Commit Graph
3002 Commits
Author SHA1 Message Date
Abdullah.andGitHub f2d9262e6a fix: on-headers is vulnerable to http response header manipulation (#15453)
Resolves [Dependabot Alert
245](https://github.com/twentyhq/twenty/security/dependabot/245) -
on-headers is vulnerable to http response header manipulation.

Updated the version of express-session from `1.18.1` to `1.18.2`.
2025-10-29 20:32:15 +01:00
Raphaël BosiandGitHub 198bf5a333 Complete color refactoring (#15414)
# Complete color refactoring

Closes https://github.com/twentyhq/core-team-issues/issues/1779

- Updated all colors to use Radix colors with P3 color space allowing
for brighter colors
- Created our own gray scale interpolated on Radix's scale to have the
same values for grays as the old ones in the app
- Introduced dark and light colors as well as there transparent versions
- Added many new colors from radix that can be used in the tags or in
the graphs
- Updated multiple color utilities to match new behaviors
- Changed the computation of Avatar colors to return only colors from
the theme (before it was random hsl)

These changes allow the user to use new colors in tags or charts, the
colors are brighter and with better contrast. We have a full range of
color variations from 1 to 12 where before we only had 4 adaptative
colors.
All these changes will allow us to develop custom themes for the user
soon, where users can choose their accent colors, background colors and
there contrast.
2025-10-29 18:08:51 +00:00
Paul RastoinandGitHub f6f52d676f Explicitly set workspaceId column as uuid type to ease pg LEFT JOIN (#15430)
Pg scan was redundant because historically the workspaceId was
`varchar`, even though below migration won't change that we had a look
to workspaceId col declaration across the codebase
2025-10-29 19:08:44 +01:00
martmullandGitHub a6cc80eedd 1751 extensibility twenty sdk v2 use twenty sdk to define a serverless function trigger (#15347)
This PR adds 2 columns handlerPath and handlerName in serverlessFunction
to locate the entrypoint of a serverless in a codebase

It adds the following decorators in twenty-sdk:
- ServerlessFunction
- DatabaseEventTrigger
- RouteTrigger
- CronTrigger
- ApplicationVariable

It still supports deprecated entity.manifest.jsonc 

Overall code needs to be cleaned a little bit, but it should work
properly so you can try to test if the DEVX fits your needs

See updates in hello-world application

```typescript
import axios from 'axios';
import {
  DatabaseEventTrigger,
  ServerlessFunction,
  RouteTrigger,
  CronTrigger,
  ApplicationVariable,
} from 'twenty-sdk';

@ApplicationVariable({
  universalIdentifier: 'dedc53eb-9c12-4fe2-ba86-4a2add19d305',
  key: 'TWENTY_API_KEY',
  description: 'Twenty API Key',
  isSecret: true,
})
@DatabaseEventTrigger({
  universalIdentifier: '203f1df3-4a82-4d06-a001-b8cf22a31156',
  eventName: 'person.created',
})
@RouteTrigger({
  universalIdentifier: 'c9f84c8d-b26d-40d1-95dd-4f834ae5a2c6',
  path: '/post-card/create',
  httpMethod: 'GET',
  isAuthRequired: false,
})
@CronTrigger({
  universalIdentifier: 'dd802808-0695-49e1-98c9-d5c9e2704ce2',
  pattern: '0 0 1 1 *', // Every year 1st of January
})
@ServerlessFunction({
  universalIdentifier: 'e56d363b-0bdc-4d8a-a393-6f0d1c75bdcf',
})
class CreateNewPostCard {
  main = async (params: { recipient: string }): Promise<string> => {
    const { recipient } = params;

    const options = {
      method: 'POST',
      url: 'http://localhost:3000/rest/postCards',
      headers: {
        'Content-Type': 'application/json',
        Authorization: `Bearer ${process.env.TWENTY_API_KEY}`,
      },
      data: { name: recipient ?? 'Unknown' },
    };

    try {
      const { data } = await axios.request(options);

      console.log(`New post card to "${recipient}" created`);

      return data;
    } catch (error) {
      console.error(error);
      throw error;
    }
  };
}

export const createNewPostCardHandler = new CreateNewPostCard().main;

