Files
twenty/packages/twenty-server/test/integration/metadata/suites/object-metadata/object-metadata-i18n.integration-spec.ts
T
Marie bc28e1557c Introduce updateWorkspaceMemberSettings and clarify product (#19441)
## Summary

Introduces a dedicated **metadata** mutation to update **standard
(non-custom)** workspace member settings, moves profile-related UI to
use it, and aligns **workspace member** record permissions with the rest
of the CRM so users cannot escalate visibility via RLS by editing their
own member record.

## Product behaviour

### Profile and appearance (standard fields)

- Users can still update **their own** standard workspace member fields
that the product exposes in **Settings / Profile** (e.g. name, locale,
color scheme, avatar flow) via the new
**`updateWorkspaceMemberSettings`** mutation.
- The mutation returns a **boolean**; the app **merges** the updated
fields into local state so the UI stays in sync without refetching the
full workspace member record.
- **Locale** changes also keep **`userWorkspace`** in sync when a locale
is present in the payload (including from the workspace `updateOne` path
when applicable).

### Custom fields on workspace members

- The dedicated metadata mutation **rejects** any **custom** workspace
member field (and unknown keys). Those updates must go through the
normal **object** `updateOne` pipeline, which is subject to **object-
and field-level** permissions like other records. But since we don't
have object- and field-level permission configuration for system objects
yet, this permission is derived from Workspace member settings
permission.
- **Workspace member** is no longer exempt from ORM permission
validation for updates merely because it is a **system** object. Users
who **do not** have workspace member access (e.g. no **Workspace
members** settings permission and no equivalent broad settings access on
the role) **cannot** use `updateOne` on `workspaceMember` to change
**custom** (or other) fields on their own row—even though that row is
used for RLS predicates.
- This closes a path where someone could widen what they can see by
writing to fields that drive row-level rules.

### Who can change another member

- Updating **another** user’s workspace member still requires
**Workspace members** (or equivalent) settings permission, consistent
with admin tooling.
2026-04-14 16:29:00 +00:00

118 lines
3.4 KiB
TypeScript

import request from 'supertest';
import { WORKSPACE_MEMBER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/workspace-member-data-seeds.constant';
const client = request(`http://localhost:${APP_PORT}`);
const objectsQuery = {
query: `
query ObjectsI18n {
objects(paging: { first: 100 }) {
edges {
node {
nameSingular
labelSingular
labelPlural
description
isCustom
}
}
}
}
`,
};
type ObjectNode = {
nameSingular: string;
labelSingular: string;
labelPlural: string;
description: string;
isCustom: boolean;
};
const updateWorkspaceMemberLocale = async (locale: string) => {
const response = await client
.post('/metadata')
.set('Authorization', `Bearer ${APPLE_JANE_ADMIN_ACCESS_TOKEN}`)
.send({
query: `
mutation UpdateWorkspaceMemberSettings(
$input: UpdateWorkspaceMemberSettingsInput!
) {
updateWorkspaceMemberSettings(input: $input)
}
`,
variables: {
input: {
workspaceMemberId: WORKSPACE_MEMBER_DATA_SEED_IDS.JANE,
update: { locale },
},
},
});
expect(response.body.errors).toBeUndefined();
expect(response.body.data.updateWorkspaceMemberSettings).toBe(true);
};
const queryMetadataObjects = () =>
client
.post('/metadata')
.set('Authorization', `Bearer ${APPLE_JANE_ADMIN_ACCESS_TOKEN}`)
.send(objectsQuery);
const findObjectByName = (
edges: Array<{ node: ObjectNode }>,
nameSingular: string,
): ObjectNode | undefined =>
edges.find((edge) => edge.node.nameSingular === nameSingular)?.node;
describe('object metadata i18n', () => {
afterAll(async () => {
await updateWorkspaceMemberLocale('en');
});
it('should return English labels when user locale is en', async () => {
const response = await queryMetadataObjects();
expect(response.body.data).toBeDefined();
expect(response.body.errors).toBeUndefined();
const edges = response.body.data.objects.edges;
const company = findObjectByName(edges, 'company');
expect(company).toBeDefined();
expect(company!.labelSingular).toBe('Company');
expect(company!.labelPlural).toBe('Companies');
expect(company!.description).toBe('A company');
});
it('should return French labels when user locale is fr-FR', async () => {
await updateWorkspaceMemberLocale('fr-FR');
const response = await queryMetadataObjects();
expect(response.body.data).toBeDefined();
expect(response.body.errors).toBeUndefined();
const edges = response.body.data.objects.edges;
const company = findObjectByName(edges, 'company');
const person = findObjectByName(edges, 'person');
const opportunity = findObjectByName(edges, 'opportunity');
expect(company).toBeDefined();
expect(company!.labelSingular).toBe('Entreprise');
expect(company!.labelPlural).toBe('Entreprises');
expect(company!.description).toBe('Une entreprise');
expect(person).toBeDefined();
expect(person!.labelSingular).toBe('Personne');
expect(person!.labelPlural).toBe('Personnes');
expect(person!.description).toBe('Une personne');
expect(opportunity).toBeDefined();
expect(opportunity!.labelSingular).toBe('Opportunité');
expect(opportunity!.labelPlural).toBe('Opportunités');
expect(opportunity!.description).toBe('Une opportunité');
});
});