#10702) 2025-03-06 16:50:22 +01:00
Antoine Moreaux 1b98f40f17 feat(custom-domain): enable UI for custom domain (#10062) 2025-02-10 08:43:13 +00:00
Guillim 9d24bfb747 preparing version 0.42-caanry (#9938) 2025-02-03 10:53:05 +01:00
Antoine Moreaux e895aa27e6 feat(custom-domains): allow to register a custom domain (without UI) (#9879)
# In this PR
- Allow to register a custom domain
- Refacto subdomain generation

# In other PRs
- Add UI to deal with a custom domain
- Add logic to work with custom domain
2025-01-30 13:51:16 +01:00
Nicolas Rouanne 17def223b6 Feat/2fa (#9634)
# Description
Closes #7003 
Implements 2FA with TOTP. 

>[!WARNING]
> This is a draft PR, with only partial changes, made as a mean of
discussion about #7003 (it's easier to reason about real code)

## Behaviour
- a `totpSecret` is stored for each user
- use [`otplib`](https://github.com/yeojz/otplib/tree/master) to create
a QR code and to validate an `otp` against an `totpSecret` (great [demo
website](https://otplib.yeojz.dev/) by `otplib`)
- OTP is asked upon each login attempt

## Source
Inspired by:
- [RFC 6238](https://datatracker.ietf.org/doc/html/rfc6238)
- Cal.com's implementation of 2FA, namely
- [raising a
401](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/packages/features/auth/lib/next-auth-options.ts#L188-L190)
when missing OTP and 2FA is enabled, with a [specific error
code](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/packages/features/auth/lib/ErrorCode.ts#L9)
- [catching the
401](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/apps/web/modules/auth/login-view.tsx#L160)
in the frontend and
[displaying](https://github.com/calcom/cal.com/blob/c21ba636d2bec4ed55775f0b058f70fdc371c410/apps/web/modules/auth/login-view.tsx#L276)
the OTP input

## Remaining
- [ ] encrypt `totpSecret` at rest using a symetric algorithm

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-01-24 18:23:57 +01:00