```


### [edit] V2 

After the v1 proposal, I see that using a class method to define the
serverless function handler is pretty confusing. Lets leave
serverlessFunction configuration decorators on the class, but move the
handler like before. Here is the v2 hello-world serverless function:

```typescript
import axios from 'axios';
import {
  DatabaseEventTrigger,
  ServerlessFunction,
  RouteTrigger,
  CronTrigger,
  ApplicationVariable,
} from 'twenty-sdk';

@ApplicationVariable({
  universalIdentifier: 'dedc53eb-9c12-4fe2-ba86-4a2add19d305',
  key: 'TWENTY_API_KEY',
  description: 'Twenty API Key',
  isSecret: true,
})
@DatabaseEventTrigger({
  universalIdentifier: '203f1df3-4a82-4d06-a001-b8cf22a31156',
  eventName: 'person.created',
})
@RouteTrigger({
  universalIdentifier: 'c9f84c8d-b26d-40d1-95dd-4f834ae5a2c6',
  path: '/post-card/create',
  httpMethod: 'GET',
  isAuthRequired: false,
})
@CronTrigger({
  universalIdentifier: 'dd802808-0695-49e1-98c9-d5c9e2704ce2',
  pattern: '0 0 1 1 *', // Every year 1st of January
})
@ServerlessFunction({
  universalIdentifier: 'e56d363b-0bdc-4d8a-a393-6f0d1c75bdcf',
})
export class ServerlessFunctionDefinition {}

export const main = async (params: { recipient: string }): Promise<string> => {
  const { recipient } = params;

  const options = {
    method: 'POST',
    url: 'http://localhost:3000/rest/postCards',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${process.env.TWENTY_API_KEY}`,
    },
    data: { name: recipient ?? 'Unknown' },
  };

  try {
    const { data } = await axios.request(options);

    console.log(`New post card to "${recipient}" created`);

    return data;
  } catch (error) {
    console.error(error);
    throw error;
  }
};

```


### [edit] V3

After the v2 proposal, we don't really like decorators on empty classes.
We decided to go with a Vercel approach with a config constant

```typescript
import axios from 'axios';
import { ServerlessFunctionConfig } from 'twenty-sdk';

export const main = async (params: { recipient: string }): Promise<string> => {
  const { recipient } = params;

  const options = {
    method: 'POST',
    url: 'http://localhost:3000/rest/postCards',
    headers: {
      'Content-Type': 'application/json',
      Authorization: `Bearer ${process.env.TWENTY_API_KEY}`,
    },
    data: { name: recipient ?? 'Unknown' },
  };

  try {
    const { data } = await axios.request(options);

    console.log(`New post card to "${recipient}" created`);

    return data;
  } catch (error) {
    console.error(error);
    throw error;
  }
};

export const config: ServerlessFunctionConfig = {
  universalIdentifier: 'e56d363b-0bdc-4d8a-a393-6f0d1c75bdcf',
  routeTriggers: [
  {
    universalIdentifier: 'c9f84c8d-b26d-40d1-95dd-4f834ae5a2c6',
    path: '/post-card/create',
    httpMethod: 'GET',
    isAuthRequired: false,
  }
  ],
  cronTriggers: [
    {
      universalIdentifier: 'dd802808-0695-49e1-98c9-d5c9e2704ce2',
      pattern: '0 0 1 1 *', // Every year 1st of January
    }
  ],
  databaseEventTriggers: [
  {
    universalIdentifier: '203f1df3-4a82-4d06-a001-b8cf22a31156',
    eventName: 'person.created',
   }
  ]
}

