From ec4b6c9aa2b4f92ee8b9ea3aa592135e5a0a8056 Mon Sep 17 00:00:00 2001
From: Weiko <corentin@twenty.com>
Date: Tue, 4 Mar 2025 10:51:06 +0100
Subject: [PATCH] Fix: security and developers path should not be accessible to
 non-admin users (#10628)

https://github.com/twentyhq/core-team-issues/issues/468
---
 .../modules/app/components/SettingsRoutes.tsx | 141 +++++++++++-------
 1 file changed, 84 insertions(+), 57 deletions(-)

diff --git a/packages/twenty-front/src/modules/app/components/SettingsRoutes.tsx b/packages/twenty-front/src/modules/app/components/SettingsRoutes.tsx
index d6f24a2d6..c0836f8a3 100644
--- a/packages/twenty-front/src/modules/app/components/SettingsRoutes.tsx
+++ b/packages/twenty-front/src/modules/app/components/SettingsRoutes.tsx
@@ -312,14 +312,22 @@ export const SettingsRoutes = ({
           />
         }
       >
+        <Route path={SettingsPath.Workspace} element={<SettingsWorkspace />} />
         <Route path={SettingsPath.Billing} element={<SettingsBilling />} />
+        <Route path={SettingsPath.Domain} element={<SettingsDomain />} />
       </Route>
-      <Route path={SettingsPath.Workspace} element={<SettingsWorkspace />} />
-      <Route path={SettingsPath.Domain} element={<SettingsDomain />} />
       <Route
-        path={SettingsPath.WorkspaceMembersPage}
-        element={<SettingsWorkspaceMembers />}
-      />
+        element={
+          <SettingsProtectedRouteWrapper
+            settingsPermission={SettingsPermissions.WORKSPACE_MEMBERS}
+          />
+        }
+      >
+        <Route
+          path={SettingsPath.WorkspaceMembersPage}
+          element={<SettingsWorkspaceMembers />}
+        />
+      </Route>
       <Route
         element={
           <SettingsProtectedRouteWrapper
@@ -337,6 +345,18 @@ export const SettingsRoutes = ({
           element={<SettingsObjectDetailPage />}
         />
         <Route path={SettingsPath.NewObject} element={<SettingsNewObject />} />
+        <Route
+          path={SettingsPath.ObjectNewFieldSelect}
+          element={<SettingsObjectNewFieldSelect />}
+        />
+        <Route
+          path={SettingsPath.ObjectNewFieldConfigure}
+          element={<SettingsObjectNewFieldConfigure />}
+        />
+        <Route
+          path={SettingsPath.ObjectFieldEdit}
+          element={<SettingsObjectFieldEdit />}
+        />
       </Route>
       <Route
         element={
@@ -349,19 +369,50 @@ export const SettingsRoutes = ({
         <Route path={SettingsPath.Roles} element={<SettingsRoles />} />
         <Route path={SettingsPath.RoleDetail} element={<SettingsRoleEdit />} />
       </Route>
-      <Route path={SettingsPath.Developers} element={<SettingsDevelopers />} />
       <Route
-        path={SettingsPath.DevelopersNewApiKey}
-        element={<SettingsDevelopersApiKeysNew />}
-      />
-      <Route
-        path={SettingsPath.DevelopersApiKeyDetail}
-        element={<SettingsDevelopersApiKeyDetail />}
-      />
-      <Route
-        path={SettingsPath.DevelopersNewWebhookDetail}
-        element={<SettingsDevelopersWebhooksDetail />}
-      />
+        element={
+          <SettingsProtectedRouteWrapper
+            settingsPermission={SettingsPermissions.API_KEYS_AND_WEBHOOKS}
+          />
+        }
+      >
+        <Route
+          path={SettingsPath.Developers}
+          element={<SettingsDevelopers />}
+        />
+        <Route
+          path={SettingsPath.DevelopersNewApiKey}
+          element={<SettingsDevelopersApiKeysNew />}
+        />
+        <Route
+          path={SettingsPath.DevelopersApiKeyDetail}
+          element={<SettingsDevelopersApiKeyDetail />}
+        />
+        <Route
+          path={SettingsPath.DevelopersNewWebhookDetail}
+          element={<SettingsDevelopersWebhooksDetail />}
+        />
+        <Route
+          path={SettingsPath.Integrations}
+          element={<SettingsIntegrations />}
+        />
+        <Route
+          path={SettingsPath.IntegrationDatabase}
+          element={<SettingsIntegrationDatabase />}
+        />
+        <Route
+          path={SettingsPath.IntegrationNewDatabaseConnection}
+          element={<SettingsIntegrationNewDatabaseConnection />}
+        />
+        <Route
+          path={SettingsPath.IntegrationEditDatabaseConnection}
+          element={<SettingsIntegrationEditDatabaseConnection />}
+        />
+        <Route
+          path={SettingsPath.IntegrationDatabaseConnection}
+          element={<SettingsIntegrationShowDatabaseConnection />}
+        />
+      </Route>
       {isFunctionSettingsEnabled && (
         <>
           <Route
@@ -378,48 +429,24 @@ export const SettingsRoutes = ({
           />
         </>
       )}
-      <Route
-        path={SettingsPath.Integrations}
-        element={<SettingsIntegrations />}
-      />
-      <Route
-        path={SettingsPath.IntegrationDatabase}
-        element={<SettingsIntegrationDatabase />}
-      />
-      <Route
-        path={SettingsPath.IntegrationNewDatabaseConnection}
-        element={<SettingsIntegrationNewDatabaseConnection />}
-      />
-      <Route
-        path={SettingsPath.IntegrationEditDatabaseConnection}
-        element={<SettingsIntegrationEditDatabaseConnection />}
-      />
-      <Route
-        path={SettingsPath.IntegrationDatabaseConnection}
-        element={<SettingsIntegrationShowDatabaseConnection />}
-      />
-      <Route
-        path={SettingsPath.ObjectNewFieldSelect}
-        element={<SettingsObjectNewFieldSelect />}
-      />
-      <Route
-        path={SettingsPath.ObjectNewFieldConfigure}
-        element={<SettingsObjectNewFieldConfigure />}
-      />
-      <Route
-        path={SettingsPath.ObjectFieldEdit}
-        element={<SettingsObjectFieldEdit />}
-      />
       <Route path={SettingsPath.Releases} element={<Releases />} />
-      <Route path={SettingsPath.Security} element={<SettingsSecurity />} />
       <Route
-        path={SettingsPath.NewSSOIdentityProvider}
-        element={<SettingsSecuritySSOIdentifyProvider />}
-      />
-      <Route
-        path={SettingsPath.NewApprovedAccessDomain}
-        element={<SettingsSecurityApprovedAccessDomain />}
-      />
+        element={
+          <SettingsProtectedRouteWrapper
+            settingsPermission={SettingsPermissions.SECURITY}
+          />
+        }
+      >
+        <Route path={SettingsPath.Security} element={<SettingsSecurity />} />
+        <Route
+          path={SettingsPath.NewSSOIdentityProvider}
+          element={<SettingsSecuritySSOIdentifyProvider />}
+        />
+        <Route
+          path={SettingsPath.NewApprovedAccessDomain}
+          element={<SettingsSecurityApprovedAccessDomain />}
+        />
+      </Route>
 
       {isAdminPageEnabled && (
         <>