Félix Malfait
cff17db6cb
## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
104 lines
3.1 KiB
TypeScript
104 lines
3.1 KiB
TypeScript
import {
|
|
AVAILABLE_WORKSPACE_FOR_AUTH_FRAGMENT,
|
|
AVAILABLE_WORKSPACES_FOR_AUTH_FRAGMENT,
|
|
} from '@/auth/graphql/fragments/authFragments';
|
|
import { OBJECT_PERMISSION_FRAGMENT } from '@/settings/roles/graphql/fragments/objectPermissionFragment';
|
|
import { ROLE_FRAGMENT } from '@/settings/roles/graphql/fragments/roleFragment';
|
|
import { BILLING_SUBSCRIPTION_FRAGMENT } from '@/users/graphql/fragments/billingSubscriptionsFragment';
|
|
import { CURRENT_BILLING_SUBSCRIPTION_FRAGMENT } from '@/users/graphql/fragments/currentBillingSubscriptionFragement';
|
|
import { WORKSPACE_URLS_FRAGMENT } from '@/users/graphql/fragments/workspaceUrlsFragment';
|
|
import { DELETED_WORKSPACE_MEMBER_QUERY_FRAGMENT } from '@/workspace-member/graphql/fragments/deletedWorkspaceMemberQueryFragment';
|
|
import { PARTIAL_WORKSPACE_MEMBER_QUERY_FRAGMENT } from '@/workspace-member/graphql/fragments/partialWorkspaceMemberQueryFragment';
|
|
import { WORKSPACE_MEMBER_QUERY_FRAGMENT } from '@/workspace-member/graphql/fragments/workspaceMemberQueryFragment';
|
|
import { gql } from '@apollo/client';
|
|
|
|
export const USER_QUERY_FRAGMENT = gql`
|
|
fragment UserQueryFragment on User {
|
|
id
|
|
firstName
|
|
lastName
|
|
email
|
|
hasPassword
|
|
canAccessFullAdminPanel
|
|
canImpersonate
|
|
supportUserHash
|
|
onboardingStatus
|
|
workspaceMember {
|
|
...WorkspaceMemberQueryFragment
|
|
}
|
|
workspaceMembers {
|
|
...PartialWorkspaceMemberQueryFragment
|
|
}
|
|
deletedWorkspaceMembers {
|
|
...DeletedWorkspaceMemberQueryFragment
|
|
}
|
|
currentUserWorkspace {
|
|
id
|
|
permissionFlags
|
|
objectsPermissions {
|
|
...ObjectPermissionFragment
|
|
}
|
|
twoFactorAuthenticationMethodSummary {
|
|
twoFactorAuthenticationMethodId
|
|
status
|
|
strategy
|
|
}
|
|
}
|
|
currentWorkspace {
|
|
id
|
|
displayName
|
|
logo
|
|
inviteHash
|
|
allowImpersonation
|
|
activationStatus
|
|
isPublicInviteLinkEnabled
|
|
isGoogleAuthEnabled
|
|
isMicrosoftAuthEnabled
|
|
isPasswordAuthEnabled
|
|
isGoogleAuthBypassEnabled
|
|
isMicrosoftAuthBypassEnabled
|
|
isPasswordAuthBypassEnabled
|
|
subdomain
|
|
hasValidEnterpriseKey
|
|
customDomain
|
|
isCustomDomainEnabled
|
|
workspaceUrls {
|
|
...WorkspaceUrlsFragment
|
|
}
|
|
featureFlags {
|
|
key
|
|
value
|
|
}
|
|
metadataVersion
|
|
currentBillingSubscription {
|
|
...CurrentBillingSubscriptionFragment
|
|
}
|
|
billingSubscriptions {
|
|
...BillingSubscriptionFragment
|
|
}
|
|
workspaceMembersCount
|
|
defaultRole {
|
|
...RoleFragment
|
|
}
|
|
routerModel
|
|
isTwoFactorAuthenticationEnforced
|
|
trashRetentionDays
|
|
}
|
|
availableWorkspaces {
|
|
...AvailableWorkspacesFragment
|
|
}
|
|
userVars
|
|
}
|
|
|
|
${WORKSPACE_MEMBER_QUERY_FRAGMENT}
|
|
${DELETED_WORKSPACE_MEMBER_QUERY_FRAGMENT}
|
|
${PARTIAL_WORKSPACE_MEMBER_QUERY_FRAGMENT}
|
|
${OBJECT_PERMISSION_FRAGMENT}
|
|
${WORKSPACE_URLS_FRAGMENT}
|
|
${ROLE_FRAGMENT}
|
|
${AVAILABLE_WORKSPACES_FOR_AUTH_FRAGMENT}
|
|
${AVAILABLE_WORKSPACE_FOR_AUTH_FRAGMENT}
|
|
${CURRENT_BILLING_SUBSCRIPTION_FRAGMENT}
|
|
${BILLING_SUBSCRIPTION_FRAGMENT}
|
|
`;
|