```
2025-10-29 16:51:43 +00:00
Paul RastoinandGitHub 0070fc10f8 Debug sentry redis integration (#15431) 2025-10-29 15:34:47 +01:00
8f009e66f1 i18n - translations (#15432)
Created by Github action

---------

Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-29 15:20:58 +01:00
Paul RastoinandGitHub c19a799973 Fix view rest api in v2 (#15398)
# Introduction
Initially wanted to reactive the test introduced in
https://github.com/twentyhq/twenty/pull/15393, that was failing because
of direct data source access removing all views ( even seeded one )
which was making the test fail

While doing so discovered a lot of issue with the rest API:
- Rest api wasn't consuming the v2 at all
- Rest api wasn't prepared to handle v2 exceptions
- Rest api did not handled unknown exceptions ( timeout )

Refactored the cleanup of each test to follow black box pattern and
avoid test leakage
2025-10-29 15:07:08 +01:00
nitinandGitHub 28c6edfa1f add validation on widgets grid position and sizing (#15397)
closes https://github.com/twentyhq/core-team-issues/issues/1606

As discussed in DMS -- overlapping is not a concern since the library
handles the collision and handles overlapping widgets (if created
through api) using the compact type vertical (ie, move the widget
vertically to create space)
2025-10-29 14:05:26 +00:00
MarieandGitHub 473efb5dc5 [groupBy] Order by within records (#15404)
Closes https://github.com/twentyhq/core-team-issues/issues/1727

<img width="1415" height="625" alt="image"
src="https://github.com/user-attachments/assets/cd132582-4a95-463c-8946-87b77670e023"
/>
2025-10-29 14:49:10 +01:00
Paul RastoinandGitHub a9fa0c33ff Fix workspace views prefill (#15428) 2025-10-29 12:24:06 +01:00
eaa82af22f i18n - translations (#15423)
Created by Github action

---------

Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-29 11:21:25 +01:00
EtienneandGitHub 0849483d2e Common - Remove feature flag (#15371)
To be done in an other PR, move graphql-query-runner handlers in
common-api-query-runner folder (+ renaming + typing improvments)


Fixes : 
- totalCount on findMany (Rest)
- getAllSelectedFields did not handle composite field (Rest)
- issue with endCursor (Rest)
- args processing for updateOne and createOne (Rest + Gql)
- fix findDuplicates (Gql)
2025-10-29 10:01:52 +00:00
EtienneandGitHub 5ae7674b9d Common - Throttle update + Metrics (#15413) 2025-10-28 19:15:18 +01:00
8d823827da fix: made standard object labels editable (#15388)
Fixes #15302 

## Video ( Fixed ) :

[Uploading
IssueFixed.mov…](https://drive.google.com/file/d/1XNk3i3ae9Wafelqgbj5GujaPAJRQRcQh/view?usp=sharing)

---------

Co-authored-by: prastoin <paul@twenty.com>
Co-authored-by: Charles Bochet <charles@twenty.com>
2025-10-28 19:03:20 +01:00
EtienneandGitHub 7df43d8fe8 Common - Update many fix (#15412) 2025-10-28 18:45:08 +01:00
1590751131 Set formatted before instead of after (#15401)
Soft deletion events use before in event properties. But we set the
after instead, that only contains a few data.

Fixes https://github.com/twentyhq/twenty/issues/15120

Debugging raised an additional issue. UpdateMany, RestoreMany and
SoftDeleteMany were broken for custom objects. The `where` clause was
using "_objectName.id" instead of "objectName.id" during select. That's
why we need to use different where clause between the select of the
existing value and the actual mutation.

---------

Co-authored-by: Charles Bochet <charles@twenty.com>
2025-10-28 17:13:39 +01:00
Thomas TrompetteGitHubgreptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
da0e5ba342 Support primitive types in filters (#15402)
When using primitive types such as array, number and boolean, we display
a text field in filters because fieldmetadataId is empty. We should
instead support these as we would do for our own fields.

