8bfa9c4adb
Replaces #23774 (closed), rebased on latest main. ## Problem Since the cookie-session migration (#23642), the front sends every request with `credentials: 'include'` and the server only reflects `Access-Control-Allow-Origin` for the exact origins in the credentialed allowlist (`SERVER_URL`, `FRONTEND_URL`, `AUTH_COOKIE_ALLOWED_ORIGINS`). Any other origin gets the `*` wildcard, which browsers reject for credentialed requests. Local dev is split-origin by default (front on `localhost:3001`, API on `localhost:3000`), and with `IS_MULTIWORKSPACE_ENABLED` every workspace subdomain (`apple.localhost:3001`, ...) is yet another origin. Each locally created workspace would need a manual `AUTH_COOKIE_ALLOWED_ORIGINS` entry. ## Solution Make local dev same-origin instead of widening the CORS policy: the vite dev server now proxies all top-level API route prefixes to the backend, and the front calls its own origin. - `vite.config.ts` adds a `server.proxy` covering the backend's top-level prefixes (`/graphql`, `/metadata`, `/admin-panel`, `/auth`, `/rest`, `/file`, `/client-config`, ...), defined in `src/config/apiProxyPrefixes.ts`. Keys are anchored regexes (`^/auth($|[/?])`) so SPA routes sharing a prefix (`/authorize`, `/settings`) are not swallowed. The target defaults to `http://localhost:3000` and follows `REACT_APP_SERVER_BASE_URL`. `changeOrigin` stays off so the backend sees the browser's Host: same-origin checks (CSRF, cookie issuance) and workspace resolution by subdomain work unchanged through the proxy. - `config/index.ts` collapses to `window._env_?.REACT_APP_SERVER_BASE_URL || window.location.origin`. Every supported production path injects `window._env_` (docker entrypoint fails hard without `REACT_APP_SERVER_BASE_URL`; a server-served front gets it from `generateFrontConfig()`), and in dev the current origin is correct on `localhost:3001` and every `*.localhost:3001` workspace subdomain thanks to the proxy. The removed `http://<hostname>:3000` fallback only served an un-injected production bundle browsed on localhost, a setup whose credentialed auth the cookie-session migration had already broken. The credentialed allowlist itself is unchanged and stays strict; since dev traffic is same-origin, the per-subdomain cookie-allowlist problem disappears without loosening any production CORS/CSRF policy. ## Tests - `src/config/__tests__/apiProxyPrefixes.test.ts` guards the proxy boundary in both directions: representative backend path shapes (including `/metadata?query=...` and `/auth/...`) must match, every SPA route from the `AppPath` enum and vite's own dev paths must not — so a future route collision fails unit tests instead of breaking dev. - Verified against running dev servers: API paths proxy to the backend from both `localhost:3001` and `apple.localhost:3001`, while SPA routes `/settings` and `/authorize` still serve the vite app; a same-origin POST from `apple.localhost:3001` goes through with no CORS involvement. - `lint:diff-with-main` and `typecheck` pass for twenty-front. --------- Co-authored-by: Félix Malfait <felix@twenty.com>
116 lines
4.0 KiB
TypeScript
116 lines
4.0 KiB
TypeScript
import {
|
|
Body,
|
|
Controller,
|
|
Delete,
|
|
Get,
|
|
Param,
|
|
Patch,
|
|
Post,
|
|
Query,
|
|
UseFilters,
|
|
UseGuards,
|
|
} from '@nestjs/common';
|
|
|
|
import { PermissionFlagType } from 'twenty-shared/constants';
|
|
import { ApiPath } from 'twenty-shared/types';
|
|
import { isDefined } from 'twenty-shared/utils';
|
|
|
|
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
|
|
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
|
|
import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
