[permissions] permissions and workflows (#12436)

In this PR

- Determine object record permissions on workflows objects (workflow,
workflowVersion, workflowRun) base on settings permissions @Weiko
- Add Workflow permission guards on workflow resolvers @thomtrp . **Any
method within a resolver that has the SettingsPermission Guard is only
callable by a apiKey or a user that has the permission** (so not by
external parties).
- Add checks bypass in workflow services since 1) for actions gated by
settings permissions, the gate should be done at resolver level, so it
will have been done before the call to the service 2) some service
methods may be called by workflowTriggerController which is callable by
external parties without permissions (ex:
workflowCommonWorkspaceService.getWorkflowVersionOrFail). This is
something we may want to change in the future (still to discuss), by
removing the guard at resolver-level and relying on
shouldBypassPermissionChecks at getRepository and made in a way that we
only bypass for external parties.
- Add checks bypass for actions performed by workflows since they should
not be restricted in our current vision
- Add tests

packages/twenty-server/src/engine/metadata-modules/permissions/constants/setting-permission-type.constants.ts

@@ -6,4 +6,5 @@ export enum SettingPermissionType {
   DATA_MODEL = 'DATA_MODEL',
   ADMIN_PANEL = 'ADMIN_PANEL',
   SECURITY = 'SECURITY',
+  WORKFLOWS = 'WORKFLOWS',
 }

packages/twenty-server/src/engine/metadata-modules/remote-server/remote-server.service.ts

@@ -84,7 +84,7 @@ export class RemoteServerService<T extends RemoteServerType> {
         const createdRemoteServer = entityManager.create(
           RemoteServerEntity,
           remoteServerToCreate,
-        );
+        ) as RemoteServerEntity<RemoteServerType>;
 
         const foreignDataWrapperQuery =
           this.foreignDataWrapperServerQueryFactory.createForeignDataWrapperServer(

packages/twenty-server/src/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache.service.ts

@@ -11,6 +11,7 @@ import { In, Repository } from 'typeorm';
 import { FeatureFlagKey } from 'src/engine/core-modules/feature-flag/enums/feature-flag-key.enum';
 import { FeatureFlagService } from 'src/engine/core-modules/feature-flag/services/feature-flag.service';
 import { ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
+import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
 import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
 import { UserWorkspaceRoleEntity } from 'src/engine/metadata-modules/role/user-workspace-role.entity';
 import { UserWorkspaceRoleMap } from 'src/engine/metadata-modules/workspace-permissions-cache/types/user-workspace-role-map.type';
@@ -18,6 +19,7 @@ import { WorkspacePermissionsCacheStorageService } from 'src/engine/metadata-mod
 import { TwentyORMExceptionCode } from 'src/engine/twenty-orm/exceptions/twenty-orm.exception';
 import { getFromCacheWithRecompute } from 'src/engine/utils/get-data-from-cache-with-recompute.util';
 import { WorkspaceCacheStorageService } from 'src/engine/workspace-cache-storage/workspace-cache-storage.service';
+import { STANDARD_OBJECT_IDS } from 'src/engine/workspace-manager/workspace-sync-metadata/constants/standard-object-ids';
 
 type CacheResult<T, U> = {
   version: T;
@@ -244,7 +246,7 @@ export class WorkspacePermissionsCacheService {
         workspaceId,
         ...(roleIds ? { id: In(roleIds) } : {}),
       },
-      relations: ['objectPermissions'],
+      relations: ['objectPermissions', 'settingPermissions'],
     });
 
     const workspaceObjectMetadataCollection =
@@ -256,7 +258,7 @@ export class WorkspacePermissionsCacheService {
       const objectRecordsPermissions: ObjectRecordsPermissions = {};
 
       for (const objectMetadata of workspaceObjectMetadataCollection) {
-        const { id: objectMetadataId, isSystem } = objectMetadata;
+        const { id: objectMetadataId, isSystem, standardId } = objectMetadata;
 
         let canRead = role.canReadAllObjectRecords;
         let canUpdate = role.canUpdateAllObjectRecords;
@@ -264,32 +266,48 @@ export class WorkspacePermissionsCacheService {
         let canDestroy = role.canDestroyAllObjectRecords;
 