Adding also a fix for https://github.com/twentyhq/twenty/issues/15282

---------

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>
2025-10-28 14:13:10 +00:00
EtienneandGitHub ee6b86b1a8 Common - many fixes (#15395) 2025-10-28 13:33:41 +01:00
EtienneandGitHub 99d73d1d4b Add metric (+fix) (#15400) 2025-10-28 11:57:31 +00:00
55224121aa i18n - translations (#15399)
Created by Github action

---------

Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-28 12:17:43 +01:00
Paul RastoinandGitHub 4dbc78285d Remove deprecated view and related workspace entities (#15393)
# Introduction
A while ago we migrated view from workspace to metadata
Their standard objects workspace entities declaration remained we can
now remove them

## Deprecating commands before 1.5
The view migration command from workspace to metadata was introduced in
`1.5.0`. Removing the `baseWorkspaceEntity` make this command obsolete.
If tomorrow twenty handles auto upgrade in latest and a user having an
instance in `1.3.0` starts auto-upgrading he won't be able to migrate
his views ( that's why we should not support upgrade before 1.5 anymore
here )
We will have the same use case with FavoritesFolders
2025-10-28 11:03:49 +00:00
Thomas TrompetteandGitHub be08233fa4 Add sort section in find records action (#15340)
https://github.com/user-attachments/assets/020f3e97-316b-41db-b95d-7b938a7f82cf
2025-10-28 09:54:47 +01:00
Raphaël BosiandGitHub 01d8b99c38 Update bar chart design (#15372)
- Implement new dynamic color palettes
- Create custom bar component with rounded edges



https://github.com/user-attachments/assets/8246f16d-0239-4807-bb4a-9647367575f2
2025-10-27 16:46:06 +00:00
GuillimandGitHub e975fbe217 Add the MORPH feature in the LAB (#15126)
PR to publish the morph relation in the lab once we are ready to push it

Fixes https://github.com/twentyhq/core-team-issues/issues/1292
2025-10-27 17:35:43 +01:00
Charles BochetandGitHub 6cf5bd2ed4 Remove old Calendar and Messaging partial/full sync stages (#15380)
Now that all existing and new workspaces have the following syncStage:
- CALENDAR_EVENT_LIST_FETCH_PENDING
- MESSAGE_LIST_FETCH_PENDING

We can fully deprecate the old FULL_CALENDAR_EVENT_LIST_FETCH_PENDING
and PARTIAL_CALENDAR_EVENT_LIST_FETCH_PENDING (full vs partial is now
directly inferred from the presence of a cursor)
2025-10-27 17:35:10 +01:00
neo773andGitHub d66d972d01 fix invalid condition for google refresh token (#15383) 2025-10-27 17:29:37 +01:00
MarieandGitHub 0e7d18546d [groupBy] Handle relations on groupBy with records (#15379)
Following PR https://github.com/twentyhq/twenty/pull/15307
2025-10-27 15:14:02 +00:00
Paul RastoinandGitHub 1bf40d9dca Fix v2 self relation field creation (#15382)
# Introduction
Fixing self relation field creation in v2
- When computing related flat field to delete on object metadata
deletion that has self relation fields
- On self relation creation validation name availability not searching
for the relation target field of the current object field if it's the
field being validated

## Coverage
- added CUD integration testing on self relation fields

close https://github.com/twentyhq/twenty/issues/15153
2025-10-27 16:07:58 +01:00
neo773andGitHub dc9d8db770 refactor: extract filter-emails utils into separate files (#15365) 2025-10-27 14:35:21 +01:00
neo773andGitHub b978b28760 fix gmail access token (#15374) 2025-10-27 12:21:38 +00:00
Paul RastoinandGitHub 267af42412 Centralize v2 errors types in twenty-shared (#15358)
# Introduction
Followup of https://github.com/twentyhq/twenty/pull/15331 ( Reducing
size by concerns )
This PR centralizes v2 format error types in `twenty-shared` and
consuming them in the existing v2 error format logic in `twenty-server`

