Files
twenty/packages/twenty-server/test/integration/metadata/suites/application-registration-variable/utils/application-registration-variable-api.util.ts
T
Félix Malfait 0e89c96170 feat: add npm and tarball app distribution with upgrade mechanism (#18358)
## Summary

- **npm + tarball app distribution**: Apps can be installed from the npm
registry (public or private) or uploaded as `.tar.gz` tarballs, with
`AppRegistrationSourceType` tracking the origin
- **Upgrade mechanism**: `AppUpgradeService` checks for newer versions,
supports rollback for npm-sourced apps, and a cron job runs every 6
hours to update `latestAvailableVersion` on registrations
- **Security hardening**: Tarball extraction uses path traversal
protection, and `enableScripts: false` in `.yarnrc.yml` disables all
lifecycle scripts during `yarn install` to prevent RCE
- **Frontend**: "Install from npm" and "Upload tarball" modals, upgrade
button on app detail page, blue "Update" badge on installed apps table
when a newer version is available
- **Marketplace catalog sync**: Hourly cron job syncs a hardcoded
catalog index into `ApplicationRegistration` entities
- **Integration tests**: Coverage for install, upgrade, tarball upload,
and catalog sync flows

## Backend changes

| Area | Files |
|------|-------|
| Entity & migration | `ApplicationRegistrationEntity` (sourceType,
sourcePackage, latestAvailableVersion), `ApplicationEntity`
(applicationRegistrationId), migration |
| Services | `AppPackageResolverService`, `ApplicationInstallService`,
`AppUpgradeService`, `MarketplaceCatalogSyncService` |
| Cron jobs | `MarketplaceCatalogSyncCronJob` (hourly),
`AppVersionCheckCronJob` (every 6h) |
| REST endpoint | `AppRegistrationUploadController` — tarball upload
with secure extraction |
| Resolver | `MarketplaceResolver` — simplified `installMarketplaceApp`
(removed redundant `sourcePackage` arg) |
| Security | `.yarnrc.yml` — `enableScripts: false` to block postinstall
RCE |

## Frontend changes

| Area | Files |
|------|-------|
| Modals | `SettingsInstallNpmAppModal`, `SettingsUploadTarballModal`,
`SettingsAppModalLayout` |
| Hooks | `useUploadAppTarball`, `useInstallMarketplaceApp` (cleaned up)
|
| Upgrade UI | `SettingsApplicationVersionContainer`,
`SettingsApplicationDetailAboutTab` |
| Badge | `SettingsApplicationTableRow` — blue "Update" tag,
`SettingsApplicationsInstalledTab` — fetches registrations for version
comparison |
| Styling | Migrated to Linaria (matching main) |

## Test plan

- [ ] Install an app from npm via the "Install from npm" modal
- [ ] Upload a `.tar.gz` tarball via the "Upload tarball" modal
- [ ] Verify upgrade badge appears when `latestAvailableVersion >
version`
- [ ] Verify upgrade flow from app detail page
- [ ] Run integration tests: `app-distribution.integration-spec.ts`,
`marketplace-catalog-sync.integration-spec.ts`
- [ ] Verify `enableScripts: false` blocks postinstall scripts during
yarn install


Made with [Cursor](https://cursor.com)
2026-03-05 10:34:08 +01:00

155 lines
4.3 KiB
TypeScript

import {
createApplicationRegistrationVariableMutationFactory,
deleteApplicationRegistrationVariableMutationFactory,
findApplicationRegistrationVariablesQueryFactory,
updateApplicationRegistrationVariableMutationFactory,
} from 'test/integration/metadata/suites/application-registration-variable/utils/application-registration-variable-query-factories.util';
import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
import { type ApplicationRegistrationVariableEntity } from 'src/engine/core-modules/application/application-registration/application-registration-variable.entity';
type VariableFields = Pick<
ApplicationRegistrationVariableEntity,
| 'id'
| 'key'
| 'description'
| 'isSecret'
| 'isRequired'
| 'isFilled'
| 'createdAt'
| 'updatedAt'
>;
const handleExpectation = (
response: { body: { errors?: unknown[]; data?: unknown } },
expectToFail: boolean | undefined,
operationName: string,
) => {
if (expectToFail === true) {
warnIfNoErrorButExpectedToFail({
response: response as never,
errorMessage: `${operationName} should have failed but did not`,
});
}
if (expectToFail === false) {
warnIfErrorButNotExpectedToFail({
response: response as never,
errorMessage: `${operationName} has failed but should not`,
});
}
};
export const findApplicationRegistrationVariables = async ({
applicationRegistrationId,
expectToFail,
token,
}: {
applicationRegistrationId: string;
expectToFail?: boolean;
token?: string;
}): CommonResponseBody<{
findApplicationRegistrationVariables: VariableFields[];
}> => {
const graphqlOperation = findApplicationRegistrationVariablesQueryFactory({
applicationRegistrationId,
});
const response = await makeMetadataAPIRequest(graphqlOperation, token);
handleExpectation(response, expectToFail, 'Find variables');
return { data: response.body.data, errors: response.body.errors };
};
export const createApplicationRegistrationVariable = async ({
applicationRegistrationId,
key,
value,
description,
isSecret,
expectToFail,
token,
}: {
applicationRegistrationId: string;
key: string;
value: string;
description?: string;
isSecret?: boolean;
expectToFail?: boolean;
token?: string;
}): CommonResponseBody<{
createApplicationRegistrationVariable: VariableFields;
}> => {
const graphqlOperation = createApplicationRegistrationVariableMutationFactory(
{
applicationRegistrationId,
key,
value,
description,
isSecret,
},
);
const response = await makeMetadataAPIRequest(graphqlOperation, token);
handleExpectation(response, expectToFail, 'Create variable');
return { data: response.body.data, errors: response.body.errors };
};
export const updateApplicationRegistrationVariable = async ({
id,
value,
description,
expectToFail,
token,
}: {
id: string;
value?: string;
description?: string;
expectToFail?: boolean;
token?: string;
}): CommonResponseBody<{
updateApplicationRegistrationVariable: VariableFields;
}> => {
const graphqlOperation = updateApplicationRegistrationVariableMutationFactory(
{
id,
value,
description,
},
);
const response = await makeMetadataAPIRequest(graphqlOperation, token);
handleExpectation(response, expectToFail, 'Update variable');
return { data: response.body.data, errors: response.body.errors };
};
export const deleteApplicationRegistrationVariable = async ({
id,
expectToFail,
token,
}: {
id: string;
expectToFail?: boolean;
token?: string;
}): CommonResponseBody<{
deleteApplicationRegistrationVariable: boolean;
}> => {
const graphqlOperation = deleteApplicationRegistrationVariableMutationFactory(
{ id },
);
const response = await makeMetadataAPIRequest(graphqlOperation, token);
handleExpectation(response, expectToFail, 'Delete variable');
return { data: response.body.data, errors: response.body.errors };
};