[permissions V2] Upsert object and setting permissions (#11119)

Closes https://github.com/twentyhq/core-team-issues/issues/639

packages/twenty-server/src/engine/metadata-modules/setting-permission/dtos/setting-permission.dto.ts

@@ -0,0 +1,18 @@
+import { Field, ObjectType } from '@nestjs/graphql';
+
+import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
+
+@ObjectType('SettingPermission')
+export class SettingPermissionDTO {
+  @Field({ nullable: false })
+  id: string;
+
+  @Field({ nullable: false })
+  roleId: string;
+
+  @Field({ nullable: false })
+  setting: SettingPermissionType;
+
+  @Field({ nullable: true })
+  canUpdateSetting?: boolean;
+}

packages/twenty-server/src/engine/metadata-modules/setting-permission/dtos/upsert-setting-permission-input.ts

@@ -0,0 +1,29 @@
+import { Field, InputType } from '@nestjs/graphql';
+
+import {
+  IsBoolean,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
+
+import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
+
+@InputType()
+export class UpsertSettingPermissionInput {
+  @IsUUID()
+  @IsNotEmpty()
+  @Field()
+  roleId: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Field({ nullable: false })
+  setting: SettingPermissionType;
+
+  @IsBoolean()
+  @IsOptional()
+  @Field({ nullable: true })
+  canUpdateSetting?: boolean;
+}

packages/twenty-server/src/engine/metadata-modules/setting-permission/setting-permission.entity.ts

@@ -0,0 +1,45 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  JoinColumn,
+  ManyToOne,
+  PrimaryGeneratedColumn,
+  Relation,
+  Unique,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
+import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+
+@Entity('settingPermission')
+@Unique('IndexOnSettingPermissionUnique', ['setting', 'roleId'])
+export class SettingPermissionEntity {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ nullable: false, type: 'uuid' })
+  roleId: string;
+
+  @ManyToOne(() => RoleEntity, (role) => role.settingPermissions, {
+    onDelete: 'CASCADE',
+  })
+  @JoinColumn({ name: 'roleId' })
+  role: Relation<RoleEntity>;
+
+  @Column({ nullable: false, type: 'varchar' })
+  setting: SettingPermissionType;
+
+  @Column({ nullable: true, type: 'boolean' })
+  canUpdateSetting?: boolean;
+
+  @Column({ nullable: false, type: 'uuid' })
+  workspaceId: string;
+
+  @CreateDateColumn({ type: 'timestamptz' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ type: 'timestamptz' })
+  updatedAt: Date;
+}

packages/twenty-server/src/engine/metadata-modules/setting-permission/setting-permission.module.ts

@@ -0,0 +1,15 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+
+import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { SettingPermissionEntity } from 'src/engine/metadata-modules/setting-permission/setting-permission.entity';
+import { SettingPermissionService } from 'src/engine/metadata-modules/setting-permission/setting-permission.service';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([SettingPermissionEntity, RoleEntity], 'metadata'),
+  ],
+  providers: [SettingPermissionService],
+  exports: [SettingPermissionService],
+})
+export class SettingPermissionModule {}

packages/twenty-server/src/engine/metadata-modules/setting-permission/setting-permission.service.ts

@@ -0,0 +1,79 @@
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { isDefined } from 'twenty-shared/utils';
+import { Repository } from 'typeorm';
+
+import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';
+import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { UpsertSettingPermissionInput } from 'src/engine/metadata-modules/setting-permission/dtos/upsert-setting-permission-input';
+import { SettingPermissionEntity } from 'src/engine/metadata-modules/setting-permission/setting-permission.entity';
+
+export class SettingPermissionService {
+  constructor(
+    @InjectRepository(SettingPermissionEntity, 'metadata')
+    private readonly settingPermissionRepository: Repository<SettingPermissionEntity>,
+    @InjectRepository(RoleEntity, 'metadata')
+    private readonly roleRepository: Repository<RoleEntity>,
+  ) {}
+
+  public async upsertSettingPermission({
+    workspaceId,
+    input,
+  }: {
+    workspaceId: string;
+    input: UpsertSettingPermissionInput;
+  }): Promise<SettingPermissionEntity | null | undefined> {
+    if (!Object.values(SettingPermissionType).includes(input.setting)) {
+      throw new PermissionsException(
+        PermissionsExceptionMessage.INVALID_SETTING,
+        PermissionsExceptionCode.INVALID_SETTING,
+      );
+    }
+
+    try {
+      const result = await this.settingPermissionRepository.upsert(
+        {
+          workspaceId,
+          ...input,
+        },
+        {
+          conflictPaths: ['setting', 'roleId'],
+        },
+      );
+
+      const settingPermissionId = result.generatedMaps?.[0]?.id;
+
+      if (!isDefined(settingPermissionId)) {
+        throw new Error('Failed to upsert setting permission');
+      }
+
+      return this.settingPermissionRepository.findOne({
+        where: {
+          id: settingPermissionId,
+        },
+      });
+    } catch (error) {
+      if (error.message.includes('violates foreign key constraint')) {
+        const role = await this.roleRepository.findOne({
+          where: {
+            id: input.roleId,
+          },
+        });
+
+        if (!isDefined(role)) {
+          throw new PermissionsException(
+            PermissionsExceptionMessage.ROLE_NOT_FOUND,
+            PermissionsExceptionCode.ROLE_NOT_FOUND,
+          );
+        }
+      }
+
+      throw error;
+    }
+  }
+}