|
|
import { SettingsPermissionGuard } from 'src/engine/guards/settings-permission.guard';
|
|
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
|
|
import { FlatEntityMapsRestApiExceptionFilter } from 'src/engine/metadata-modules/flat-entity/filters/flat-entity-maps-rest-api-exception.filter';
|
|
import { CreatePageLayoutInput } from 'src/engine/metadata-modules/page-layout/dtos/inputs/create-page-layout.input';
|
|
import { UpdatePageLayoutInput } from 'src/engine/metadata-modules/page-layout/dtos/inputs/update-page-layout.input';
|
|
import { type PageLayoutDTO } from 'src/engine/metadata-modules/page-layout/dtos/page-layout.dto';
|
|
import { PageLayoutType } from 'src/engine/metadata-modules/page-layout/enums/page-layout-type.enum';
|
|
import { PageLayoutRestApiExceptionFilter } from 'src/engine/metadata-modules/page-layout/filters/page-layout-rest-api-exception.filter';
|
|
import { PageLayoutService } from 'src/engine/metadata-modules/page-layout/services/page-layout.service';
|
|
import { PermissionsRestApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-rest-api-exception.filter';
|
|
import { WorkspaceMigrationRunnerRestApiExceptionFilter } from 'src/engine/workspace-manager/workspace-migration/filters/workspace-migration-runner-rest-api-exception.filter';
|
|
|
|
@Controller(`${ApiPath.Rest}/metadata/pageLayouts`)
|
|
@UseGuards(WorkspaceAuthGuard)
|
|
@UseFilters(
|
|
PermissionsRestApiExceptionFilter,
|
|
PageLayoutRestApiExceptionFilter,
|
|
FlatEntityMapsRestApiExceptionFilter,
|
|
WorkspaceMigrationRunnerRestApiExceptionFilter,
|
|
)
|
|
export class PageLayoutController {
|
|
constructor(private readonly pageLayoutService: PageLayoutService) {}
|
|
|
|
@Get()
|
|
@UseGuards(NoPermissionGuard)
|
|
async findMany(
|
|
@AuthWorkspace() workspace: WorkspaceEntity,
|
|
@Query('objectMetadataId') objectMetadataId?: string,
|
|
@Query('pageLayoutType') pageLayoutType?: PageLayoutType,
|
|
): Promise<PageLayoutDTO[]> {
|
|
if (isDefined(objectMetadataId)) {
|
|
return this.pageLayoutService.findBy({
|
|
workspaceId: workspace.id,
|
|
filter: {
|
|
objectMetadataId,
|
|
pageLayoutType,
|
|
},
|
|
});
|
|
}
|
|
|
|
return this.pageLayoutService.findByWorkspaceId(workspace.id);
|
|
}
|
|
|
|
@Get(':id')
|
|
@UseGuards(NoPermissionGuard)
|
|
async findOne(
|
|
@Param('id') id: string,
|
|
@AuthWorkspace() workspace: WorkspaceEntity,
|
|
): Promise<PageLayoutDTO | null> {
|
|
return this.pageLayoutService.findByIdOrThrow({
|
|
id,
|
|
workspaceId: workspace.id,
|
|
});
|
|
}
|
|
|
|
@Post()
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.LAYOUTS))
|
|
async create(
|
|
@Body() input: CreatePageLayoutInput,
|
|
@AuthWorkspace() workspace: WorkspaceEntity,
|
|
): Promise<PageLayoutDTO> {
|
|
return this.pageLayoutService.create({
|
|
createPageLayoutInput: input,
|
|
workspaceId: workspace.id,
|
|
});
|
|
}
|
|
|
|
@Patch(':id')
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.LAYOUTS))
|
|
async update(
|
|
@Param('id') id: string,
|
|
@Body() input: UpdatePageLayoutInput,
|
|
@AuthWorkspace() workspace: WorkspaceEntity,
|
|
): Promise<PageLayoutDTO> {
|
|
const updatedPageLayout = await this.pageLayoutService.update({
|
|
id,
|
|
workspaceId: workspace.id,
|
|
updateData: input,
|
|
});
|
|
|
|
return updatedPageLayout;
|
|
}
|
|
|
|
@Delete(':id')
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.LAYOUTS))
|
|
async destroy(
|
|
@Param('id') id: string,
|
|
@AuthWorkspace() workspace: WorkspaceEntity,
|
|
): Promise<boolean> {
|
|
return this.pageLayoutService.destroy({
|
|
id,
|
|
workspaceId: workspace.id,
|
|
});
|
|
}
|
|
}
|