nitin
db0547f503
Split of #20377. ## Summary This PR separates available permission flags from per-role permission flag grants. Previously, `core.permissionFlag` stored the role assignment directly: `roleId + flag`. This PR renames that legacy grant table to `core.rolePermissionFlag`, then recreates `core.permissionFlag` as the catalog of available permission flags. ## What changed - Rename the existing `core.permissionFlag` grant table to `core.rolePermissionFlag`. - Add the new syncable `core.permissionFlag` catalog entity with key, label, description, icon, permission type, relevance flags, and custom/standard metadata. - Add stable `SystemPermissionFlag` universal identifiers for the built-in `PermissionFlagType` values. - Seed the standard permission flags for every workspace under the Twenty standard application. - Backfill existing role grants: - create missing catalog rows for existing grant keys, - add `rolePermissionFlag.permissionFlagId`, - migrate grants from the old string `flag` column to the new catalog FK, - replace the old `(flag, roleId)` uniqueness with `(permissionFlagId, roleId)`. - Rewire role permission flag caches, permission checks, role DTO mapping, and `upsertPermissionFlags` to resolve through the catalog. - Keep the existing public role permission API shape: product/app surfaces still talk about `permissionFlags` and return `{ id, roleId, flag }`. - Update metadata flat-entity machinery, migration builders, validators, action handlers, snapshots, generated schemas, docs, and app fixtures for the new `permissionFlag` / `rolePermissionFlag` split. ## Behavior after this PR - Existing permission flag grants keep working. - Existing GraphQL role permission flows keep the same public naming. - Standard permission flags are represented as catalog rows. - Permission checks now compare grants through catalog universal identifiers instead of the legacy `flag` column. - Workspace deletion cleanup now verifies both `permissionFlag` and `rolePermissionFlag`. ## What is not in this PR - Public GraphQL CRUD for custom permission flags. - App manifest support for declaring new custom permission flags. - Frontend UI for creating or assigning custom permission flags beyond the existing role permission flow. --------- Co-authored-by: Weiko <corentin@twenty.com>
89 lines
4.2 KiB
TypeScript
89 lines
4.2 KiB
TypeScript
import { Module } from '@nestjs/common';
|
|
import { APP_FILTER } from '@nestjs/core';
|
|
|
|
import { AiAgentMonitorModule } from 'src/engine/metadata-modules/ai/ai-agent-monitor/ai-agent-monitor.module';
|
|
import { AiAgentModule } from 'src/engine/metadata-modules/ai/ai-agent/ai-agent.module';
|
|
import { AiChatModule } from 'src/engine/metadata-modules/ai/ai-chat/ai-chat.module';
|
|
import { AiGenerateTextModule } from 'src/engine/metadata-modules/ai/ai-generate-text/ai-generate-text.module';
|
|
import { CalendarChannelMetadataModule } from 'src/engine/metadata-modules/calendar-channel/calendar-channel-metadata.module';
|
|
import { ConnectedAccountMetadataModule } from 'src/engine/metadata-modules/connected-account/connected-account-metadata.module';
|
|
import { CommandMenuItemModule } from 'src/engine/metadata-modules/command-menu-item/command-menu-item.module';
|
|
import { FieldMetadataModule } from 'src/engine/metadata-modules/field-metadata/field-metadata.module';
|
|
import { FlatEntityMapsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/flat-entity/filters/flat-entity-maps-graphql-api-exception.filter';
|
|
import { FrontComponentModule } from 'src/engine/metadata-modules/front-component/front-component.module';
|
|
import { LogicFunctionLayerModule } from 'src/engine/metadata-modules/logic-function-layer/logic-function-layer.module';
|
|
import { LogicFunctionModule } from 'src/engine/metadata-modules/logic-function/logic-function.module';
|
|
import { MessageChannelMetadataModule } from 'src/engine/metadata-modules/message-channel/message-channel-metadata.module';
|
|
import { MessageFolderMetadataModule } from 'src/engine/metadata-modules/message-folder/message-folder-metadata.module';
|
|
import { NavigationMenuItemModule } from 'src/engine/metadata-modules/navigation-menu-item/navigation-menu-item.module';
|
|
import { ObjectMetadataModule } from 'src/engine/metadata-modules/object-metadata/object-metadata.module';
|
|
import { PermissionFlagModule } from 'src/engine/metadata-modules/permission-flag/permission-flag.module';
|
|
import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
|
|
import { MinimalMetadataModule } from 'src/engine/metadata-modules/minimal-metadata/minimal-metadata.module';
|
|
import { RoleModule } from 'src/engine/metadata-modules/role/role.module';
|
|
import { RouteTriggerModule } from 'src/engine/metadata-modules/route-trigger/route-trigger.module';
|
|
import { SearchFieldMetadataModule } from 'src/engine/metadata-modules/search-field-metadata/search-field-metadata.module';
|
|
import { SkillModule } from 'src/engine/metadata-modules/skill/skill.module';
|
|
import { ViewModule } from 'src/engine/metadata-modules/view/view.module';
|
|
import { WebhookModule } from 'src/engine/metadata-modules/webhook/webhook.module';
|
|
import { WorkspaceMetadataVersionModule } from 'src/engine/metadata-modules/workspace-metadata-version/workspace-metadata-version.module';
|
|
|
|
@Module({
|
|
imports: [
|
|
FieldMetadataModule,
|
|
FrontComponentModule,
|
|
ObjectMetadataModule,
|
|
SearchFieldMetadataModule,
|
|
LogicFunctionModule,
|
|
LogicFunctionLayerModule,
|
|
SkillModule,
|
|
CommandMenuItemModule,
|
|
NavigationMenuItemModule,
|
|
AiAgentModule,
|
|
AiAgentMonitorModule,
|
|
AiChatModule,
|
|
AiGenerateTextModule,
|
|
MinimalMetadataModule,
|
|
ViewModule,
|
|
WorkspaceMetadataVersionModule,
|
|
RoleModule,
|
|
PermissionsModule,
|
|
PermissionFlagModule,
|
|
RouteTriggerModule,
|
|
WebhookModule,
|
|
ConnectedAccountMetadataModule,
|
|
MessageChannelMetadataModule,
|
|
CalendarChannelMetadataModule,
|
|
MessageFolderMetadataModule,
|
|
],
|
|
providers: [
|
|
{
|
|
provide: APP_FILTER,
|
|
useClass: FlatEntityMapsGraphqlApiExceptionFilter,
|
|
},
|
|
],
|
|
exports: [
|
|
FieldMetadataModule,
|
|
FrontComponentModule,
|
|
ObjectMetadataModule,
|
|
SearchFieldMetadataModule,
|
|
LogicFunctionModule,
|
|
SkillModule,
|
|
CommandMenuItemModule,
|
|
NavigationMenuItemModule,
|
|
AiAgentModule,
|
|
AiChatModule,
|
|
MinimalMetadataModule,
|
|
ViewModule,
|
|
RoleModule,
|
|
PermissionsModule,
|
|
PermissionFlagModule,
|
|
WebhookModule,
|
|
ConnectedAccountMetadataModule,
|
|
MessageChannelMetadataModule,
|
|
CalendarChannelMetadataModule,
|
|
MessageFolderMetadataModule,
|
|
],
|
|
})
|
|
export class MetadataEngineModule {}
|