## Summary Splits admin-panel resolvers off the shared `/metadata` GraphQL endpoint onto a dedicated `/admin-panel` endpoint. The backend plumbing mirrors the existing `metadata` / `core` pattern (new scope, decorator, module, factory), and admin types now live in their own `generated-admin/graphql.ts` on the frontend — dropping 877 lines of admin noise from `generated-metadata`. ## Why - **Smaller attack surface on `/metadata`** — every authenticated user hits that endpoint; admin ops don't belong there. - **Independent complexity limits and monitoring** per endpoint. - **Cleaner module boundaries** — admin is a cross-cutting concern that doesn't match the "shared-schema configuration" meaning of `/metadata`. - **Deploy / blast-radius isolation** — a broken admin query can't affect `/metadata`. Runtime behavior, auth, and authorization are unchanged — this is a relocation, not a re-permissioning. All existing guards (`WorkspaceAuthGuard`, `UserAuthGuard`, `SettingsPermissionGuard(SECURITY)` at class level; `AdminPanelGuard` / `ServerLevelImpersonateGuard` at method level) remain on `AdminPanelResolver`. ## What changed ### Backend - `@AdminResolver()` decorator with scope `'admin'`, naming parallels `CoreResolver` / `MetadataResolver`. - `AdminPanelGraphQLApiModule` + `adminPanelModuleFactory` registered at `/admin-panel`, same Yoga hook set as the metadata factory (Sentry tracing, error handler, introspection-disabling in prod, complexity validation). - Middleware chain on `/admin-panel` is identical to `/metadata`. - `@nestjs/graphql` patch extended: `resolverSchemaScope?: 'core' | 'metadata' | 'admin'`. - `AdminPanelResolver` class decorator swapped from `@MetadataResolver()` to `@AdminResolver()` — no other changes. ### Frontend - `codegen-admin.cjs` → `src/generated-admin/graphql.ts` (982 lines). - `codegen-metadata.cjs` excludes admin paths; metadata file shrinks by 877 lines. - `ApolloAdminProvider` / `useApolloAdminClient` follow the existing `ApolloCoreProvider` / `useApolloCoreClient` pattern, wired inside `AppRouterProviders` alongside the core provider. - 37 admin consumer files migrated: imports switched to `~/generated-admin/graphql` and `client: useApolloAdminClient()` is passed to `useQuery` / `useMutation`. - Three files intentionally kept on `generated-metadata` because they consume non-admin Documents: `useHandleImpersonate.ts`, `SettingsAdminApplicationRegistrationDangerZone.tsx`, `SettingsAdminApplicationRegistrationGeneralToggles.tsx`. ### CI - `ci-server.yaml` runs all three `graphql:generate` configurations and diff-checks all three generated dirs. ## Authorization (unchanged, but audited while reviewing) Every one of the 38 methods on `AdminPanelResolver` has a method-level guard: - `AdminPanelGuard` (32 methods) — requires `canAccessFullAdminPanel === true` - `ServerLevelImpersonateGuard` (6 methods: user/workspace lookup + chat thread views) — requires `canImpersonate === true` On top of the class-level guards above. No resolver method is accessible without these flags + `SECURITY` permission in the workspace. ## Test plan - [ ] Dev server boots; `/graphql`, `/metadata`, `/admin-panel` all mapped as separate GraphQL routes (confirmed locally during development). - [ ] `nx typecheck twenty-server` passes. - [ ] `nx typecheck twenty-front` passes. - [ ] `nx lint:diff-with-main twenty-server` and `twenty-front` both clean. - [ ] Manual smoke test: log in with a user who has `canAccessFullAdminPanel=true`, open the admin panel at `/settings/admin-panel`, verify each tab loads (General, Health, Config variables, AI, Apps, Workspace details, User details, chat threads). - [ ] Manual smoke test: log in with a user who has `canImpersonate=false` and `canAccessFullAdminPanel=false`, hit `/admin-panel` directly with a raw GraphQL request, confirm permission error on every operation. - [ ] Production deploy note: reverse proxy / ingress must route the new `/admin-panel` path to the Nest server. If the proxy has an explicit allowlist, infra change required before cutover. ## Follow-ups (out of scope here) - Consider cutting over the three `SettingsAdminApplicationRegistration*` components to admin-scope versions of the app-registration operations so the admin page is fully on the admin endpoint. - The `renderGraphiQL` double-assignment in `admin-panel.module-factory.ts` is copied from `metadata.module-factory.ts` — worth cleaning up in both.
