admin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Handle restricted objects #1 refactor permissions map + return object permissions from gql (#12313)

Browse Source 
## Context
- Introduced objectPermissions in currentUserWorkspace which uses role
permissions from cache so we can fetch granular permissions from the API
- Refactored cached role permissions to map permissions with object
metadata id instead of object metadata name singular to be more flexible

New Cache
<img width="574" alt="Screenshot 2025-05-27 at 11 59 06"
src="https://github.com/user-attachments/assets/1a090134-1b8a-4681-a630-29f1472178bd"
/>

GQL
<img width="977" alt="Screenshot 2025-05-27 at 11 58 53"
src="https://github.com/user-attachments/assets/3b9a82b0-6019-4a25-a6e2-a9e0fb4bb8a0"
/>


Next steps: Use the updated API in the FE to fetch granular permissions
and update useHasObjectReadOnlyPermission hook
This commit is contained in:
Weiko
2025-05-27 17:42:26 +02:00
committed by GitHub
parent 651ad38e79
commit 8051646567
14 changed files with 143 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
packages/twenty-server/src/engine/core-modules/user-workspace/user-workspace.entity.ts
View File

@ -20,6 +20,7 @@ import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/
import { TwoFactorMethod } from 'src/engine/core-modules/two-factor-method/two-factor-method.entity';
import { User } from 'src/engine/core-modules/user/user.entity';
import { Workspace } from 'src/engine/core-modules/workspace/workspace.entity';
import { ObjectPermissionDTO } from 'src/engine/metadata-modules/object-permission/dtos/object-permission.dto';
import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
registerEnumType(SettingPermissionType, {
@ -84,6 +85,12 @@ export class UserWorkspace {
@Field(() => [SettingPermissionType], { nullable: true })
settingsPermissions?: SettingPermissionType[];
@Field(() => [PermissionsOnAllObjectRecords], { nullable: true })
@Field(() => [PermissionsOnAllObjectRecords], {
nullable: true,
deprecationReason: 'Use objectPermissions instead',
})
objectRecordsPermissions?: PermissionsOnAllObjectRecords[];
@Field(() => [ObjectPermissionDTO], { nullable: true })
objectPermissions?: ObjectPermissionDTO[];
}

50
packages/twenty-server/src/engine/core-modules/user/user.resolver.ts
View File

