[permissions] Remove raw queries and restrict its usage (#12360)

Closes https://github.com/twentyhq/core-team-issues/issues/748 In the frame of the work on permissions we - remove all raw queries possible to use repositories instead - forbid usage workspaceDataSource.executeRawQueries() - restrict usage of workspaceDataSource.query() to force developers to pass on shouldBypassPermissionChecks to use it. --------- Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2025-06-02 10:53:51 +02:00
parent 1ef7b7a474
commit 9706f0df13
49 changed files with 495 additions and 754 deletions
--- a/packages/twenty-server/src/modules/timeline/jobs/timeline-job.module.ts
+++ b/packages/twenty-server/src/modules/timeline/jobs/timeline-job.module.ts
@ -1,17 +1,12 @@
 import { Module } from '@nestjs/common';

 import { AuditModule } from 'src/engine/core-modules/audit/audit.module';
-import { ObjectMetadataRepositoryModule } from 'src/engine/object-metadata-repository/object-metadata-repository.module';
+import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
 import { UpsertTimelineActivityFromInternalEvent } from 'src/modules/timeline/jobs/upsert-timeline-activity-from-internal-event.job';
 import { TimelineActivityModule } from 'src/modules/timeline/timeline-activity.module';
-import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';

@Module({
-  imports: [
-    ObjectMetadataRepositoryModule.forFeature([WorkspaceMemberWorkspaceEntity]),
-    TimelineActivityModule,
-    AuditModule,
-  ],
+  imports: [TimelineActivityModule, AuditModule, TwentyORMModule],
  providers: [UpsertTimelineActivityFromInternalEvent],
 })
 export class TimelineJobModule {}
--- a/packages/twenty-server/src/modules/timeline/jobs/upsert-timeline-activity-from-internal-event.job.ts
+++ b/packages/twenty-server/src/modules/timeline/jobs/upsert-timeline-activity-from-internal-event.job.ts
@ -2,18 +2,16 @@ import { ObjectRecordNonDestructiveEvent } from 'src/engine/core-modules/event-e
 import { Process } from 'src/engine/core-modules/message-queue/decorators/process.decorator';
 import { Processor } from 'src/engine/core-modules/message-queue/decorators/processor.decorator';
 import { MessageQueue } from 'src/engine/core-modules/message-queue/message-queue.constants';
-import { InjectObjectMetadataRepository } from 'src/engine/object-metadata-repository/object-metadata-repository.decorator';
+import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
 import { WorkspaceEventBatch } from 'src/engine/workspace-event-emitter/types/workspace-event.type';
 import { TimelineActivityService } from 'src/modules/timeline/services/timeline-activity.service';
-import { WorkspaceMemberRepository } from 'src/modules/workspace-member/repositories/workspace-member.repository';
 import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';

@Processor(MessageQueue.entityEventsToDbQueue)
 export class UpsertTimelineActivityFromInternalEvent {
  constructor(
-    @InjectObjectMetadataRepository(WorkspaceMemberWorkspaceEntity)
-    private readonly workspaceMemberService: WorkspaceMemberRepository,
    private readonly timelineActivityService: TimelineActivityService,
+    private readonly twentyORMGlobalManager: TwentyORMGlobalManager,
  ) {}

  @Process(UpsertTimelineActivityFromInternalEvent.name)
@ -22,9 +20,18 @@ export class UpsertTimelineActivityFromInternalEvent {
  ): Promise<void> {
    for (const eventData of workspaceEventBatch.events) {
      if (eventData.userId) {
-        const workspaceMember = await this.workspaceMemberService.getByIdOrFail(
-          eventData.userId,
-          workspaceEventBatch.workspaceId,
+        const workspaceMemberRepository =
+          await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+            workspaceEventBatch.workspaceId,
+            WorkspaceMemberWorkspaceEntity,
+            {
+              shouldBypassPermissionChecks: true,
+            },
+          );
+        const workspaceMember = await workspaceMemberRepository.findOneByOrFail(
+          {
+            userId: eventData.userId,
+          },
        );

        eventData.workspaceMemberId = workspaceMember.id;
--- a/packages/twenty-server/src/modules/timeline/repositiories/timeline-activity.repository.ts
+++ b/packages/twenty-server/src/modules/timeline/repositiories/timeline-activity.repository.ts
@ -1,14 +1,16 @@
 import { Injectable } from '@nestjs/common';

