72b4b26e2c
Closes https://github.com/twentyhq/core-team-issues/issues/526 (for reminder: 1. Make defaultRoleId non-nullable for an active workspace 2. Remove permissions V1 feature flag 3. Set member role as default role for new workspaces About 1.: An active workspace's defaultRoleId should never be null. We can't rely on a simple postgres NOT NULL constraint as defaultRoleId will always be initially null when the workspace is first created since the roles do not exist at that time. Let's add a more complex rule to ensure that About 3.: In the first phase of our deploy of permissions, we chose to assign admin role to all existing users, not to break any existing behavior with the introduction of the feature (= existing users have less rights than before). As we deploy permissions to all existing and future workspaces, let's set the member role as default role for future workspaces. )
53 lines
1.6 KiB
TypeScript
53 lines
1.6 KiB
TypeScript
import {
|
|
CanActivate,
|
|
ExecutionContext,
|
|
Injectable,
|
|
mixin,
|
|
Type,
|
|
} from '@nestjs/common';
|
|
import { GqlExecutionContext } from '@nestjs/graphql';
|
|
|
|
import { isDefined } from 'twenty-shared/utils';
|
|
|
|
import { SettingPermissionType } from 'src/engine/metadata-modules/permissions/constants/setting-permission-type.constants';
|
|
import {
|
|
PermissionsException,
|
|
PermissionsExceptionCode,
|
|
PermissionsExceptionMessage,
|
|
} from 'src/engine/metadata-modules/permissions/permissions.exception';
|
|
import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
|
|
|
|
export const SettingsPermissionsGuard = (
|
|
requiredPermission: SettingPermissionType,
|
|
): Type<CanActivate> => {
|
|
@Injectable()
|
|
class SettingsPermissionsMixin implements CanActivate {
|
|
constructor(private readonly permissionsService: PermissionsService) {}
|
|
|
|
async canActivate(context: ExecutionContext): Promise<boolean> {
|
|
const ctx = GqlExecutionContext.create(context);
|
|
const workspaceId = ctx.getContext().req.workspace.id;
|
|
const userWorkspaceId = ctx.getContext().req.userWorkspaceId;
|
|
|
|
const hasPermission =
|
|
await this.permissionsService.userHasWorkspaceSettingPermission({
|
|
userWorkspaceId,
|
|
_setting: requiredPermission,
|
|
workspaceId,
|
|
isExecutedByApiKey: isDefined(ctx.getContext().req.apiKey),
|
|
});
|
|
|
|
if (hasPermission === true) {
|
|
return true;
|
|
}
|
|
|
|
throw new PermissionsException(
|
|
PermissionsExceptionMessage.PERMISSION_DENIED,
|
|
PermissionsExceptionCode.PERMISSION_DENIED,
|
|
);
|
|
}
|
|
}
|
|
|
|
return mixin(SettingsPermissionsMixin);
|
|
};
|