@ -26,8 +26,12 @@ import {
AuthExceptionCode,
} from 'src/engine/core-modules/auth/auth.exception';
import { DomainManagerService } from 'src/engine/core-modules/domain-manager/services/domain-manager.service';
import { FeatureFlagKey } from 'src/engine/core-modules/feature-flag/enums/feature-flag-key.enum';
import { FeatureFlagService } from 'src/engine/core-modules/feature-flag/services/feature-flag.service';
import { SignedFileDTO } from 'src/engine/core-modules/file/file-upload/dtos/signed-file.dto';
import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
import { FileService } from 'src/engine/core-modules/file/services/file.service';
import { extractFilenameFromPath } from 'src/engine/core-modules/file/utils/extract-file-id-from-path.utils';
import { OnboardingStatus } from 'src/engine/core-modules/onboarding/enums/onboarding-status.enum';
import {
OnboardingService,
@ -46,6 +50,7 @@ import { Workspace } from 'src/engine/core-modules/workspace/workspace.entity';
import { AuthUser } from 'src/engine/decorators/auth/auth-user.decorator';
import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
import { ObjectPermissionDTO } from 'src/engine/metadata-modules/object-permission/dtos/object-permission.dto';
import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
import { PermissionsGraphqlApiExceptionFilter } from 'src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter';
@ -53,8 +58,6 @@ import { RoleDTO } from 'src/engine/metadata-modules/role/dtos/role.dto';
import { UserRoleService } from 'src/engine/metadata-modules/user-role/user-role.service';
import { AccountsToReconnectKeys } from 'src/modules/connected-account/types/accounts-to-reconnect-key-value.type';
import { streamToBuffer } from 'src/utils/stream-to-buffer';
import { SignedFileDTO } from 'src/engine/core-modules/file/file-upload/dtos/signed-file.dto';
import { extractFilenameFromPath } from 'src/engine/core-modules/file/utils/extract-file-id-from-path.utils';
const getHMACKey = (email?: string, key?: string | null) => {
if (!email || !key) return null;
@ -83,6 +86,7 @@ export class UserResolver {
private readonly userRoleService: UserRoleService,
private readonly permissionsService: PermissionsService,
private readonly deletedWorkspaceMemberTranspiler: DeletedWorkspaceMemberTranspiler,
private readonly featureFlagService: FeatureFlagService,
) {}
@Query(() => User)
@ -111,6 +115,7 @@ export class UserResolver {
}
let settingsPermissions = {};
let objectRecordsPermissions = {};
let objectPermissions: ObjectPermissionDTO[] = [];
if (
![
@ -118,14 +123,40 @@ export class UserResolver {
WorkspaceActivationStatus.ONGOING_CREATION,
].includes(workspace.activationStatus)
) {
const permissions =
await this.permissionsService.getUserWorkspacePermissions({
userWorkspaceId: currentUserWorkspace.id,
workspaceId: workspace.id,
});
const isPermissionsV2Enabled =
await this.featureFlagService.isFeatureEnabled(
FeatureFlagKey.IsPermissionsV2Enabled,
workspace.id,
);
settingsPermissions = permissions.settingsPermissions;
objectRecordsPermissions = permissions.objectRecordsPermissions;
if (isPermissionsV2Enabled) {
const permissions =
await this.permissionsService.getUserWorkspacePermissionsV2({
userWorkspaceId: currentUserWorkspace.id,
workspaceId: workspace.id,
});
settingsPermissions = permissions.settingsPermissions;
objectPermissions = Object.entries(
permissions.objectRecordsPermissions,
).map(([objectMetadataId, permissions]) => ({
objectMetadataId,
canReadObjectRecords: permissions.canRead,
canUpdateObjectRecords: permissions.canUpdate,
canSoftDeleteObjectRecords: permissions.canSoftDelete,
canDestroyObjectRecords: permissions.canDestroy,
}));
objectRecordsPermissions = permissions.objectRecordsPermissions;
} else {
const permissions =
await this.permissionsService.getUserWorkspacePermissions({
userWorkspaceId: currentUserWorkspace.id,
workspaceId: workspace.id,
});
settingsPermissions = permissions.settingsPermissions;
objectRecordsPermissions = permissions.objectRecordsPermissions;
}
}
const grantedSettingsPermissions: SettingPermissionType[] = (
@ -143,6 +174,7 @@ export class UserResolver {
currentUserWorkspace.settingsPermissions = grantedSettingsPermissions;
currentUserWorkspace.objectRecordsPermissions =
grantedObjectRecordsPermissions;
currentUserWorkspace.objectPermissions = objectPermissions;
user.currentUserWorkspace = currentUserWorkspace;
return {

6
packages/twenty-server/src/engine/metadata-modules/object-permission/dtos/object-permission.dto.ts
View File

@ -2,12 +2,6 @@ import { Field, ObjectType } from '@nestjs/graphql';
@ObjectType('ObjectPermission')
export class ObjectPermissionDTO {
@Field({ nullable: false })
id: string;
@Field({ nullable: false })
roleId: string;
@Field({ nullable: false })
objectMetadataId: string;

59
packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
View File

@ -1,6 +1,7 @@
import { Injectable } from '@nestjs/common';
import { PermissionsOnAllObjectRecords } from 'twenty-shared/constants';
import { ObjectRecordsPermissions } from 'twenty-shared/types';
import { isDefined } from 'twenty-shared/utils';
import {
@ -26,6 +27,64 @@ export class PermissionsService {
private readonly featureFlagService: FeatureFlagService,
) {}
public async getUserWorkspacePermissionsV2({
userWorkspaceId,
workspaceId,
}: {
userWorkspaceId: string;
workspaceId: string;
}): Promise<{
settingsPermissions: Record<SettingPermissionType, boolean>;
objectRecordsPermissions: ObjectRecordsPermissions;
}> {
const [roleOfUserWorkspace] = await this.userRoleService
.getRolesByUserWorkspaces({
userWorkspaceIds: [userWorkspaceId],
workspaceId,
})
.then((roles) => roles?.get(userWorkspaceId) ?? []);
let hasPermissionOnSettingFeature = false;
if (!isDefined(roleOfUserWorkspace)) {
throw new PermissionsException(
PermissionsExceptionMessage.NO_ROLE_FOUND_FOR_USER_WORKSPACE,
PermissionsExceptionCode.NO_ROLE_FOUND_FOR_USER_WORKSPACE,
);
}
if (roleOfUserWorkspace.canUpdateAllSettings === true) {
hasPermissionOnSettingFeature = true;
}
const settingPermissions = roleOfUserWorkspace.settingPermissions ?? [];
const settingsPermissionsMap = Object.keys(SettingPermissionType).reduce(
(acc, feature) => ({
...acc,
[feature]:
hasPermissionOnSettingFeature ||
settingPermissions.some(
(settingPermission) => settingPermission.setting === feature,
),
}),
{} as Record<SettingPermissionType, boolean>,
);
const { data: rolesPermissions } =
await this.workspacePermissionsCacheService.getRolesPermissionsFromCache({
workspaceId,
});
const objectRecordsPermissions =
rolesPermissions[roleOfUserWorkspace.id] ?? {};
return {
settingsPermissions: settingsPermissionsMap,
objectRecordsPermissions: objectRecordsPermissions,
};
}
public async getUserWorkspacePermissions({
userWorkspaceId,
workspaceId,

