Files
twenty/packages/twenty-front/src/modules/activities/tasks/components/TaskGroups.tsx
T
Félix Malfait cff17db6cb Enhance role-check system with stricter checks (#15392)
## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
-  All TypeScript type checks pass
-  ESLint validation passes
-  New permission guards properly enforced
-  Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.
2025-11-07 15:37:17 +01:00

128 lines
4.2 KiB
TypeScript

import styled from '@emotion/styled';
import { SkeletonLoader } from '@/activities/components/SkeletonLoader';
import { useOpenCreateActivityDrawer } from '@/activities/hooks/useOpenCreateActivityDrawer';
import { useTasks } from '@/activities/tasks/hooks/useTasks';
import { type ActivityTargetableObject } from '@/activities/types/ActivityTargetableEntity';
import { type Task } from '@/activities/types/Task';
import { useObjectMetadataItem } from '@/object-metadata/hooks/useObjectMetadataItem';
import { CoreObjectNameSingular } from '@/object-metadata/types/CoreObjectNameSingular';
import { useObjectPermissionsForObject } from '@/object-record/hooks/useObjectPermissionsForObject';
import { activeTabIdComponentState } from '@/ui/layout/tab-list/states/activeTabIdComponentState';
import { useRecoilComponentValue } from '@/ui/utilities/state/component-state/hooks/useRecoilComponentValue';
import { t } from '@lingui/core/macro';
import groupBy from 'lodash.groupby';
import { IconPlus } from 'twenty-ui/display';
import { Button } from 'twenty-ui/input';
import {
AnimatedPlaceholder,
AnimatedPlaceholderEmptyContainer,
AnimatedPlaceholderEmptySubTitle,
AnimatedPlaceholderEmptyTextContainer,
AnimatedPlaceholderEmptyTitle,
EMPTY_PLACEHOLDER_TRANSITION_PROPS,
} from 'twenty-ui/layout';
import { AddTaskButton } from './AddTaskButton';
import { TaskList } from './TaskList';
const StyledContainer = styled.div`
display: flex;
flex-direction: column;
width: 100%;
`;
type TaskGroupsProps = {
filterDropdownId?: string;
targetableObject: ActivityTargetableObject;
};
export const TaskGroups = ({ targetableObject }: TaskGroupsProps) => {
const { tasks, tasksLoading } = useTasks({
targetableObjects: [targetableObject],
});
const { objectMetadataItem } = useObjectMetadataItem({
objectNameSingular: targetableObject.targetObjectNameSingular,
});
const objectPermissions = useObjectPermissionsForObject(
objectMetadataItem.id,
);
const hasObjectUpdatePermissions = objectPermissions.canUpdateObjectRecords;
const openCreateActivity = useOpenCreateActivityDrawer({
activityObjectNameSingular: CoreObjectNameSingular.Task,
});
const activeTabId = useRecoilComponentValue(activeTabIdComponentState);
const isLoading =
(activeTabId !== 'done' && tasksLoading) ||
(activeTabId === 'done' && tasksLoading);
const isTasksEmpty =
(activeTabId !== 'done' && tasks?.length === 0) ||
(activeTabId === 'done' && tasks?.length === 0);
if (isLoading && isTasksEmpty) {
return <SkeletonLoader />;
}
if (isTasksEmpty) {
return (
<AnimatedPlaceholderEmptyContainer
// eslint-disable-next-line react/jsx-props-no-spreading
{...EMPTY_PLACEHOLDER_TRANSITION_PROPS}
>
<AnimatedPlaceholder type="noTask" />
<AnimatedPlaceholderEmptyTextContainer>
<AnimatedPlaceholderEmptyTitle>
Mission accomplished!
</AnimatedPlaceholderEmptyTitle>
<AnimatedPlaceholderEmptySubTitle>
All tasks addressed. Maintain the momentum.
</AnimatedPlaceholderEmptySubTitle>
</AnimatedPlaceholderEmptyTextContainer>
{hasObjectUpdatePermissions && (
<Button
Icon={IconPlus}
title={t`New task`}
variant="secondary"
onClick={() =>
openCreateActivity({
targetableObjects: [targetableObject],
})
}
/>
)}
</AnimatedPlaceholderEmptyContainer>
);
}
const sortedTasksByStatus = Object.entries(
groupBy(tasks, ({ status }) => status),
).sort(([statusA], [statusB]) => statusB.localeCompare(statusA));
const hasTodoStatus = sortedTasksByStatus.some(
([status]) => status === 'TODO',
);
return (
<StyledContainer>
{sortedTasksByStatus.map(([status, tasksByStatus]: [string, Task[]]) => (
<TaskList
key={status}
title={status}
tasks={tasksByStatus}
button={
(status === 'TODO' || !hasTodoStatus) && (
<AddTaskButton activityTargetableObject={targetableObject} />
)
}
/>
))}
</StyledContainer>
);
};