147 lines
5.3 KiB
TypeScript
147 lines
5.3 KiB
TypeScript
import {
|
|
type DynamicModule,
|
|
type MiddlewareConsumer,
|
|
Module,
|
|
RequestMethod,
|
|
} from '@nestjs/common';
|
|
import { GraphQLModule } from '@nestjs/graphql';
|
|
import { ServeStaticModule } from '@nestjs/serve-static';
|
|
|
|
import { existsSync } from 'fs';
|
|
import { join } from 'path';
|
|
|
|
import { YogaDriver, type YogaDriverConfig } from '@graphql-yoga/nestjs';
|
|
import { SentryModule } from '@sentry/nestjs/setup';
|
|
|
|
import { AdminPanelGraphQLApiModule } from 'src/engine/api/graphql/admin-panel-graphql-api.module';
|
|
import { CoreGraphQLApiModule } from 'src/engine/api/graphql/core-graphql-api.module';
|
|
import { GraphQLConfigModule } from 'src/engine/api/graphql/graphql-config/graphql-config.module';
|
|
import { GraphQLConfigService } from 'src/engine/api/graphql/graphql-config/graphql-config.service';
|
|
import { MetadataGraphQLApiModule } from 'src/engine/api/graphql/metadata-graphql-api.module';
|
|
import { McpMethodGuardMiddleware } from 'src/engine/api/mcp/middlewares/mcp-method-guard.middleware';
|
|
import { McpModule } from 'src/engine/api/mcp/mcp.module';
|
|
import { RestApiModule } from 'src/engine/api/rest/rest-api.module';
|
|
import { WorkspaceAuthContextMiddleware } from 'src/engine/core-modules/auth/middlewares/workspace-auth-context.middleware';
|
|
import { MetricsModule } from 'src/engine/core-modules/metrics/metrics.module';
|
|
import { DataloaderModule } from 'src/engine/dataloaders/dataloader.module';
|
|
import { WorkspaceMetadataVersionModule } from 'src/engine/metadata-modules/workspace-metadata-version/workspace-metadata-version.module';
|
|
import { GraphQLHydrateRequestFromTokenMiddleware } from 'src/engine/middlewares/graphql-hydrate-request-from-token.middleware';
|
|
import { MiddlewareModule } from 'src/engine/middlewares/middleware.module';
|
|
import { RestCoreMiddleware } from 'src/engine/middlewares/rest-core.middleware';
|
|
import { GlobalWorkspaceDataSourceModule } from 'src/engine/twenty-orm/global-workspace-datasource/global-workspace-datasource.module';
|
|
import { TwentyORMModule } from 'src/engine/twenty-orm/twenty-orm.module';
|
|
import { WorkspaceCacheStorageModule } from 'src/engine/workspace-cache-storage/workspace-cache-storage.module';
|
|
import { ModulesModule } from 'src/modules/modules.module';
|
|
|
|
import { ClickHouseModule } from './database/clickHouse/clickHouse.module';
|
|
import { CoreEngineModule } from './engine/core-modules/core-engine.module';
|
|
import { I18nModule } from './engine/core-modules/i18n/i18n.module';
|
|
|
|
// TODO: Remove this middleware when all the rest endpoints are migrated to TwentyORM
|
|
const MIGRATED_REST_METHODS = [
|
|
RequestMethod.DELETE,
|
|
RequestMethod.POST,
|
|