+import { MoreThan } from 'typeorm';
+
 import { ObjectRecord } from 'src/engine/api/graphql/workspace-query-builder/interfaces/object-record.interface';

 import { objectRecordDiffMerge } from 'src/engine/core-modules/event-emitter/utils/object-record-diff-merge';
-import { WorkspaceDataSourceService } from 'src/engine/workspace-datasource/workspace-datasource.service';
+import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';

@Injectable()
 export class TimelineActivityRepository {
  constructor(
-    private readonly workspaceDataSourceService: WorkspaceDataSourceService,
+    private readonly twentyORMGlobalManager: TwentyORMGlobalManager,
  ) {}

  async upsertOne(
@ -22,11 +24,7 @@ export class TimelineActivityRepository {
    linkedRecordId?: string,
    linkedObjectMetadataId?: string,
  ) {
-    const dataSourceSchema =
-      this.workspaceDataSourceService.getSchemaName(workspaceId);
-
    const recentTimelineActivity = await this.findRecentTimelineActivity(
-      dataSourceSchema,
      name,
      objectName,
      recordId,
@ -53,7 +51,6 @@ export class TimelineActivityRepository {
      );

      return this.updateTimelineActivity(
-        dataSourceSchema,
        recentTimelineActivity[0].id,
        newProps,
        workspaceMemberId,
@ -62,7 +59,6 @@ export class TimelineActivityRepository {
    }

    return this.insertTimelineActivity(
-      dataSourceSchema,
      name,
      properties,
      objectName,
@ -76,7 +72,6 @@ export class TimelineActivityRepository {
  }

  private async findRecentTimelineActivity(
-    dataSourceSchema: string,
    name: string,
    objectName: string,
    recordId: string,
@ -84,40 +79,59 @@ export class TimelineActivityRepository {
    linkedRecordId: string | undefined,
    workspaceId: string,
  ) {
-    return this.workspaceDataSourceService.executeRawQuery(
-      `SELECT * FROM ${dataSourceSchema}."timelineActivity"
-      WHERE "${objectName}Id" = $1
-      AND "name" = $2
-      AND "workspaceMemberId" = $3
-      AND ${
-        linkedRecordId ? `"linkedRecordId" = $4` : `"linkedRecordId" IS NULL`
-      }
-      AND "createdAt" >= NOW() - interval '10 minutes'`,
-      linkedRecordId
-        ? [recordId, name, workspaceMemberId, linkedRecordId]
-        : [recordId, name, workspaceMemberId],
-      workspaceId,
-    );
+    const timelineActivityTypeORMRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        'timelineActivity',
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );
+
+    const tenMinutesAgo = new Date(Date.now() - 10 * 60 * 1000);
+
+    const whereConditions: Record<string, unknown> = {
+      [objectName + 'Id']: recordId,
+      name: name,
+      workspaceMemberId: workspaceMemberId,
+      createdAt: MoreThan(tenMinutesAgo),
+    };
+
+    if (linkedRecordId) {
+      whereConditions.linkedRecordId = linkedRecordId;
+    } else {
+      whereConditions.linkedRecordId = null;
+    }
+
+    return timelineActivityTypeORMRepository.find({
+      where: whereConditions,
+      order: { createdAt: 'DESC' },
+      take: 1,
+    });
  }

  private async updateTimelineActivity(
-    dataSourceSchema: string,
    id: string,
    properties: Partial<ObjectRecord>,
    workspaceMemberId: string | undefined,
    workspaceId: string,
  ) {
-    return this.workspaceDataSourceService.executeRawQuery(
-      `UPDATE ${dataSourceSchema}."timelineActivity"
-      SET "properties" = $2, "workspaceMemberId" = $3
-      WHERE "id" = $1`,
-      [id, properties, workspaceMemberId],
-      workspaceId,
-    );
+    const timelineActivityTypeORMRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        'timelineActivity',
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );
+
+    return timelineActivityTypeORMRepository.update(id, {
+      properties: properties,
+      workspaceMemberId: workspaceMemberId,
+    });
  }

