vynte-infra/twenty
2
0
Fork 0
Code Issues Pull Requests Actions 2 Packages Projects Releases Wiki Activity

refactor(twenty-orm): migrate role/api-key/permissions services to WorkspaceScopedRepository

Browse Source 
Cover RoleValidationService, PermissionsService, ApiKeyRoleService,
GenerateApiKeyCommand, and the role permission flag cache service.
This commit is contained in:
Félix Malfait
2026-05-27 19:40:26 +02:00
parent 63145689a4
commit e62d0fc776
8 changed files with 49 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts
+2
View File
@@ -44,6 +44,8 @@ import { ApiKeyController } from './controllers/api-key.controller';
WorkspaceApiKeyMapCacheService,
GenerateApiKeyCommand,
provideWorkspaceScopedRepository(ApiKeyEntity),
provideWorkspaceScopedRepository(RoleEntity),
provideWorkspaceScopedRepository(RoleTargetEntity),
],
controllers: [ApiKeyController],
exports: [
packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts
+5 -4
View File
@@ -13,6 +13,8 @@ import { ApiKeyService } from 'src/engine/core-modules/api-key/services/api-key.
import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
import { STANDARD_ROLE } from 'src/engine/workspace-manager/twenty-standard-application/constants/standard-role.constant';
type GenerateApiKeyCommandOptions = {
@@ -33,8 +35,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
constructor(
@InjectRepository(WorkspaceEntity)
private readonly workspaceRepository: Repository<WorkspaceEntity>,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
private readonly apiKeyService: ApiKeyService,
private readonly twentyConfigService: TwentyConfigService,
) {
@@ -104,9 +106,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
return;
}
const adminRole = await this.roleRepository.findOne({
const adminRole = await this.roleRepository.findOne(workspace.id, {
where: {
workspaceId: workspace.id,
universalIdentifier: STANDARD_ROLE.admin.universalIdentifier,
},
});
packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts
+17 -18
View File
@@ -1,8 +1,7 @@
import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { isDefined } from 'twenty-shared/utils';
import { In, IsNull, Not, Repository } from 'typeorm';
import { In, IsNull, Not } from 'typeorm';
import { ApiKeyEntity } from 'src/engine/core-modules/api-key/api-key.entity';
import {
@@ -23,10 +22,10 @@ import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/works
@Injectable()
export class ApiKeyRoleService {
constructor(
@InjectRepository(RoleTargetEntity)
private readonly roleTargetRepository: Repository<RoleTargetEntity>,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleTargetEntity)
private readonly roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
@InjectWorkspaceScopedRepository(ApiKeyEntity)
private readonly apiKeyRepository: WorkspaceScopedRepository<ApiKeyEntity>,
@@ -141,8 +140,8 @@ export class ApiKeyRoleService {
);
}
const role = await this.roleRepository.findOne({
where: { id: roleId, workspaceId },
const role = await this.roleRepository.findOne(workspaceId, {
where: { id: roleId },
});
if (!role) {
@@ -159,13 +158,15 @@ export class ApiKeyRoleService {
);
}
const existingRoleTarget = await this.roleTargetRepository.findOne({
where: {
apiKeyId,
roleId,
workspaceId,
const existingRoleTarget = await this.roleTargetRepository.findOne(
workspaceId,
{
where: {
apiKeyId,
roleId,
},
},
});
);
return {
roleToAssignIsSameAsCurrentRole: Boolean(existingRoleTarget),
@@ -183,10 +184,9 @@ export class ApiKeyRoleService {
return new Map();
}
const roleTargets = await this.roleTargetRepository.find({
const roleTargets = await this.roleTargetRepository.find(workspaceId, {
where: {
apiKeyId: In(apiKeyIds),
workspaceId,
},
relations: ['role'],
});
@@ -209,10 +209,9 @@ export class ApiKeyRoleService {
roleId: string,
workspaceId: string,
): Promise<ApiKeyEntity[]> {
const roleTargets = await this.roleTargetRepository.find({
const roleTargets = await this.roleTargetRepository.find(workspaceId, {
where: {
roleId,
workspaceId,
apiKeyId: Not(IsNull()),
},
});
packages/twenty-server/src/engine/metadata-modules/flat-role-permission-flag/services/workspace-flat-role-permission-flag-map-cache.service.ts
+3 -4
View File
@@ -25,8 +25,8 @@ export class WorkspaceFlatRolePermissionFlagMapCacheService extends WorkspaceCac
private readonly rolePermissionFlagRepository: Repository<RolePermissionFlagEntity>,
@InjectRepository(ApplicationEntity)
