[permissions] Add permissions check layer in entityManager #11818

ijreilly · 2025-04-30T14:25:56Z

First and main step of twentyhq/core-team-issues#747

We are implementing a permission check layer in our custom WorkspaceEntityManager by overriding all the db-executing methods (this PR only overrides some as a POC, the rest will be done in the next PR).
Our custom repositories call entity managers under the hood to interact with the db so this solves the repositories case too.
This is still behind the feature flag IsPermissionsV2Enabled.

In the next PR

finish overriding all the methods required in WorkspaceEntityManager
add tests

…r used

github-actions · 2025-04-30T14:38:21Z

🚀 Preview Environment Ready!

Your preview environment is available at: http://bore.pub:17301

This environment will automatically shut down when the PR is closed or after 5 hours.

packages/twenty-server/src/database/typeorm-seeds/workspace/api-key.ts

ijreilly · 2025-05-02T11:28:55Z

packages/twenty-server/src/engine/twenty-orm/datasource/workspace.datasource.ts

    this.featureFlagMap = featureFlagMap;
    this.featureFlagMapVersion = featureFlagMapVersion;
+    // Recreate manager after internalContext has been initialized
+    this.manager = this.createEntityManager();


order matters, otherwise this.featureFlagMap is empty

ijreilly · 2025-05-02T12:46:49Z

packages/twenty-server/src/engine/twenty-orm/entity-manager/entity.manager.ts

@@ -68,6 +81,88 @@ export class WorkspaceEntityManager extends EntityManager {
    return newRepository;
  }

+  override createQueryBuilder<Entity extends ObjectLiteral>(


this is currently only used in seeds

greptile-apps

PR Summary

This PR implements a comprehensive permission check layer in the WorkspaceEntityManager by overriding database-executing methods. Here are the key changes:

Replaced TypeORM's EntityManager with custom WorkspaceEntityManager across all database operations to enforce permission checks
Added shouldBypassPermissionChecks flag to allow seeding operations to bypass permission validation
Implemented permission validation utilities and query builders with proper checks before executing operations
Feature is controlled by IsPermissionsV2Enabled flag for gradual rollout

Key points to review:

Permission validation is only implemented for some methods as proof of concept, with more to come in next PR
Tests are deferred to a future PR which could be risky for such a fundamental change
Raw SQL queries in some repositories bypass the new permission layer
Transaction management changes could impact data consistency in some services

The PR appears to be incorrectly linked to issue #747 about probability picker UI, as this is a backend permissions infrastructure change.

_{59 file(s) reviewed, 8 comment(s)}
_{Edit PR Review Bot Settings | Greptile}

packages/twenty-server/src/database/typeorm-seeds/workspace/message-channels.ts

packages/twenty-server/src/database/typeorm-seeds/workspace/connected-account.ts

greptile-apps · 2025-05-02T13:00:10Z

packages/twenty-server/src/engine/twenty-orm/entity-manager/entity.manager.ts

+
+    validateOperationIsPermittedOrThrow({
+      entityName: this.extractTargetNameSingularFromEntityTarget(target),
+      operationType: 'update',


logic: operationType is hardcoded as 'update' for both insert and upsert operations. This is incorrect and could lead to wrong permission checks.

Suggested change

operationType: 'update',

operationType: 'create',

is it expected?

oops no, this should not be hardcoded indeed ! (didn't matter too much here as insert and update are behind the same permission gate, canUpdate, but definitely required for what's next)

packages/twenty-server/src/engine/twenty-orm/entity-manager/entity.manager.ts

packages/twenty-server/src/engine/twenty-orm/repository/workspace.repository.ts

.../suites/object-records-permissions/create-one-object-records-permissions.integration-spec.ts

greptile-apps · 2025-05-02T13:06:09Z

.../suites/object-records-permissions/create-one-object-records-permissions.integration-spec.ts

+      expect(response.body.data).toStrictEqual({ createPerson: null });
+      expect(response.body.errors).toBeDefined();
+      expect(response.body.errors[0].message).toBe(
+        PermissionsExceptionMessage.PERMISSION_DENIED,
+      );
+      expect(response.body.errors[0].extensions.code).toBe(ErrorCode.FORBIDDEN);
+    });


style: Test could be more specific by checking error array length is exactly 1 to ensure no unexpected additional errors

Weiko

This is great!! Good job @ijreilly 👏

packages/twenty-server/src/database/typeorm-seeds/workspace/api-key.ts

Weiko · 2025-05-02T14:00:52Z

packages/twenty-server/src/engine/twenty-orm/datasource/workspace.datasource.ts

+    mode = 'master' as ReplicationMode,
+  ): WorkspaceQueryRunner {
+    const queryRunner = this.driver.createQueryRunner(mode);
+    const manager = this.createEntityManager(queryRunner);


should we use this.manager here?

i think we need to pass our queryRunner to keep the same across different operations led by different managers

...rc/engine/metadata-modules/field-metadata/services/field-metadata-related-records.service.ts

Weiko · 2025-05-02T14:04:51Z

packages/twenty-server/src/engine/twenty-orm/entity-manager/entity.manager.ts

 import { WorkspaceDataSource } from 'src/engine/twenty-orm/datasource/workspace.datasource';
+import { validateOperationIsPermittedOrThrow } from 'src/engine/twenty-orm/repository/permissions.utils';
+import { WorkspaceSelectQueryBuilder } from 'src/engine/twenty-orm/repository/workspace-select-query-builder';
 import { WorkspaceRepository } from 'src/engine/twenty-orm/repository/workspace.repository';

 export class WorkspaceEntityManager extends EntityManager {


Just realised this but could we rename the file accordingly?