RequestMethod.PATCH,
|
|
RequestMethod.PUT,
|
|
RequestMethod.GET,
|
|
];
|
|
|
|
@Module({
|
|
imports: [
|
|
SentryModule.forRoot(),
|
|
GraphQLModule.forRootAsync<YogaDriverConfig>({
|
|
driver: YogaDriver,
|
|
imports: [GraphQLConfigModule, MetricsModule, DataloaderModule],
|
|
useClass: GraphQLConfigService,
|
|
}),
|
|
TwentyORMModule,
|
|
GlobalWorkspaceDataSourceModule,
|
|
ClickHouseModule,
|
|
// Core engine module, contains all the core modules
|
|
CoreEngineModule,
|
|
// Modules module, contains all business logic modules
|
|
ModulesModule,
|
|
// Needed for the user workspace middleware
|
|
WorkspaceCacheStorageModule,
|
|
// Api modules
|
|
CoreGraphQLApiModule,
|
|
MetadataGraphQLApiModule,
|
|
AdminPanelGraphQLApiModule,
|
|
RestApiModule,
|
|
McpModule,
|
|
MiddlewareModule,
|
|
WorkspaceMetadataVersionModule,
|
|
// I18n module for translations
|
|
I18nModule,
|
|
// Conditional modules
|
|
...AppModule.getConditionalModules(),
|
|
],
|
|
})
|
|
export class AppModule {
|
|
private static getConditionalModules(): DynamicModule[] {
|
|
const modules: DynamicModule[] = [];
|
|
const frontPath = join(__dirname, 'front');
|
|
|
|
// NestJS DevTools - can be useful for debugging and profiling
|
|
/* if (process.env.NODE_ENV === NodeEnvironment.DEVELOPMENT) {
|
|
modules.push(
|
|
DevtoolsModule.register({
|
|
http: true,
|
|
}),
|
|
);
|
|
} */
|
|
|
|
if (existsSync(frontPath)) {
|
|
modules.push(
|
|
ServeStaticModule.forRoot({
|
|
rootPath: frontPath,
|
|
}),
|
|
);
|
|
}
|
|
|
|
// Messaque Queue explorer only for sync driver
|
|
// Maybe we don't need to conditionaly register the explorer, because we're creating a jobs module
|
|
// that will expose classes that are only used in the queue worker
|
|
/*
|
|
if (process.env.MESSAGE_QUEUE_TYPE === MessageQueueDriverType.Sync) {
|
|
modules.push(MessageQueueModule.registerExplorer());
|
|
}
|
|
*/
|
|
|
|
return modules;
|
|
}
|
|
|
|
configure(consumer: MiddlewareConsumer) {
|
|
consumer
|
|
.apply(
|
|
GraphQLHydrateRequestFromTokenMiddleware,
|
|
WorkspaceAuthContextMiddleware,
|
|
)
|
|
.forRoutes({ path: 'graphql', method: RequestMethod.ALL });
|
|
|
|
consumer
|
|
.apply(
|
|
GraphQLHydrateRequestFromTokenMiddleware,
|
|
WorkspaceAuthContextMiddleware,
|
|
)
|
|
.forRoutes({ path: 'metadata', method: RequestMethod.ALL });
|
|
|
|
consumer
|
|
.apply(
|
|
GraphQLHydrateRequestFromTokenMiddleware,
|
|
WorkspaceAuthContextMiddleware,
|
|
)
|
|
.forRoutes({ path: 'admin-panel', method: RequestMethod.ALL });
|
|
|
|
consumer
|
|
.apply(McpMethodGuardMiddleware)
|
|
.forRoutes({ path: 'mcp', method: RequestMethod.ALL });
|
|
|
|
for (const method of MIGRATED_REST_METHODS) {
|
|
consumer
|
|
.apply(RestCoreMiddleware, WorkspaceAuthContextMiddleware)
|
|
.forRoutes({ path: 'rest/*path', method });
|
|
}
|
|
}
|
|
}
|