  private async insertTimelineActivity(
-    dataSourceSchema: string,
    name: string,
    properties: Partial<ObjectRecord>,
    objectName: string,
@ -128,21 +142,24 @@ export class TimelineActivityRepository {
    linkedObjectMetadataId: string | undefined,
    workspaceId: string,
  ) {
-    return this.workspaceDataSourceService.executeRawQuery(
-      `INSERT INTO ${dataSourceSchema}."timelineActivity"
-    ("name", "properties", "workspaceMemberId", "${objectName}Id", "linkedRecordCachedName", "linkedRecordId", "linkedObjectMetadataId")
-    VALUES ($1, $2, $3, $4, $5, $6, $7)`,
-      [
-        name,
-        properties,
-        workspaceMemberId,
-        recordId,
-        linkedRecordCachedName ?? '',
-        linkedRecordId,
-        linkedObjectMetadataId,
-      ],
-      workspaceId,
-    );
+    const timelineActivityTypeORMRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        'timelineActivity',
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );
+
+    return timelineActivityTypeORMRepository.insert({
+      name: name,
+      properties: properties,
+      workspaceMemberId: workspaceMemberId,
+      [objectName + 'Id']: recordId,
+      linkedRecordCachedName: linkedRecordCachedName ?? '',
+      linkedRecordId: linkedRecordId,
+      linkedObjectMetadataId: linkedObjectMetadataId,
+    });
  }

  public async insertTimelineActivitiesForObject(
@ -161,33 +178,25 @@ export class TimelineActivityRepository {
    if (activities.length === 0) {
      return;
    }
+    const timelineActivityTypeORMRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        'timelineActivity',
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );

-    const dataSourceSchema =
-      this.workspaceDataSourceService.getSchemaName(workspaceId);
-
-    return this.workspaceDataSourceService.executeRawQuery(
-      `INSERT INTO ${dataSourceSchema}."timelineActivity"
-    ("name", "properties", "workspaceMemberId", "${objectName}Id", "linkedRecordCachedName", "linkedRecordId", "linkedObjectMetadataId")
-    VALUES ${activities
-      .map(
-        (_, index) =>
-          `($${index * 7 + 1}, $${index * 7 + 2}, $${index * 7 + 3}, $${
-            index * 7 + 4
-          }, $${index * 7 + 5}, $${index * 7 + 6}, $${index * 7 + 7})`,
-      )
-      .join(',')}`,
-      activities
-        .map((activity) => [
-          activity.name,
-          activity.properties,
-          activity.workspaceMemberId,
-          activity.recordId,
-          activity.linkedRecordCachedName ?? '',
-          activity.linkedRecordId,
-          activity.linkedObjectMetadataId,
-        ])
-        .flat(),
-      workspaceId,
+    return timelineActivityTypeORMRepository.insert(
+      activities.map((activity) => ({
+        name: activity.name,
+        properties: activity.properties,
+        workspaceMemberId: activity.workspaceMemberId,
+        [objectName + 'Id']: activity.recordId,
+        linkedRecordCachedName: activity.linkedRecordCachedName ?? '',
+        linkedRecordId: activity.linkedRecordId,
+        linkedObjectMetadataId: activity.linkedObjectMetadataId,
+      })),
    );
  }
 }
--- a/packages/twenty-server/src/modules/timeline/services/timeline-activity.service.ts
+++ b/packages/twenty-server/src/modules/timeline/services/timeline-activity.service.ts
@ -1,9 +1,11 @@
 import { Injectable } from '@nestjs/common';