67
packages/twenty-server/src/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache.service.ts
View File

@ -247,17 +247,15 @@ export class WorkspacePermissionsCacheService {
relations: ['objectPermissions'],
});
const workspaceObjectMetadataNameIdMap =
await this.getWorkspaceObjectMetadataNameIdMap(workspaceId);
const workspaceObjectMetadataIds =
await this.getWorkspaceObjectMetadataIds(workspaceId);
const permissionsByRoleId: ObjectRecordsPermissionsByRoleId = {};
for (const role of roles) {
const objectRecordsPermissions: ObjectRecordsPermissions = {};
for (const objectMetadataNameSingular of Object.keys(
workspaceObjectMetadataNameIdMap,
)) {
for (const objectMetadataId of workspaceObjectMetadataIds) {
let canRead = role.canReadAllObjectRecords;
let canUpdate = role.canUpdateAllObjectRecords;
let canSoftDelete = role.canSoftDeleteAllObjectRecords;
@ -266,8 +264,7 @@ export class WorkspacePermissionsCacheService {
if (isPermissionsV2Enabled) {
const objectRecordPermissionsOverride = role.objectPermissions.find(
(objectPermission) =>
objectPermission.objectMetadataId ===
workspaceObjectMetadataNameIdMap[objectMetadataNameSingular],
objectPermission.objectMetadataId === objectMetadataId,
);
canRead =
@ -283,7 +280,7 @@ export class WorkspacePermissionsCacheService {
canDestroy;
}
objectRecordsPermissions[objectMetadataNameSingular] = {
objectRecordsPermissions[objectMetadataId] = {
canRead,
canUpdate,
canSoftDelete,
@ -297,53 +294,17 @@ export class WorkspacePermissionsCacheService {
return permissionsByRoleId;
}
private async getWorkspaceObjectMetadataNameIdMap(
private async getWorkspaceObjectMetadataIds(
workspaceId: string,
): Promise<Record<string, string>> {
let workspaceObjectMetadataMap: Record<string, string> = {};
const metadataVersion =
await this.workspaceCacheStorageService.getMetadataVersion(workspaceId);
): Promise<string[]> {
const workspaceObjectMetadata = await this.objectMetadataRepository.find({
where: {
workspaceId,
},
select: ['id'],
});
if (metadataVersion) {
const objectMetadataMaps =
await this.workspaceCacheStorageService.getObjectMetadataMaps(
workspaceId,
metadataVersion,
);
workspaceObjectMetadataMap = Object.values(
objectMetadataMaps?.byId ?? {},
).reduce(
(acc, objectMetadata) => {
acc[objectMetadata.nameSingular] = objectMetadata.id;
return acc;
},
{} as Record<string, string>,
);
}
if (
!metadataVersion ||
Object.keys(workspaceObjectMetadataMap).length === 0
) {
const workspaceObjectMetadata = await this.objectMetadataRepository.find({
where: {
workspaceId,
},
});
workspaceObjectMetadataMap = workspaceObjectMetadata.reduce(
(acc, objectMetadata) => {
acc[objectMetadata.nameSingular] = objectMetadata.id;
return acc;
},
{} as Record<string, string>,
);
}
return workspaceObjectMetadataMap;
return workspaceObjectMetadata.map((objectMetadata) => objectMetadata.id);
}
private async getUserWorkspaceRoleMapFromDatabase({

3
packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts
View File

@ -47,7 +47,8 @@ export const validateOperationIsPermittedOrThrow = ({
return;
}
const permissionsForEntity = objectRecordsPermissions[entityName];
const permissionsForEntity =
objectRecordsPermissions[objectMetadataIdForEntity];
switch (operationType) {
case 'select':