Félix Malfait
8cb88cabee
## Customer-reported bug
A customer hit this when using the AI chat:
```json
{
"message": "API key 760d4822-da40-4b3f-9031-40563d7ed6c9 has no role assigned",
"extensions": {
"code": "INTERNAL_SERVER_ERROR",
"userFriendlyMessage": "This API key has no role assigned."
}
}
```
Their integration authenticates via API key. Somewhere along the way,
the role bound to that API key was deleted, leaving the API key
authenticated but role-less. Any request that hits a permission check
(`getRoleIdForApiKeyId`) blows up.
## Root cause
In `RoleService.deleteManyRoles`, the pre-deletion cleanup
(`assignDefaultRoleToMembersWithRoleToDelete`) only rebinds **user
workspaces** to the workspace default role. API keys and agents pointing
at the role are ignored. Because `RoleTargetEntity.role` declares
`onDelete: 'CASCADE'`, the FK then drops the role_target rows for those
API keys / agents — but the API keys themselves stay in `api_key`, now
orphaned in `apiKeyRoleMap`.
A previous read-side workaround
([2767ddac44](https://github.com/twentyhq/twenty/commit/2767ddac44) —
make the `role` ResolveField nullable) handled the API-key-details page,
but did not address the write paths (`getRoleIdForApiKeyId`).
## Fix
- Rename `assignDefaultRoleToMembersWithRoleToDelete` →
`rebindTargetsOfRoleToDeleteToDefaultRole` and extend it to rebind API
keys (via `ApiKeyRoleService.assignRoleToApiKey`) and agents (via
`AiAgentRoleService.assignRoleToAgent`) in the same step, before the
role is deleted.
- If the workspace default role doesn't satisfy `canBeAssignedToApiKeys`
/ `canBeAssignedToAgents`, the inner `assignRoleTo*` validation throws.
We catch that and rethrow as a `PermissionsException` with a
role-deletion-context message and two new codes —
`ROLE_CANNOT_BE_ASSIGNED_TO_API_KEYS` /
`ROLE_CANNOT_BE_ASSIGNED_TO_AGENTS` — so the admin sees a clear
"reassign these first" prompt rather than a confusing inner error.
## Scope / non-goals
- **Already-orphaned API keys are not auto-healed.** The customer still
needs to reassign a role to their existing orphan API key via the UI
(Settings > API Keys > [the key] > role). A separate cleanup command for
existing orphans is a follow-up.
- I did not investigate *why* the customer's session was authenticated
via API key in the AI chat — that may be their integration setup. Worth
confirming with them separately.
## Test plan
- [ ] Workspace with default role `Admin` (which has
`canBeAssignedToApiKeys: true`): create an API key with a custom role,
delete the custom role → API key is rebound to Admin, requests keep
working.
- [ ] Workspace with default role `Member` (default, has
`canBeAssignedToApiKeys: false`): create an API key with a custom role,
delete the custom role → role deletion fails with the new
`ROLE_CANNOT_BE_ASSIGNED_TO_API_KEYS` error explaining the admin must
reassign first. API key + custom role are both unchanged.
- [ ] Same two scenarios for agents (`canBeAssignedToAgents`).
- [ ] Existing user-workspace rebind behavior is unchanged.
- [ ] Role deletion with no dependent API keys / agents still works.
83 lines
4.0 KiB
TypeScript
83 lines
4.0 KiB
TypeScript
import { msg } from '@lingui/core/macro';
|
|
import { assertUnreachable } from 'twenty-shared/utils';
|
|
|
|
import {
|
|
ForbiddenError,
|
|
NotFoundError,
|
|
UserInputError,
|
|
} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
|
|
import {
|
|
type PermissionsException,
|
|
PermissionsExceptionCode,
|
|
} from 'src/engine/metadata-modules/permissions/permissions.exception';
|
|
|
|
export const permissionGraphqlApiExceptionHandler = (
|
|
error: PermissionsException,