## Next
This https://github.com/twentyhq/twenty/pull/15360 handles the frontend
v2 format error refactor

## Conclusion
Related to https://github.com/twentyhq/core-team-issues/issues/1776
2025-10-27 09:44:41 +01:00
Abdul RahmanandGitHub 6405097c6b Add Role tab to agent detail page and fix restricted fields permission issue (#15276) 2025-10-26 09:17:37 +01:00
Abdullah.andGitHub 63c261645a fix: nodemailer - email to an unintended domain can occur due to interpretation conflict. (#15356)
Resolves [Dependabot Alert
289](https://github.com/twentyhq/twenty/security/dependabot/289) and a
couple other alerts.

Removed types for `imapflow` since the package ships them internally
now. `yarn.lock` has major changes due to an upgraded AWS SDK
`@aws-sdk/client-sesv2` which is used by Nodemailer 7.

- No breaking changes were introduced in imapflow and mailparser. 
- Nodemailer's breaking change was dropping the legacy SES transport; we
already use the SMTP transport + our own AWS SES client, so nothing else
needs changing.
2025-10-26 07:08:13 +01:00
Kenny VaneetveldeandGitHub 7f911913c7 fix(mcp): Remove jsonSchema wrapper from tool inputSchema for MCP compatibility (#15349)
## Description

Fixes #15348

The Vercel AI SDK serializes tool schemas with a `jsonSchema` wrapper
(`{ jsonSchema: {...} }`), but the Model Context Protocol specification
expects the schema directly (`{ type: 'object', properties: {...} }`).

This was causing MCP clients like Claude Desktop to silently reject all
tool definitions as invalid, leaving users with no available tools.

## Changes

Modified `handleToolsListing()` in `mcp.service.ts` to unwrap the
`jsonSchema` key before returning tools to MCP clients.

## Before

```json
{
  "name": "create_company",
  "description": "...",
  "inputSchema": {
    "jsonSchema": {
      "type": "object",
      "properties": {...}
    }
  }
}
```

## After

```json
{
  "name": "create_company",
  "description": "...",
  "inputSchema": {
    "type": "object",
    "properties": {...}
  }
}
```

## Testing

Tested with:
- Direct curl request to verify schema format
- Claude Desktop client via mcp-proxy
- Verified tools now appear correctly in MCP clients

## References

- [MCP Tools
Specification](https://modelcontextprotocol.io/specification/2025-06-18/server/tools)
- Related discussion in #12953
2025-10-25 09:59:23 +02:00
Baptiste DevessierandGitHub 9b2a73d50a Support more standard objects in Record Page Layout (#15288)
Used the `PageLayoutRenderer` for people, opportunities, tasks and
notes.

## Demo


https://github.com/user-attachments/assets/35e61702-f338-47b3-91b7-fd3951a0c967
2025-10-24 17:38:49 +02:00
EtienneandGitHub 93ab1c4118 Throttling in common api (#15338) 2025-10-24 17:32:51 +02:00
MarieandGitHub d7bda9576f [groupBy] Load record within groups (without relations) (#15307)
First step of https://github.com/twentyhq/core-team-issues/issues/1726.
I will handle relations in another PR.
Another ticket is planned to allow for sorting among the records.

When querying records we have set the number of maximum groups to 50,
and of maximum records par group to 10.

