## Overview This PR strengthens our permission system by introducing more granular role-based access control across the platform. ## Changes ### New Permissions Added - **Applications** - Control who can install and manage applications - **Layouts** - Control who can customize page layouts and UI structure - **AI** - Control access to AI features and agents - **Upload File** - Separate permission for file uploads - **Download File** - Separate permission for file downloads (frontend visibility) ### Security Enhancements - Implemented whitelist-based validation for workspace field updates - Added explicit permission guards to core entity resolvers - Enhanced ESLint rule to enforce permission checks on all mutations - Created `CustomPermissionGuard` and `NoPermissionGuard` for better code documentation ### Affected Components - Core entity resolvers: webhooks, files, domains, applications, layouts, postgres credentials - Workspace update mutations now use whitelist validation - Settings UI updated with new permission controls ### Developer Experience - ESLint now catches missing permission guards during development - Explicit guard markers make permission requirements clear in code review - Comprehensive test coverage for new permission logic ## Testing - ✅ All TypeScript type checks pass - ✅ ESLint validation passes - ✅ New permission guards properly enforced - ✅ Frontend UI displays new permissions correctly ## Migration Notes Existing workspaces will need to assign the new permissions to roles as needed. By default, all new permissions are set to `false` for non-admin roles.
5.0 KiB
5.0 KiB
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
Twenty is an open-source CRM built with modern technologies in a monorepo structure. The codebase is organized as an Nx workspace with multiple packages.
Key Commands
Development
# Start development environment (frontend + backend + worker)
yarn start
# Individual package development
npx nx start twenty-front # Start frontend dev server
npx nx start twenty-server # Start backend server
npx nx run twenty-server:worker # Start background worker
Testing
# Run tests
npx nx test twenty-front # Frontend unit tests
npx nx test twenty-server # Backend unit tests
npx nx run twenty-server:test:integration:with-db-reset # Integration tests with DB reset
# Storybook
npx nx storybook:build twenty-front # Build Storybook
npx nx storybook:serve-and-test:static twenty-front # Run Storybook tests
When testing the UI end to end, click on "Continue with Email" and use the prefilled credentials.
Code Quality
# Linting
npx nx lint twenty-front # Frontend linting
npx nx lint twenty-server # Backend linting
npx nx lint twenty-front --fix # Auto-fix linting issues
# Type checking
npx nx typecheck twenty-front
npx nx typecheck twenty-server
# Format code
npx nx fmt twenty-front
npx nx fmt twenty-server
Build
# Build packages
npx nx build twenty-front
npx nx build twenty-server
Database Operations
# Database management
npx nx database:reset twenty-server # Reset database
npx nx run twenty-server:database:init:prod # Initialize database
npx nx run twenty-server:database:migrate:prod # Run migrations
# Generate migration
npx nx run twenty-server:typeorm migration:generate src/database/typeorm/core/migrations/common/[name] -d src/database/typeorm/core/core.datasource.ts
# Sync metadata
npx nx run twenty-server:command workspace:sync-metadata
GraphQL
# Generate GraphQL types
npx nx run twenty-front:graphql:generate
Architecture Overview
Tech Stack
- Frontend: React 18, TypeScript, Recoil (state management), Emotion (styling), Vite
- Backend: NestJS, TypeORM, PostgreSQL, Redis, GraphQL (with GraphQL Yoga)
- Monorepo: Nx workspace managed with Yarn 4
Package Structure
packages/
├── twenty-front/ # React frontend application
├── twenty-server/ # NestJS backend API
├── twenty-ui/ # Shared UI components library
├── twenty-shared/ # Common types and utilities
├── twenty-emails/ # Email templates with React Email
├── twenty-website/ # Next.js documentation website
├── twenty-zapier/ # Zapier integration
└── twenty-e2e-testing/ # Playwright E2E tests
Key Development Principles
- Functional components only (no class components)
- Named exports only (no default exports)
- Types over interfaces (except when extending third-party interfaces)
- String literals over enums (except for GraphQL enums)
- No 'any' type allowed
- Event handlers preferred over useEffect for state updates
State Management
- Recoil for global state management
- Component-specific state with React hooks
- GraphQL cache managed by Apollo Client
Backend Architecture
- NestJS modules for feature organization
- TypeORM for database ORM with PostgreSQL
- GraphQL API with code-first approach
- Redis for caching and session management
- BullMQ for background job processing
Database
- PostgreSQL as primary database
- Redis for caching and sessions
- TypeORM migrations for schema management
- ClickHouse for analytics (when enabled)
Development Workflow
IMPORTANT: Use Context7 for code generation, setup or configuration steps, or library/API documentation. Automatically use the Context7 MCP tools to resolve library IDs and get library docs without waiting for explicit requests.
Before Making Changes
- Always run linting and type checking after code changes
- Test changes with relevant test suites
- Ensure database migrations are properly structured
- Check that GraphQL schema changes are backward compatible
Code Style Notes
- Use Emotion for styling with styled-components pattern
- Follow Nx workspace conventions for imports
- Use Lingui for internationalization
- Components should be in their own directories with tests and stories
Testing Strategy
- Unit tests with Jest for both frontend and backend
- Integration tests for critical backend workflows
- Storybook for component development and testing
- E2E tests with Playwright for critical user flows
Important Files
nx.json- Nx workspace configuration with task definitionstsconfig.base.json- Base TypeScript configurationpackage.json- Root package with workspace definitions.cursor/rules/- Development guidelines and best practices