|
|
) => {
|
|
switch (error.code) {
|
|
case PermissionsExceptionCode.PERMISSION_DENIED:
|
|
throw new ForbiddenError(error.message, {
|
|
userFriendlyMessage: msg`User does not have permission.`,
|
|
subCode: error.code,
|
|
});
|
|
case PermissionsExceptionCode.NO_AUTHENTICATION_CONTEXT:
|
|
throw new ForbiddenError(error.message, {
|
|
userFriendlyMessage: msg`No valid authentication context found.`,
|
|
subCode: error.code,
|
|
});
|
|
case PermissionsExceptionCode.ROLE_LABEL_ALREADY_EXISTS:
|
|
throw new ForbiddenError(error);
|
|
case PermissionsExceptionCode.CANNOT_UNASSIGN_LAST_ADMIN:
|
|
case PermissionsExceptionCode.CANNOT_UPDATE_SELF_ROLE:
|
|
case PermissionsExceptionCode.CANNOT_DELETE_LAST_ADMIN_USER:
|
|
case PermissionsExceptionCode.ROLE_NOT_EDITABLE:
|
|
case PermissionsExceptionCode.CANNOT_ADD_OBJECT_PERMISSION_ON_SYSTEM_OBJECT:
|
|
case PermissionsExceptionCode.CANNOT_ADD_FIELD_PERMISSION_ON_SYSTEM_OBJECT:
|
|
throw new ForbiddenError(error);
|
|
case PermissionsExceptionCode.INVALID_ARG:
|
|
case PermissionsExceptionCode.INVALID_SETTING:
|
|
case PermissionsExceptionCode.CANNOT_GIVE_WRITING_PERMISSION_ON_NON_READABLE_OBJECT:
|
|
case PermissionsExceptionCode.CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION:
|
|
case PermissionsExceptionCode.ONLY_FIELD_RESTRICTION_ALLOWED:
|
|
case PermissionsExceptionCode.FIELD_RESTRICTION_ONLY_ALLOWED_ON_READABLE_OBJECT:
|
|
case PermissionsExceptionCode.FIELD_RESTRICTION_ON_UPDATE_ONLY_ALLOWED_ON_UPDATABLE_OBJECT:
|
|
case PermissionsExceptionCode.EMPTY_FIELD_PERMISSION_NOT_ALLOWED:
|
|
case PermissionsExceptionCode.ROLE_MUST_HAVE_AT_LEAST_ONE_TARGET:
|
|
case PermissionsExceptionCode.ROLE_CANNOT_BE_ASSIGNED_TO_USERS:
|
|
case PermissionsExceptionCode.ROLE_CANNOT_BE_ASSIGNED_TO_API_KEYS:
|
|
case PermissionsExceptionCode.ROLE_CANNOT_BE_ASSIGNED_TO_AGENTS:
|
|
throw new UserInputError(error);
|
|
case PermissionsExceptionCode.ROLE_NOT_FOUND:
|
|
case PermissionsExceptionCode.OBJECT_METADATA_NOT_FOUND:
|
|
case PermissionsExceptionCode.FIELD_METADATA_NOT_FOUND:
|
|
case PermissionsExceptionCode.FIELD_PERMISSION_NOT_FOUND:
|
|
case PermissionsExceptionCode.PERMISSION_NOT_FOUND:
|
|
throw new NotFoundError(error);
|
|
case PermissionsExceptionCode.UPSERT_FIELD_PERMISSION_FAILED:
|
|
case PermissionsExceptionCode.DEFAULT_ROLE_NOT_FOUND:
|
|
case PermissionsExceptionCode.WORKSPACE_ID_ROLE_USER_WORKSPACE_MISMATCH:
|
|
case PermissionsExceptionCode.TOO_MANY_ADMIN_CANDIDATES:
|
|
case PermissionsExceptionCode.USER_WORKSPACE_ALREADY_HAS_ROLE:
|
|
case PermissionsExceptionCode.ADMIN_ROLE_NOT_FOUND:
|
|
case PermissionsExceptionCode.DEFAULT_ROLE_CANNOT_BE_DELETED:
|
|
case PermissionsExceptionCode.WORKSPACE_MEMBER_NOT_FOUND:
|
|
case PermissionsExceptionCode.UNKNOWN_OPERATION_NAME:
|
|
case PermissionsExceptionCode.UNKNOWN_REQUIRED_PERMISSION:
|
|
case PermissionsExceptionCode.NO_ROLE_FOUND_FOR_USER_WORKSPACE:
|
|
case PermissionsExceptionCode.NO_PERMISSIONS_FOUND_IN_DATASOURCE:
|
|
case PermissionsExceptionCode.METHOD_NOT_ALLOWED:
|
|
case PermissionsExceptionCode.RAW_SQL_NOT_ALLOWED:
|
|
case PermissionsExceptionCode.OBJECT_PERMISSION_NOT_FOUND:
|
|
case PermissionsExceptionCode.API_KEY_ROLE_NOT_FOUND:
|
|
case PermissionsExceptionCode.JOIN_COLUMN_NAME_REQUIRED:
|
|
case PermissionsExceptionCode.COMPOSITE_TYPE_NOT_FOUND:
|
|
case PermissionsExceptionCode.USER_WORKSPACE_NOT_FOUND:
|
|
case PermissionsExceptionCode.APPLICATION_ROLE_NOT_FOUND:
|
|
case PermissionsExceptionCode.ROLE_BELONGS_TO_ANOTHER_APPLICATION:
|
|
throw error;
|
|
default: {
|
|
return assertUnreachable(error.code);
|
|
}
|
|
}
|
|
};
|