Félix Malfait
cff17db6cb
## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
73 lines
2.3 KiB
TypeScript
73 lines
2.3 KiB
TypeScript
import { useRecoilCallback } from 'recoil';
|
|
|
|
import { contextStoreCurrentViewIdComponentState } from '@/context-store/states/contextStoreCurrentViewIdComponentState';
|
|
import { useRecoilComponentCallbackState } from '@/ui/utilities/state/component-state/hooks/useRecoilComponentCallbackState';
|
|
import { useCanPersistViewChanges } from '@/views/hooks/useCanPersistViewChanges';
|
|
import { useRefreshCoreViewsByObjectMetadataId } from '@/views/hooks/useRefreshCoreViewsByObjectMetadataId';
|
|
import { coreViewFromViewIdFamilySelector } from '@/views/states/selectors/coreViewFromViewIdFamilySelector';
|
|
import { type GraphQLView } from '@/views/types/GraphQLView';
|
|
import { convertUpdateViewInputToCore } from '@/views/utils/convertUpdateViewInputToCore';
|
|
import { isDefined } from 'twenty-shared/utils';
|
|
import { useUpdateCoreViewMutation } from '~/generated-metadata/graphql';
|
|
|
|
export const useUpdateCurrentView = () => {
|
|
const { canPersistChanges } = useCanPersistViewChanges();
|
|
const currentViewIdCallbackState = useRecoilComponentCallbackState(
|
|
contextStoreCurrentViewIdComponentState,
|
|
);
|
|
|
|
const { refreshCoreViewsByObjectMetadataId } =
|
|
useRefreshCoreViewsByObjectMetadataId();
|
|
|
|
const [updateOneCoreView] = useUpdateCoreViewMutation();
|
|
|
|
const updateCurrentView = useRecoilCallback(
|
|
({ snapshot }) =>
|
|
async (view: Partial<GraphQLView>) => {
|
|
if (!canPersistChanges) {
|
|
return;
|
|
}
|
|
|
|
const currentViewId = snapshot
|
|
.getLoadable(currentViewIdCallbackState)
|
|
.getValue();
|
|
|
|
const currentView = snapshot
|
|
.getLoadable(
|
|
coreViewFromViewIdFamilySelector({
|
|
viewId: currentViewId ?? '',
|
|
}),
|
|
)
|
|
.getValue();
|
|
|
|
if (!isDefined(currentView)) {
|
|
return;
|
|
}
|
|
|
|
if (isDefined(currentViewId)) {
|
|
const input = convertUpdateViewInputToCore(view);
|
|
|
|
await updateOneCoreView({
|
|
variables: {
|
|
id: currentViewId,
|
|
input,
|
|
},
|
|
});
|
|
await refreshCoreViewsByObjectMetadataId(
|
|
currentView.objectMetadataId,
|
|
);
|
|
}
|
|
},
|
|
[
|
|
canPersistChanges,
|
|
currentViewIdCallbackState,
|
|
refreshCoreViewsByObjectMetadataId,
|
|
updateOneCoreView,
|
|
],
|
|
);
|
|
|
|
return {
|
|
updateCurrentView,
|
|
};
|
|
};
|