<img width="1283" height="798" alt="image"
src="https://github.com/user-attachments/assets/7ffc9805-d715-4017-8030-4f3521e6f741"
/>
2025-10-24 15:30:57 +00:00
WeikoandGitHub 822b4d75a4 CleanOrphanedKanbanAggregateOperationFieldMetadataIdCommand (#15344)
## Context

We want to introduce a FK between view and fieldMetadata through
KanbanAggregateOperationFieldMetadataId so we need to clean up orphan
ones
2025-10-24 17:18:02 +02:00
a8d35cb831 i18n - translations (#15342)
Created by Github action

---------

Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-24 16:48:06 +02:00
Antoine MoreauxandGitHub 2fdd15e1d9 test(billing): add assertion for end_date in billing subscription s… (#15341)
…ervice test
2025-10-24 16:39:50 +02:00
e37b8b61ba message channel change 2 (#15269)
Co-authored-by: Charles Bochet <charles@twenty.com>
2025-10-24 16:39:22 +02:00
Antoine MoreauxandGitHub 5442e9fc37 fix(billing): adapt current phase to current period (#15321)
Fix https://github.com/twentyhq/core-team-issues/issues/1748
2025-10-24 15:44:08 +02:00
Thomas TrompetteandGitHub f65c4e4be9 Missing workspace id in command (#15337)
As title
2025-10-24 15:01:24 +02:00
682bbe7bba i18n - translations (#15335)
Created by Github action

---------

Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-24 14:48:19 +02:00
WeikoandGitHub a5708c7289 fix migrations (#15336) 2025-10-24 14:47:47 +02:00
EtienneandGitHub 10f4f1592f Common - Update one/many, restore one/many, findDuplicates & mergeMany (#15279)
closes https://github.com/twentyhq/core-team-issues/issues/1739
2025-10-24 12:41:17 +00:00
8f60f7e277 i18n - translations (#15334)
Created by Github action

---------

Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-24 14:39:27 +02:00
721e180fd0 i18n - translations (#15328)
Created by Github action

---------

Co-authored-by: Crowdin Bot <support+bot@crowdin.com>
Co-authored-by: github-actions <github-actions@twenty.com>
2025-10-24 13:46:05 +02:00
c7c671f3e1 Introduce a command to regenerate search vectors for standard and custom objects to fix accent issue. (#15175)
Legacy workspaces still hold the old stored expression, which omits
public.unaccent_immutable, so their tsvectors remain accented and can’t
match the new, unaccented queries. Metadata sync doesn’t touch
asExpression, so only a targeted drop/recreate fixes the underlying
column.

In simpler words, the search vector should contain `mader` instead of
`mäder` for the search to work properly. Therefore, this command
regenerates the search vector across every object that uses
`SEARCH_FIELDS_FOR_*`.

Note that dashboard has a searchVector, but breaks the pattern of using
`SEARCH_FIELDS_FOR_DASHBOARD`. If you look at
packages/twenty-server/src/modules/dashboard/standard-objects/dashboard.workspace-entity.ts:116,
the searchVector field is hard-coded as

```
asExpression: `to_tsvector('english', title)`
```

Therefore, the following code snippet.

```
    const storedExpression = hasAsExpressionSetting(
      searchVectorFieldMetadata.settings,
    )
      ? searchVectorFieldMetadata.settings.asExpression
      : undefined;

    if (storedExpression) {
      return storedExpression;
    }

    return undefined;
```

It checks whether the searchVector field already carries its own
asExpression value in metadata. If the settings object includes that
string, it returns it so the upgrade can reuse the existing expression
for objects that aren’t in our predefined lists. If not, it returns
undefined, signaling there’s no stored expression to fall back on.

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>
Co-authored-by: Félix Malfait <felix@twenty.com>
2025-10-24 10:16:23 +00:00
Raphaël BosiandGitHub f301f07e43 Convert number chart to aggregate chart allowing date aggregates (#15294)
- Convert number chart to aggregate chart 
- Allow date aggregates on all charts
- Only allow `EARLIEST` and `LATEST` on Aggregate chart and Gauge chart
- Various design fixes


https://github.com/user-attachments/assets/b5a2239d-7b11-48b5-93e6-98ceffae5cab
2025-10-24 05:48:42 +13:00