admin/twenty
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Fix workspace hydratation (#12452)

Browse Source 
We must separate the concept of hydratation which happens at the request
level (take the token and pass auth/user context), from the concept of
authorization which happens at the query/endpoint/mutation level.

Previously, hydratation exemption happened at the operation name level
which is not correct because the operation name is meaningless and
optional. Still this gave an impression of security by enforcing a
blacklist. So in this PR we introduce linting rule that aim to achieve a
similar behavior, now every api method has to have a guard. That way if
and endpoint is not protected by AuthUserGuard or AuthWorspaceGuard,
then it has to be stated explicitly next to its code.

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
This commit is contained in:
Félix Malfait
2025-06-09 14:14:32 +02:00
committed by GitHub
parent 322c8a1852
commit ecf21774dd
37 changed files with 741 additions and 138 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
tools/eslint-rules/index.ts
View File

@ -1,54 +1,62 @@
import {
RULE_NAME as injectWorkspaceRepositoryName,
rule as injectWorkspaceRepository,
} from './rules/inject-workspace-repository';
import {
rule as componentPropsNaming,
RULE_NAME as componentPropsNamingName,
rule as componentPropsNaming,
RULE_NAME as componentPropsNamingName,
} from './rules/component-props-naming';
import {
rule as effectComponents,
RULE_NAME as effectComponentsName,
rule as effectComponents,
RULE_NAME as effectComponentsName,
} from './rules/effect-components';
import {
rule as explicitBooleanPredicatesInIf,
RULE_NAME as explicitBooleanPredicatesInIfName,
rule as explicitBooleanPredicatesInIf,
RULE_NAME as explicitBooleanPredicatesInIfName,
} from './rules/explicit-boolean-predicates-in-if';
import {
rule as matchingStateVariable,
RULE_NAME as matchingStateVariableName,
rule as graphqlResolversShouldBeGuarded,
RULE_NAME as graphqlResolversShouldBeGuardedName,
} from './rules/graphql-resolvers-should-be-guarded';
import {
rule as injectWorkspaceRepository,
RULE_NAME as injectWorkspaceRepositoryName,
} from './rules/inject-workspace-repository';
import {
rule as matchingStateVariable,
RULE_NAME as matchingStateVariableName,
} from './rules/matching-state-variable';
import {
rule as maxConstsPerFile,
RULE_NAME as maxConstsPerFileName,
rule as maxConstsPerFile,
RULE_NAME as maxConstsPerFileName,
} from './rules/max-consts-per-file';
import {
rule as noHardcodedColors,
RULE_NAME as noHardcodedColorsName,
rule as noHardcodedColors,
RULE_NAME as noHardcodedColorsName,
} from './rules/no-hardcoded-colors';
import {
rule as noNavigatePreferLink,
RULE_NAME as noNavigatePreferLinkName,
rule as noNavigatePreferLink,
RULE_NAME as noNavigatePreferLinkName,
} from './rules/no-navigate-prefer-link';
import {
rule as noStateUseref,
RULE_NAME as noStateUserefName,
rule as noStateUseref,
RULE_NAME as noStateUserefName,
} from './rules/no-state-useref';
import {
rule as sortCssPropertiesAlphabetically,
RULE_NAME as sortCssPropertiesAlphabeticallyName,
rule as restApiMethodsShouldBeGuarded,
RULE_NAME as restApiMethodsShouldBeGuardedName,
} from './rules/rest-api-methods-should-be-guarded';
import {
rule as sortCssPropertiesAlphabetically,
RULE_NAME as sortCssPropertiesAlphabeticallyName,
} from './rules/sort-css-properties-alphabetically';
import {
rule as styledComponentsPrefixedWithStyled,
RULE_NAME as styledComponentsPrefixedWithStyledName,
rule as styledComponentsPrefixedWithStyled,
RULE_NAME as styledComponentsPrefixedWithStyledName,
} from './rules/styled-components-prefixed-with-styled';
import {
rule as useGetLoadableAndGetValueToGetAtoms,
RULE_NAME as useGetLoadableAndGetValueToGetAtomsName,
rule as useGetLoadableAndGetValueToGetAtoms,
RULE_NAME as useGetLoadableAndGetValueToGetAtomsName,
} from './rules/use-getLoadable-and-getValue-to-get-atoms';
import {
rule as useRecoilCallbackHasDependencyArray,
RULE_NAME as useRecoilCallbackHasDependencyArrayName,
rule as useRecoilCallbackHasDependencyArray,
RULE_NAME as useRecoilCallbackHasDependencyArrayName,
} from './rules/useRecoilCallback-has-dependency-array';
/**
@ -93,5 +101,7 @@ module.exports = {
useRecoilCallbackHasDependencyArray,
[noNavigatePreferLinkName]: noNavigatePreferLink,
[injectWorkspaceRepositoryName]: injectWorkspaceRepository,
[restApiMethodsShouldBeGuardedName]: restApiMethodsShouldBeGuarded,
[graphqlResolversShouldBeGuardedName]: graphqlResolversShouldBeGuarded,
},
};