+import { isDefined } from 'twenty-shared/utils';
+
 import { ObjectRecordNonDestructiveEvent } from 'src/engine/core-modules/event-emitter/types/object-record-non-destructive-event';
 import { ObjectRecordBaseEvent } from 'src/engine/core-modules/event-emitter/types/object-record.base.event';
 import { InjectObjectMetadataRepository } from 'src/engine/object-metadata-repository/object-metadata-repository.decorator';
-import { WorkspaceDataSourceService } from 'src/engine/workspace-datasource/workspace-datasource.service';
+import { TwentyORMGlobalManager } from 'src/engine/twenty-orm/twenty-orm-global.manager';
 import { TimelineActivityRepository } from 'src/modules/timeline/repositiories/timeline-activity.repository';
 import { TimelineActivityWorkspaceEntity } from 'src/modules/timeline/standard-objects/timeline-activity.workspace-entity';

@ -22,7 +24,7 @@ export class TimelineActivityService {
  constructor(
    @InjectObjectMetadataRepository(TimelineActivityWorkspaceEntity)
    private readonly timelineActivityRepository: TimelineActivityRepository,
-    private readonly workspaceDataSourceService: WorkspaceDataSourceService,
+    private readonly twentyORMGlobalManager: TwentyORMGlobalManager,
  ) {}

  private targetObjects: Record<string, string> = {
@ -110,14 +112,10 @@ export class TimelineActivityService {
    workspaceId: string;
    eventName: string;
  }): Promise<TimelineActivity[] | undefined> {
-    const dataSourceSchema =
-      this.workspaceDataSourceService.getSchemaName(workspaceId);
-
    switch (event.objectMetadata.nameSingular) {
      case 'noteTarget':
        return this.computeActivityTargets({
          event,
-          dataSourceSchema,
          activityType: 'note',
          eventName,
          workspaceId,
@ -125,7 +123,6 @@ export class TimelineActivityService {
      case 'taskTarget':
        return this.computeActivityTargets({
          event,
-          dataSourceSchema,
          activityType: 'task',
          eventName,
          workspaceId,
@ -134,7 +131,6 @@ export class TimelineActivityService {
      case 'task':
        return this.computeActivities({
          event,
-          dataSourceSchema,
          activityType: event.objectMetadata.nameSingular,
          eventName,
          workspaceId,
@ -146,100 +142,119 @@ export class TimelineActivityService {

  private async computeActivities({
    event,
-    dataSourceSchema,
    activityType,
    eventName,
    workspaceId,
  }: {
    event: ObjectRecordBaseEvent;
-    dataSourceSchema: string;
    activityType: string;
    eventName: string;
    workspaceId: string;
  }) {
-    const activityTargets =
-      await this.workspaceDataSourceService.executeRawQuery(
-        `SELECT * FROM ${dataSourceSchema}."${this.targetObjects[activityType]}"
-         WHERE "${activityType}Id" = $1`,
-        [event.recordId],
+    const activityTargetRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
        workspaceId,
+        this.targetObjects[activityType],
+        {
+          shouldBypassPermissionChecks: true,
+        },
      );

-    const activity = await this.workspaceDataSourceService.executeRawQuery(
-      `SELECT * FROM ${dataSourceSchema}."${activityType}"
-       WHERE "id" = $1`,
-      [event.recordId],
-      workspaceId,
-    );
+    const activityTargets = await activityTargetRepository.find({
+      where: {
+        [activityType + 'Id']: event.recordId,
+      },
+    });
+
+    const activityRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        activityType,
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );
+
+    const activity = await activityRepository.findOneBy({
+      id: event.recordId,
+    });

    if (activityTargets.length === 0) return;
-    if (activity.length === 0) return;
+    if (!isDefined(activity)) return;