private readonly applicationRepository: Repository<ApplicationEntity>,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
@InjectWorkspaceScopedRepository(PermissionFlagEntity)
private readonly permissionFlagRepository: WorkspaceScopedRepository<PermissionFlagEntity>,
) {
@@ -47,8 +47,7 @@ export class WorkspaceFlatRolePermissionFlagMapCacheService extends WorkspaceCac
select: ['id', 'universalIdentifier'],
withDeleted: true,
}),
this.roleRepository.find({
where: { workspaceId },
this.roleRepository.find(workspaceId, {
select: ['id', 'universalIdentifier'],
withDeleted: true,
}),
packages/twenty-server/src/engine/metadata-modules/permissions/permissions.module.ts
+2
View File
@@ -32,6 +32,8 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
ApiKeyRoleService,
PermissionsService,
provideWorkspaceScopedRepository(ApiKeyEntity),
provideWorkspaceScopedRepository(RoleEntity),
provideWorkspaceScopedRepository(RoleTargetEntity),
],
exports: [PermissionsService, ApiKeyRoleService],
})
packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
+10 -8
View File
@@ -25,6 +25,8 @@ import { type UserWorkspacePermissions } from 'src/engine/metadata-modules/permi
import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
import { UserRoleService } from 'src/engine/metadata-modules/user-role/user-role.service';
import { type RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';
import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/workspace-cache.service';
@Injectable()
@@ -33,8 +35,8 @@ export class PermissionsService {
private readonly userRoleService: UserRoleService,
private readonly workspaceCacheService: WorkspaceCacheService,
private readonly apiKeyRoleService: ApiKeyRoleService,
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
@InjectRepository(ApplicationEntity)
private readonly applicationRepository: Repository<ApplicationEntity>,
) {}
@@ -149,8 +151,8 @@ export class PermissionsService {
workspaceId,
);
const role = await this.roleRepository.findOne({
where: { id: roleId, workspaceId },
const role = await this.roleRepository.findOne(workspaceId, {
where: { id: roleId },
relations: [
'rolePermissionFlags',
'rolePermissionFlags.permissionFlag',
@@ -205,8 +207,8 @@ export class PermissionsService {
const applicationRoleId = application.defaultRoleId;
const role = await this.roleRepository.findOne({
where: { id: applicationRoleId, workspaceId },
const role = await this.roleRepository.findOne(workspaceId, {
where: { id: applicationRoleId },
relations: [
'rolePermissionFlags',
'rolePermissionFlags.permissionFlag',
@@ -289,8 +291,8 @@ export class PermissionsService {
throw new Error('No role IDs provided');
}
const roles = await this.roleRepository.find({
where: { id: In(roleIds), workspaceId },
const roles = await this.roleRepository.find(workspaceId, {
where: { id: In(roleIds) },
relations,
});
packages/twenty-server/src/engine/metadata-modules/role-validation/role-validation.module.ts
+5 -1
View File
@@ -3,10 +3,14 @@ import { TypeOrmModule } from '@nestjs/typeorm';
import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
import { RoleValidationService } from 'src/engine/metadata-modules/role-validation/services/role-validation.service';
import { provideWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/provide-workspace-scoped-repository';
@Module({
imports: [TypeOrmModule.forFeature([RoleEntity])],
providers: [RoleValidationService],
providers: [
RoleValidationService,
provideWorkspaceScopedRepository(RoleEntity),
],
exports: [RoleValidationService],
})
export class RoleValidationModule {}
packages/twenty-server/src/engine/metadata-modules/role-validation/services/role-validation.service.ts
+5 -7
View File
@@ -1,7 +1,4 @@
import { Injectable } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import {
PermissionsException,
@@ -9,22 +6,23 @@ import {
PermissionsExceptionMessage,
} from 'src/engine/metadata-modules/permissions/permissions.exception';
import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
@Injectable()
export class RoleValidationService {
constructor(
@InjectRepository(RoleEntity)
private readonly roleRepository: Repository<RoleEntity>,
@InjectWorkspaceScopedRepository(RoleEntity)
private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
) {}
async validateRoleAssignableToUsersOrThrow(
roleId: string,
workspaceId: string,
): Promise<void> {
const role = await this.roleRepository.findOne({
const role = await this.roleRepository.findOne(workspaceId, {
where: {
id: roleId,
workspaceId,
},
});