MarieandGitHub
96aef62ae4
Fixes https://github.com/twentyhq/core-team-issues/issues/1956 **Problem** Within an app, the `.yarn/releases/` folder contains executable Yarn binaries that run when executing any yarn command (`.yarnrc` file indicates yarn path to be `.yarn/releases/yarn-4.9.2.cjs `.) This is a supply chain attack vector: a malicious actor could submit a PR with a compromised `yarn-4.9.2.cjs binary`, which would execute arbitrary code on developers' machines or CI systems. **Fix** Actually, thanks to Corepack, we don't need to store and execute this binary. Corepack can be seen as the manager of a package manager: in `package.json` we indicate a packageManager version like `"packageManager": "yarn@4.9.2"`, and when executing `yarn` Corepack will securely fetch the verified version from npm, avoiding the risk of executing a compromised binary committed to the repository. This was already in our app's package.json template but we were not using it! We can now - remove the folder containing the binary from our app template base-application (that is scaffolded when creating an app through cli), `.yarn/releases/`, and remove `yarnPath: .yarn/releases/yarn-4.9.2.cjs` from its .yarnrc - remove them from the community apps that were already published in the repo - add .yarn to gitignore **Tested** This has been tested and works for app created in the repo, outside the repo, and existing apps in the repo
Browser Extension Serverless Functions
Serverless functions for the Twenty browser extension. These functions handle API interactions between the browser extension and the Twenty backend.
Overview
This package contains serverless functions that are deployed to your Twenty workspace. The browser extension calls these functions to create and retrieve records in Twenty CRM.
Functions
Create Person
Endpoint: /s/create/person
Creates a new person record in Twenty from LinkedIn profile data.
Parameters:
firstName(string) - Person's first namelastName(string) - Person's last name
Response: Created person object
Create Company
Endpoint: /s/create/company
Creates a new company record in Twenty from LinkedIn company profile data.
Parameters:
name(string) - Company name
Response: Created company object
Get Person
Endpoint: /s/get/person
Retrieves an existing person record from Twenty (placeholder implementation).
Get Company
Endpoint: /s/get/company
Retrieves an existing company record from Twenty (placeholder implementation).
Setup
Prerequisites
- Twenty CLI installed globally:
npm install -g twenty-cli - API Key from your Twenty workspace:
- Go to https://twenty.com/settings/api-webhooks
- Generate an API key
Configuration
-
Authenticate with Twenty CLI:
twenty auth login -
Sync serverless functions to your workspace:
twenty app sync -
Configure environment variables:
TWENTY_API_URL- Your Twenty API URL (e.g.,https://your-workspace.twenty.com)TWENTY_API_KEY- Your Twenty API key (marked as secret)
Environment variables can be configured via the Twenty CLI or the Twenty web interface after syncing.
How It Works
- The browser extension extracts data from LinkedIn profiles
- The extension calls the serverless functions via the background script
- Serverless functions authenticate with your Twenty API using the configured API key
- Functions create or retrieve records in your Twenty workspace
- Response is sent back to the extension for user feedback
File Structure
serverlessFunctions/
├── create-person/
│ ├── serverlessFunction.manifest.jsonc # Function configuration
│ └── src/
│ └── index.ts # Function implementation
├── create-company/
│ ├── serverlessFunction.manifest.jsonc
│ └── src/
│ └── index.ts
├── get-person/
│ ├── serverlessFunction.manifest.jsonc
│ └── src/
│ └── index.ts
└── get-company/
├── serverlessFunction.manifest.jsonc
└── src/
└── index.ts
Development
These functions are managed by the Twenty CLI and are deployed to your workspace. After making changes:
- Update the function code in
src/index.ts - Run
twenty app syncto deploy changes to your workspace - Test the functions via the browser extension or Twenty API directly
Related Packages
twenty-browser-extension- The main browser extension that calls these functions- See
packages/twenty-browser-extension/README.mdfor the complete extension documentation