Sonarly Claude Code
04c2c3c3e5
https://sonarly.com/issue/20520?type=bug Record creation fails with PERMISSION_DENIED when any field used in row-level permissions has Edit disabled, because the insert code path shares the same field-level update permission check as the update code path. Fix: Separated the `insert` case from the `update` case in `validateOperationIsPermittedOrThrow` in `permissions.utils.ts`. **Problem:** The `case 'insert':` fell through to `case 'update':`, causing both operations to run `validateUpdateFieldPermissionOrThrow`. For inserts, `updatedColumns` contains ALL columns in the SQL INSERT (derived from TypeORM's `valuesSet`), including join columns for relation fields that the user never explicitly set. If any of these fields had `canUpdate: false` (Edit disabled), the entire insert was rejected. **Fix:** The `insert` case now has its own block that: 1. Checks `canUpdateObjectRecords` (unchanged — object-level permission) 2. Validates read field permissions on returned columns (unchanged) 3. Skips `validateUpdateFieldPermissionOrThrow` — field-level update restrictions should not apply to record creation This is safe because: - Row-level security constraints are validated separately in `WorkspaceInsertQueryBuilder.validateRLSPredicatesForInsert()`, which checks that the newly created record satisfies RLS predicates (e.g., "Owner is (Me) or Owner is Empty") - The `update` case is completely unchanged and continues to enforce field-level update permissions - Users can still only create records that satisfy their RLS predicates
The #1 Open-Source CRM
🌐 Website · 📚 Documentation · 
Roadmap · 
Discord · 
Figma
Installation
See: 🚀 Self-hosting 🖥️ Local Setup
Why Twenty
We built Twenty for three reasons:
CRMs are too expensive, and users are trapped. Companies use locked-in customer data to hike prices. It shouldn't be that way.
A fresh start is required to build a better experience. We can learn from past mistakes and craft a cohesive experience inspired by new UX patterns from tools like Notion, Airtable or Linear.
We believe in open-source and community. Hundreds of developers are already building Twenty together. Once we have plugin capabilities, a whole ecosystem will grow around it.
What You Can Do With Twenty
Please feel free to flag any specific needs you have by creating an issue.
Below are a few features we have implemented to date:
- Personalize layouts with filters, sort, group by, kanban and table views
- Customize your objects and fields
- Create and manage permissions with custom roles
- Automate workflow with triggers and actions
- Emails, calendar events, files, and more
Personalize layouts with filters, sort, group by, kanban and table views
Customize your objects and fields
Create and manage permissions with custom roles
Automate workflow with triggers and actions
Emails, calendar events, files, and more
Stack
- TypeScript
- Nx
- NestJS, with BullMQ, PostgreSQL, Redis
- React, with Jotai, Linaria and Lingui
Thanks
Thanks to these amazing services that we use and recommend for UI testing (Chromatic), code review (Greptile), catching bugs (Sentry) and translating (Crowdin).
Join the Community
- Star the repo
- Subscribe to releases (watch -> custom -> releases)
- Follow us on Twitter or LinkedIn
- Join our Discord
- Improve translations on Crowdin
- Contributions are, of course, most welcome!