3bec43696f
Implements permission intersection (AND logic) to prevent permission escalation when agents act on behalf of users. ### Changes: - **Permission Intersection**: Operations requiring both user AND agent permissions - **RoleContext Type**: Unified type supporting single `roleId` or multiple `roleIds` for intersection - **CRUD Services**: Updated to accept `roleContext` for granular permission control - **Agent Integration**: Chat agents now use user + agent role intersection for all operations - **ORM Layer**: Enhanced `getRepository` to support multi-role permission checks ### Related: - Part 2 of ["Acting on behalf of user" concept PR](https://github.com/twentyhq/twenty/pull/15103) [Closes #1661](https://github.com/twentyhq/core-team-issues/issues/1661) --------- Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
93 lines
3.4 KiB
TypeScript
93 lines
3.4 KiB
TypeScript
import { Injectable } from '@nestjs/common';
|
|
|
|
import { QUERY_MAX_RECORDS } from 'twenty-shared/constants';
|
|
import { type ObjectRecord } from 'twenty-shared/types';
|
|
|
|
import {
|
|
GraphqlQueryBaseResolverService,
|
|
type GraphqlQueryResolverExecutionArgs,
|
|
} from 'src/engine/api/graphql/graphql-query-runner/interfaces/base-resolver-service';
|
|
import { type WorkspaceQueryRunnerOptions } from 'src/engine/api/graphql/workspace-query-runner/interfaces/query-runner-option.interface';
|
|
import { type DestroyOneResolverArgs } from 'src/engine/api/graphql/workspace-resolver-builder/interfaces/workspace-resolvers-builder.interface';
|
|
|
|
import {
|
|
GraphqlQueryRunnerException,
|
|
GraphqlQueryRunnerExceptionCode,
|
|
} from 'src/engine/api/graphql/graphql-query-runner/errors/graphql-query-runner.exception';
|
|
import { ObjectRecordsToGraphqlConnectionHelper } from 'src/engine/api/graphql/graphql-query-runner/helpers/object-records-to-graphql-connection.helper';
|
|
import { buildColumnsToReturn } from 'src/engine/api/graphql/graphql-query-runner/utils/build-columns-to-return';
|
|
|
|
@Injectable()
|
|
export class GraphqlQueryDestroyOneResolverService extends GraphqlQueryBaseResolverService<
|
|
DestroyOneResolverArgs,
|
|
ObjectRecord
|
|
> {
|
|
async resolve(
|
|
executionArgs: GraphqlQueryResolverExecutionArgs<DestroyOneResolverArgs>,
|
|
): Promise<ObjectRecord> {
|
|
const { authContext, objectMetadataItemWithFieldMaps, objectMetadataMaps } =
|
|
executionArgs.options;
|
|
|
|
const queryBuilder = executionArgs.repository.createQueryBuilder(
|
|
objectMetadataItemWithFieldMaps.nameSingular,
|
|
);
|
|
|
|
const columnsToReturn = buildColumnsToReturn({
|
|
select: executionArgs.graphqlQuerySelectedFieldsResult.select,
|
|
relations: executionArgs.graphqlQuerySelectedFieldsResult.relations,
|
|
objectMetadataItemWithFieldMaps,
|
|
objectMetadataMaps,
|
|
});
|
|
|
|
const deletedObjectRecords = await queryBuilder
|
|
.delete()
|
|
.where({ id: executionArgs.args.id })
|
|
.returning(columnsToReturn)
|
|
.execute();
|
|
|
|
if (!deletedObjectRecords.affected) {
|
|
throw new GraphqlQueryRunnerException(
|
|
'Record not found',
|
|
GraphqlQueryRunnerExceptionCode.RECORD_NOT_FOUND,
|
|
);
|
|
}
|
|
|
|
if (executionArgs.graphqlQuerySelectedFieldsResult.relations) {
|
|
await this.processNestedRelationsHelper.processNestedRelations({
|
|
objectMetadataMaps,
|
|
parentObjectMetadataItem: objectMetadataItemWithFieldMaps,
|
|
parentObjectRecords:
|
|
deletedObjectRecords.generatedMaps as ObjectRecord[],
|
|
relations: executionArgs.graphqlQuerySelectedFieldsResult.relations,
|
|
limit: QUERY_MAX_RECORDS,
|
|
authContext,
|
|
workspaceDataSource: executionArgs.workspaceDataSource,
|
|
rolePermissionConfig: executionArgs.rolePermissionConfig,
|
|
selectedFields: executionArgs.graphqlQuerySelectedFieldsResult.select,
|
|
});
|
|
}
|
|
|
|
const typeORMObjectRecordsParser =
|
|
new ObjectRecordsToGraphqlConnectionHelper(objectMetadataMaps);
|
|
|
|
return typeORMObjectRecordsParser.processRecord({
|
|
objectRecord: deletedObjectRecords.generatedMaps[0] as ObjectRecord,
|
|
objectName: objectMetadataItemWithFieldMaps.nameSingular,
|
|
take: 1,
|
|
totalCount: 1,
|
|
});
|
|
}
|
|
|
|
async validate(
|
|
args: DestroyOneResolverArgs,
|
|
_options: WorkspaceQueryRunnerOptions,
|
|
): Promise<void> {
|
|
if (!args.id) {
|
|
throw new GraphqlQueryRunnerException(
|
|
'Missing id',
|
|
GraphqlQueryRunnerExceptionCode.INVALID_QUERY_INPUT,
|
|
);
|
|
}
|
|
}
|
|
}
|