         if (isPermissionsV2Enabled) {
-          const objectRecordPermissionsOverride = role.objectPermissions.find(
-            (objectPermission) =>
-              objectPermission.objectMetadataId === objectMetadataId,
-          );
+          if (
+            standardId &&
+            [
+              STANDARD_OBJECT_IDS.workflow,
+              STANDARD_OBJECT_IDS.workflowRun,
+              STANDARD_OBJECT_IDS.workflowVersion,
+            ].includes(standardId)
+          ) {
+            const hasWorkflowsPermissions = this.hasWorkflowsPermissions(role);
 
-          const getPermissionValue = (
-            overrideValue: boolean | undefined,
-            defaultValue: boolean,
-          ) => (isSystem ? true : (overrideValue ?? defaultValue));
+            canRead = hasWorkflowsPermissions;
+            canUpdate = hasWorkflowsPermissions;
+            canSoftDelete = hasWorkflowsPermissions;
+            canDestroy = hasWorkflowsPermissions;
+          } else {
+            const objectRecordPermissionsOverride = role.objectPermissions.find(
+              (objectPermission) =>
+                objectPermission.objectMetadataId === objectMetadataId,
+            );
 
-          canRead = getPermissionValue(
-            objectRecordPermissionsOverride?.canReadObjectRecords,
-            canRead,
-          );
-          canUpdate = getPermissionValue(
-            objectRecordPermissionsOverride?.canUpdateObjectRecords,
-            canUpdate,
-          );
-          canSoftDelete = getPermissionValue(
-            objectRecordPermissionsOverride?.canSoftDeleteObjectRecords,
-            canSoftDelete,
-          );
-          canDestroy = getPermissionValue(
-            objectRecordPermissionsOverride?.canDestroyObjectRecords,
-            canDestroy,
-          );
+            const getPermissionValue = (
+              overrideValue: boolean | undefined,
+              defaultValue: boolean,
+            ) => (isSystem ? true : (overrideValue ?? defaultValue));
+
+            canRead = getPermissionValue(
+              objectRecordPermissionsOverride?.canReadObjectRecords,
+              canRead,
+            );
+            canUpdate = getPermissionValue(
+              objectRecordPermissionsOverride?.canUpdateObjectRecords,
+              canUpdate,
+            );
+            canSoftDelete = getPermissionValue(
+              objectRecordPermissionsOverride?.canSoftDeleteObjectRecords,
+              canSoftDelete,
+            );
+            canDestroy = getPermissionValue(
+              objectRecordPermissionsOverride?.canDestroyObjectRecords,
+              canDestroy,
+            );
+          }
         }
 
         objectRecordsPermissions[objectMetadataId] = {
@@ -298,9 +316,9 @@ export class WorkspacePermissionsCacheService {
           canSoftDelete,
           canDestroy,
         };
-      }
 
-      permissionsByRoleId[role.id] = objectRecordsPermissions;
+        permissionsByRoleId[role.id] = objectRecordsPermissions;
+      }
     }
 
     return permissionsByRoleId;
@@ -313,7 +331,7 @@ export class WorkspacePermissionsCacheService {
       where: {
         workspaceId,
       },
-      select: ['id', 'isSystem'],
+      select: ['id', 'isSystem', 'standardId'],
     });
 
     return workspaceObjectMetadata;
@@ -336,4 +354,19 @@ export class WorkspacePermissionsCacheService {
       return acc;
     }, {} as UserWorkspaceRoleMap);
   }
+
+  private hasWorkflowsPermissions(role: RoleEntity): boolean {
+    const hasWorkflowsPermissionFromRole = role.canUpdateAllSettings;
+    const hasWorkflowsPermissionsFromSettingPermissions = isDefined(
+      role.settingPermissions.find(
+        (settingPermission) =>
+          settingPermission.setting === SettingPermissionType.WORKFLOWS,
+      ),
+    );
+
+    return (
+      hasWorkflowsPermissionFromRole ||
+      hasWorkflowsPermissionsFromSettingPermissions
+    );
+  }
 }