-    return (
-      activityTargets
+    return activityTargets
+      .map((activityTarget) => {
+        const targetColumn: string[] = Object.entries(activityTarget)
+          .map(([columnName, columnValue]: [string, string]) => {
+            if (
+              columnName === activityType + 'Id' ||
+              !columnName.endsWith('Id')
+            )
+              return;
+            if (columnValue === null) return;
+
+            return columnName;
+          })
+          .filter((column): column is string => column !== undefined);
+
+        if (targetColumn.length === 0) return;
+
+        return {
+          ...event,
+          name: 'linked-' + eventName,
+          objectName: targetColumn[0].replace(/Id$/, ''),
+          recordId: activityTarget[targetColumn[0]],
+          linkedRecordCachedName: activity.title,
+          linkedRecordId: activity.id,
+          linkedObjectMetadataId: event.objectMetadata.id,
+        } satisfies TimelineActivity;
+      })
+      .filter(
        // @ts-expect-error legacy noImplicitAny
-        .map((activityTarget) => {
-          const targetColumn: string[] = Object.entries(activityTarget)
-            .map(([columnName, columnValue]: [string, string]) => {
-              if (
-                columnName === activityType + 'Id' ||
-                !columnName.endsWith('Id')
-              )
-                return;
-              if (columnValue === null) return;
-
-              return columnName;
-            })
-            .filter((column): column is string => column !== undefined);
-
-          if (targetColumn.length === 0) return;
-
-          return {
-            ...event,
-            name: 'linked-' + eventName,
-            objectName: targetColumn[0].replace(/Id$/, ''),
-            recordId: activityTarget[targetColumn[0]],
-            linkedRecordCachedName: activity[0].title,
-            linkedRecordId: activity[0].id,
-            linkedObjectMetadataId: event.objectMetadata.id,
-          } satisfies TimelineActivity;
-        })
-        // @ts-expect-error legacy noImplicitAny
-        .filter((event): event is TimelineActivity => event !== undefined)
-    );
+        (event): event is TimelineActivity => event !== undefined,
+      ) as TimelineActivity[];
  }

  private async computeActivityTargets({
    event,
-    dataSourceSchema,
    activityType,
    eventName,
    workspaceId,
  }: {
    event: ObjectRecordBaseEvent;
-    dataSourceSchema: string;
-    activityType: string;
+    activityType: 'task' | 'note';
    eventName: string;
    workspaceId: string;
  }): Promise<TimelineActivity[] | undefined> {
-    const activityTarget =
-      await this.workspaceDataSourceService.executeRawQuery(
-        `SELECT * FROM ${dataSourceSchema}."${this.targetObjects[activityType]}"
-         WHERE "id" = $1`,
-        [event.recordId],
+    const activityTargetRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
        workspaceId,
+        this.targetObjects[activityType],
+        {
+          shouldBypassPermissionChecks: true,
+        },
      );

-    if (activityTarget.length === 0) return;
+    const activityTarget = await activityTargetRepository.findOneBy({
+      id: event.recordId,
+    });

-    const activity = await this.workspaceDataSourceService.executeRawQuery(
-      `SELECT * FROM ${dataSourceSchema}."${activityType}"
-       WHERE "id" = $1`,
-      [activityTarget[0].activityId],
-      workspaceId,
-    );
+    if (!isDefined(activityTarget)) return;

-    if (activity.length === 0) return;
+    const activityRepository =
+      await this.twentyORMGlobalManager.getRepositoryForWorkspace(
+        workspaceId,
+        activityType,
+        {
+          shouldBypassPermissionChecks: true,
+        },
+      );
+
+    const activity = await activityRepository.findOneBy({
+      id: activityTarget.activityId,
+    });
+
+    if (!isDefined(activity)) return;

    const activityObjectMetadataId = event.objectMetadata.fields.find(
      (field) => field.name === activityType,
--- a/packages/twenty-server/src/modules/timeline/timeline-activity.module.ts
+++ b/packages/twenty-server/src/modules/timeline/timeline-activity.module.ts
@ -1,16 +1,16 @@
 import { Module } from '@nestjs/common';

 import { ObjectMetadataRepositoryModule } from 'src/engine/object-metadata-repository/object-metadata-repository.module';
-import { WorkspaceDataSourceModule } from 'src/engine/workspace-datasource/workspace-datasource.module';
+import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
 import { TimelineActivityService } from 'src/modules/timeline/services/timeline-activity.service';
 import { TimelineActivityWorkspaceEntity } from 'src/modules/timeline/standard-objects/timeline-activity.workspace-entity';

@Module({
  imports: [
-    WorkspaceDataSourceModule,
    ObjectMetadataRepositoryModule.forFeature([
      TimelineActivityWorkspaceEntity,
    ]),
+    TwentyORMModule,
  ],
  providers: [TimelineActivityService],
  exports: [TimelineActivityService],