Félix Malfait
cff17db6cb
## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
47 lines
1.4 KiB
TypeScript
47 lines
1.4 KiB
TypeScript
import { useOpenCreateActivityDrawer } from '@/activities/hooks/useOpenCreateActivityDrawer';
|
|
import { type ActivityTargetableObject } from '@/activities/types/ActivityTargetableEntity';
|
|
import { useObjectMetadataItem } from '@/object-metadata/hooks/useObjectMetadataItem';
|
|
import { CoreObjectNameSingular } from '@/object-metadata/types/CoreObjectNameSingular';
|
|
import { useObjectPermissionsForObject } from '@/object-record/hooks/useObjectPermissionsForObject';
|
|
import { t } from '@lingui/core/macro';
|
|
import { IconPlus } from 'twenty-ui/display';
|
|
import { Button } from 'twenty-ui/input';
|
|
|
|
export const AddTaskButton = ({
|
|
activityTargetableObject,
|
|
}: {
|
|
activityTargetableObject: ActivityTargetableObject;
|
|
}) => {
|
|
const openCreateActivity = useOpenCreateActivityDrawer({
|
|
activityObjectNameSingular: CoreObjectNameSingular.Task,
|
|
});
|
|
|
|
const { objectMetadataItem } = useObjectMetadataItem({
|
|
objectNameSingular: activityTargetableObject.targetObjectNameSingular,
|
|
});
|
|
|
|
const objectPermissions = useObjectPermissionsForObject(
|
|
objectMetadataItem.id,
|
|
);
|
|
|
|
const hasObjectUpdatePermissions = objectPermissions.canUpdateObjectRecords;
|
|
|
|
if (!hasObjectUpdatePermissions) {
|
|
return null;
|
|
}
|
|
|
|
return (
|
|
<Button
|
|
Icon={IconPlus}
|
|
size="small"
|
|
variant="secondary"
|
|
title={t`Add task`}
|
|
onClick={() =>
|
|
openCreateActivity({
|
|
targetableObjects: [activityTargetableObject],
|
|
})
|
|
}
|
|
/>
|
|
);
|
|
};
|