From e863318f1c55ea8cd6beac97e4228bc0d8f4f617 Mon Sep 17 00:00:00 2001 From: Weiko Date: Wed, 27 May 2026 20:14:43 +0200 Subject: [PATCH] review 2 --- .../logic-function-executor.service.ts | 90 +----------------- .../permissions/permissions.service.ts | 93 ++++++++++++++----- 2 files changed, 74 insertions(+), 109 deletions(-) diff --git a/packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts b/packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts index 15932a68c52..c88f9a6c666 100644 --- a/packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts +++ b/packages/twenty-server/src/engine/core-modules/logic-function/logic-function-executor/logic-function-executor.service.ts @@ -6,7 +6,6 @@ import { DEFAULT_API_URL_NAME, DEFAULT_APP_ACCESS_TOKEN_NAME, DEFAULT_PERMISSION_CONTEXT_NAME, - type LogicFunctionPermissionContext, } from 'twenty-shared/application'; import { isDefined } from 'twenty-shared/utils'; import { Not, Repository } from 'typeorm'; @@ -266,10 +265,11 @@ export class LogicFunctionExecutorService { this.secretEncryptionService, ); - const permissionContext = await this.buildPermissionContext({ - workspaceId, - roleId, - }); + const permissionContext = + await this.permissionsService.buildLogicFunctionPermissionContext({ + workspaceId, + roleId, + }); return { [DEFAULT_API_URL_NAME]: baseUrl ?? '', @@ -284,86 +284,6 @@ export class LogicFunctionExecutorService { }; } - private async buildPermissionContext({ - workspaceId, - roleId, - }: { - workspaceId: string; - roleId?: string; - }): Promise { - if (!isDefined(roleId)) { - return { - canReadAllObjectRecords: false, - canUpdateAllObjectRecords: false, - canSoftDeleteAllObjectRecords: false, - canDestroyAllObjectRecords: false, - canUpdateAllSettings: false, - canAccessAllTools: false, - permissionFlags: {}, - objectsPermissions: {}, - }; - } - - const { capabilities, permissionFlags, objectsPermissions } = - await this.permissionsService.getRolePermissionContext({ - roleId, - workspaceId, - }); - - const { flatObjectMetadataMaps, flatFieldMetadataMaps } = - await this.workspaceCacheService.getOrRecompute(workspaceId, [ - 'flatObjectMetadataMaps', - 'flatFieldMetadataMaps', - ]); - - const objectsPermissionsByUniversalIdentifier: LogicFunctionPermissionContext['objectsPermissions'] = - {}; - - for (const [objectMetadataId, objectPermissions] of Object.entries( - objectsPermissions, - )) { - const objectUniversalIdentifier = - flatObjectMetadataMaps.universalIdentifierById[objectMetadataId]; - - if (!isDefined(objectUniversalIdentifier)) { - continue; - } - - const restrictedFields: LogicFunctionPermissionContext['objectsPermissions'][string]['restrictedFields'] = - {}; - - for (const [fieldMetadataId, fieldPermissions] of Object.entries( - objectPermissions.restrictedFields, - )) { - const fieldUniversalIdentifier = - flatFieldMetadataMaps.universalIdentifierById[fieldMetadataId]; - - if (!isDefined(fieldUniversalIdentifier)) { - continue; - } - - restrictedFields[fieldUniversalIdentifier] = { - canRead: fieldPermissions.canRead, - canUpdate: fieldPermissions.canUpdate, - }; - } - - objectsPermissionsByUniversalIdentifier[objectUniversalIdentifier] = { - canRead: objectPermissions.canReadObjectRecords, - canUpdate: objectPermissions.canUpdateObjectRecords, - canSoftDelete: objectPermissions.canSoftDeleteObjectRecords, - canDestroy: objectPermissions.canDestroyObjectRecords, - restrictedFields, - }; - } - - return { - ...capabilities, - permissionFlags, - objectsPermissions: objectsPermissionsByUniversalIdentifier, - }; - } - // Resolves encrypted server-level variables (ApplicationRegistrationVariable) // for the application's registration. Returns an empty object when the // application isn't linked to a registration (legacy LOCAL apps). diff --git a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts index 30317bf9bcf..8e9392ca1bd 100644 --- a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts +++ b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts @@ -2,11 +2,11 @@ import { Injectable } from '@nestjs/common'; import { InjectRepository } from '@nestjs/typeorm'; import { msg } from '@lingui/core/macro'; +import { type LogicFunctionPermissionContext } from 'twenty-shared/application'; import { PermissionFlagType, SystemPermissionFlag, } from 'twenty-shared/constants'; -import { type ObjectsPermissions } from 'twenty-shared/types'; import { isDefined } from 'twenty-shared/utils'; import { In, Repository } from 'typeorm'; @@ -100,34 +100,40 @@ export class PermissionsService { }; } - public async getRolePermissionContext({ + public async buildLogicFunctionPermissionContext({ roleId, workspaceId, }: { - roleId: string; + roleId?: string; workspaceId: string; - }): Promise<{ - capabilities: { - canReadAllObjectRecords: boolean; - canUpdateAllObjectRecords: boolean; - canSoftDeleteAllObjectRecords: boolean; - canDestroyAllObjectRecords: boolean; - canUpdateAllSettings: boolean; - canAccessAllTools: boolean; - }; - permissionFlags: Record; - objectsPermissions: ObjectsPermissions; - }> { + }): Promise { + if (!isDefined(roleId)) { + return { + canReadAllObjectRecords: false, + canUpdateAllObjectRecords: false, + canSoftDeleteAllObjectRecords: false, + canDestroyAllObjectRecords: false, + canUpdateAllSettings: false, + canAccessAllTools: false, + permissionFlags: {}, + objectsPermissions: {}, + }; + } + const { rolesPermissions, flatRoleMaps, flatRolePermissionFlagMaps, flatPermissionFlagMaps, + flatObjectMetadataMaps, + flatFieldMetadataMaps, } = await this.workspaceCacheService.getOrRecompute(workspaceId, [ 'rolesPermissions', 'flatRoleMaps', 'flatRolePermissionFlagMaps', 'flatPermissionFlagMaps', + 'flatObjectMetadataMaps', + 'flatFieldMetadataMaps', ]); const flatRole = findFlatEntityByIdInFlatEntityMaps({ @@ -173,17 +179,56 @@ export class PermissionsService { grantedPermissionFlagIds.has(flatPermissionFlag.id); } + const objectsPermissions: LogicFunctionPermissionContext['objectsPermissions'] = + {}; + + for (const [objectMetadataId, objectPermissions] of Object.entries( + rolesPermissions[roleId] ?? {}, + )) { + const objectUniversalIdentifier = + flatObjectMetadataMaps.universalIdentifierById[objectMetadataId]; + + if (!isDefined(objectUniversalIdentifier)) { + continue; + } + + const restrictedFields: LogicFunctionPermissionContext['objectsPermissions'][string]['restrictedFields'] = + {}; + + for (const [fieldMetadataId, fieldPermissions] of Object.entries( + objectPermissions.restrictedFields, + )) { + const fieldUniversalIdentifier = + flatFieldMetadataMaps.universalIdentifierById[fieldMetadataId]; + + if (!isDefined(fieldUniversalIdentifier)) { + continue; + } + + restrictedFields[fieldUniversalIdentifier] = { + canRead: fieldPermissions.canRead, + canUpdate: fieldPermissions.canUpdate, + }; + } + + objectsPermissions[objectUniversalIdentifier] = { + canRead: objectPermissions.canReadObjectRecords, + canUpdate: objectPermissions.canUpdateObjectRecords, + canSoftDelete: objectPermissions.canSoftDeleteObjectRecords, + canDestroy: objectPermissions.canDestroyObjectRecords, + restrictedFields, + }; + } + return { - capabilities: { - canReadAllObjectRecords: flatRole.canReadAllObjectRecords, - canUpdateAllObjectRecords: flatRole.canUpdateAllObjectRecords, - canSoftDeleteAllObjectRecords: flatRole.canSoftDeleteAllObjectRecords, - canDestroyAllObjectRecords: flatRole.canDestroyAllObjectRecords, - canUpdateAllSettings: flatRole.canUpdateAllSettings, - canAccessAllTools: flatRole.canAccessAllTools, - }, + canReadAllObjectRecords: flatRole.canReadAllObjectRecords, + canUpdateAllObjectRecords: flatRole.canUpdateAllObjectRecords, + canSoftDeleteAllObjectRecords: flatRole.canSoftDeleteAllObjectRecords, + canDestroyAllObjectRecords: flatRole.canDestroyAllObjectRecords, + canUpdateAllSettings: flatRole.canUpdateAllSettings, + canAccessAllTools: flatRole.canAccessAllTools, permissionFlags, - objectsPermissions: rolesPermissions[roleId] ?? {}, + objectsPermissions, }; }