9a80164cf3
This PR enhances our security model by ensuring all GraphQL resolvers and REST API endpoints have appropriate permission guards. ## Changes ### ESLint Rules - Enhanced `graphql-resolvers-should-be-guarded` to require permission guards on all resolvers (Query, Mutation, Subscription), not just mutations - Enhanced `rest-api-methods-should-be-guarded` to require permission guards on all REST endpoints (GET, POST, PUT, PATCH, DELETE), not just mutating methods - Both rules now enforce consistent security: authentication guards + permission guards for all endpoints ### Permission Guards Added **Public Endpoints** - Added `NoPermissionGuard`: - Auth-related queries (checkUserExists, findWorkspaceFromInviteHash, validatePasswordResetToken) - Billing webhooks (Stripe callbacks) - SSO callbacks (SAML authentication) - Workflow webhooks - Cloudflare webhooks - Route trigger endpoints - GraphQL subscriptions - Current workspace queries - Geo-map address autocomplete - View-related read operations (view-field, view-filter, view-group, view-sort, view-filter-group) **Settings Permission Guards** - Added `SettingsPermissionGuard`: - API Keys management: `PermissionFlagType.API_KEYS_AND_WEBHOOKS` - Webhooks management: `PermissionFlagType.API_KEYS_AND_WEBHOOKS` - Page Layouts (write operations): `PermissionFlagType.LAYOUTS` - REST Metadata API: `PermissionFlagType.DATA_MODEL` - Agent operations: `PermissionFlagType.AI` - Remote servers: `PermissionFlagType.DATA_MODEL` - Remote tables: `PermissionFlagType.DATA_MODEL` - Serverless functions: `PermissionFlagType.WORKFLOWS` **Custom Permission Guards** - Added `CustomPermissionGuard`: - REST Core API (permissions checked at query execution layer) - Timeline calendar events (permission checks in service layer) - Timeline messaging (permission checks in service layer) - Search operations (permission checks in service layer) - View operations (permission checks via dedicated view permission guards) ### View Permission Guards - Created dedicated `FindManyViewsPermissionGuard` and `FindOneViewPermissionGuard` for reading views - Created `CreateViewPermissionGuard` for view creation with visibility-based permission checks - All view child entities (view-field, view-filter, view-sort, view-group, view-filter-group) use `NoPermissionGuard` for reads - Write operations on view child entities use dedicated permission guards that check parent view access ### Page Layout Permissions - Read operations (GET/Query) now use `NoPermissionGuard` - users can view layouts without LAYOUTS permission - Write operations (POST/PATCH/DELETE/Mutation) require `SettingsPermissionGuard(PermissionFlagType.LAYOUTS)` - Applied consistently across page-layout, page-layout-tab, and page-layout-widget endpoints ## Security Model All endpoints now follow a consistent pattern: 1. **Authentication**: `UserAuthGuard`, `WorkspaceAuthGuard`, or `PublicEndpointGuard` 2. **Authorization**: One of: - `SettingsPermissionGuard(PermissionFlagType.XXX)` - for settings/admin operations - `CustomPermissionGuard` - when permissions are checked in service/data layer - `NoPermissionGuard` - for public or non-sensitive read operations The ESLint rules automatically enforce this pattern going forward. ## Stats - 47 files changed - 603 insertions, 163 deletions - 3 new guard files created
88 lines
3.5 KiB
TypeScript
88 lines
3.5 KiB
TypeScript
import { UseFilters, UseGuards, UsePipes } from '@nestjs/common';
|
|
import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
|
|
|
|
import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules/graphql/filters/prevent-nest-to-auto-log-graphql-errors.filter';
|
|
import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
|
|
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
|
|
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
|
|
import { SettingsPermissionGuard } from 'src/engine/guards/settings-permission.guard';
|
|
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
|
|
import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
|
|
import { FindManyRemoteTablesInput } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/find-many-remote-tables-input';
|
|
import { RemoteTableInput } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/remote-table-input';
|
|
import { RemoteTableDTO } from 'src/engine/metadata-modules/remote-server/remote-table/dtos/remote-table.dto';
|
|
import { RemoteTableService } from 'src/engine/metadata-modules/remote-server/remote-table/remote-table.service';
|
|
import { remoteTableGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/remote-server/remote-table/utils/remote-table-graphql-api-exception-handler.util';
|
|
|
|
@UseGuards(
|
|
WorkspaceAuthGuard,
|
|
SettingsPermissionGuard(PermissionFlagType.DATA_MODEL),
|
|
)
|
|
@UsePipes(ResolverValidationPipe)
|
|
@UseFilters(PreventNestToAutoLogGraphqlErrorsFilter)
|
|
@Resolver()
|
|
export class RemoteTableResolver {
|
|
constructor(private readonly remoteTableService: RemoteTableService) {}
|
|
|
|
@Query(() => [RemoteTableDTO])
|
|
async findDistantTablesWithStatus(
|
|
@Args('input') input: FindManyRemoteTablesInput,
|
|
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
|
|
) {
|
|
try {
|
|
return await this.remoteTableService.findDistantTablesWithStatus(
|
|
input.id,
|
|
workspaceId,
|
|
input.shouldFetchPendingSchemaUpdates,
|
|
);
|
|
} catch (error) {
|
|
remoteTableGraphqlApiExceptionHandler(error);
|
|
}
|
|
}
|
|
|
|
@Mutation(() => RemoteTableDTO)
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.DATA_MODEL))
|
|
async syncRemoteTable(
|
|
@Args('input') input: RemoteTableInput,
|
|
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
|
|
) {
|
|
try {
|
|
return await this.remoteTableService.syncRemoteTable(input, workspaceId);
|
|
} catch (error) {
|
|
remoteTableGraphqlApiExceptionHandler(error);
|
|
}
|
|
}
|
|
|
|
@Mutation(() => RemoteTableDTO)
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.DATA_MODEL))
|
|
async unsyncRemoteTable(
|
|
@Args('input') input: RemoteTableInput,
|
|
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
|
|
) {
|
|
try {
|
|
return await this.remoteTableService.unsyncRemoteTable(
|
|
input,
|
|
workspaceId,
|
|
);
|
|
} catch (error) {
|
|
remoteTableGraphqlApiExceptionHandler(error);
|
|
}
|
|
}
|
|
|
|
@Mutation(() => RemoteTableDTO)
|
|
@UseGuards(SettingsPermissionGuard(PermissionFlagType.DATA_MODEL))
|
|
async syncRemoteTableSchemaChanges(
|
|
@Args('input') input: RemoteTableInput,
|
|
@AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
|
|
) {
|
|
try {
|
|
return await this.remoteTableService.syncRemoteTableSchemaChanges(
|
|
input,
|
|
workspaceId,
|
|
);
|
|
} catch (error) {
|
|
remoteTableGraphqlApiExceptionHandler(error);
|
|
}
|
|
}
|
|
}
|