packages/twenty-server/src/engine/core-modules/auth/services/google-apis.service.ts

Weiko · 2025-05-02T14:08:43Z

packages/twenty-server/src/engine/seeder/seeder.service.ts

@@ -60,12 +61,13 @@ export class SeederService {
    const schemaName =
      this.workspaceDataSourceService.getSchemaName(workspaceId);

-    const workspaceDataSource =
+    const workspaceDataSource: DataSource =


Not your fault and note for myself but I've just realised that this one is very misleading since it returns the main datasource from TypeORMService (which is not the workspace datasource (also why your type is DataSource here)

I know, initially I had left two comments around workspaceDataSource and the below entityManager to raise attention around that, but thought that was maybe too much and added explicit types instead. wdyt ?

Should be fine for now but I think our next goal should be:

Removing DataSource table, move schema name to Workspace table and we don't need the rest.

connectedToWorkspaceDataSourceAndReturnMetadata should be removed, this is only called during seeding or internal code and it's actually returning the mainDataSource as stated above. We should use typeorm service in those places directly and have a getMainDataSource() instead of connectToDataSource()

Weiko · 2025-05-02T14:10:34Z

packages/twenty-server/src/engine/twenty-orm/datasource/workspace.datasource.ts

+    return queryRunner as any as WorkspaceQueryRunner;
+  }
+
+  override transaction<T>(


is this override needed? Looks like the implementation from typeorm already with no particular changes or maybe I'm missing something?

Can't remember why i did it in the first place indeed, doesn't look necessary yes, removing it !

Weiko · 2025-05-02T14:13:22Z

packages/twenty-server/src/engine/twenty-orm/entity-manager/entity.manager.ts

+
+    validateOperationIsPermittedOrThrow({
+      entityName: this.extractTargetNameSingularFromEntityTarget(target),
+      operationType: 'update',


is it expected?

ijreilly · 2025-05-05T09:41:41Z

packages/twenty-server/src/modules/contact-creation-manager/services/create-company.service.ts

-      },
-      transactionManager,
-    );
+    const existingCompanies = await companyRepository.find({


transactionManager not used here: https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/modules/contact-creation-manager/services/create-company-and-contact.service.ts#L218

ijreilly · 2025-05-05T11:08:24Z

packages/twenty-server/src/modules/blocklist/repositories/blocklist.repository.ts

@@ -14,7 +12,6 @@ export class BlocklistRepository {
  public async getById(
    id: string,
    workspaceId: string,
-    transactionManager?: EntityManager,


checked - was never used

ijreilly · 2025-05-05T11:11:43Z

...y-server/src/modules/contact-creation-manager/services/create-company-and-contact.service.ts

@@ -45,7 +45,6 @@ export class CreateCompanyAndContactService {
    contactsToCreate: Contact[],
    workspaceId: string,
    source: FieldActorSource,
-    transactionManager?: EntityManager,


checked - was not used

ijreilly · 2025-05-05T11:12:53Z

packages/twenty-server/src/modules/contact-creation-manager/services/create-contact.service.ts

@@ -74,7 +74,6 @@ export class CreateContactService {
  public async createPeople(
    contactsToCreate: ContactToCreate[],
    workspaceId: string,
-    transactionManager?: EntityManager,


checked - was not used

ijreilly · 2025-05-05T11:14:42Z

packages/twenty-server/src/modules/timeline/repositiories/timeline-activity.repository.ts

@@ -159,7 +157,6 @@ export class TimelineActivityRepository {
      linkedObjectMetadataId: string | undefined;
    }[],
    workspaceId: string,
-    transactionManager?: EntityManager,


checked - was not used
https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/modules/timeline/repositiories/timeline-activity.repository.ts#L121
and
https://github.com/twentyhq/twenty/blob/main/packages/twenty-server/src/modules/calendar/calendar-event-participant-manager/listeners/calendar-event-participant.listener.ts#L59

Weiko

LGTM

Weiko · 2025-05-05T13:35:25Z

...ngine/api/graphql/graphql-query-runner/resolvers/graphql-query-find-many-resolver.service.ts

@@ -144,7 +144,7 @@ export class GraphqlQueryFindManyResolverService extends GraphqlQueryBaseResolve
    }

    const parentObjectRecordsAggregatedValues =
-      await aggregateQueryBuilder.getRawOne();
+      await aggregateQueryBuilder.getRawOne<any>();


<Record<string, any>> might be a little bit more accurate here but that's probably the best we can do in terms of typing for now

Actually I've just realised you have this typing error everywhere, maybe it's better to implement a default type in the class itself (see my other comment)

Weiko · 2025-05-05T13:39:43Z

packages/twenty-server/src/engine/workspace-datasource/workspace-datasource.service.ts

@@ -124,6 +124,7 @@ export class WorkspaceDataSourceService {
    workspaceId: string,
    transactionManager?: EntityManager,
  ): Promise<any> {
+    // TODO


Could be more explicit here if you want to leave a TODO?

oops, that was just something for me to think of but i will remove it for now

Weiko · 2025-05-05T13:47:05Z

packages/twenty-server/src/engine/twenty-orm/repository/workspace-select-query-builder.ts

+    return super.getRawOne();
+  }
+
+  override getRawMany<U>(): Promise<U[]> {


Suggested change

override getRawMany<U>(): Promise<U[]> {

override getRawMany<U = any>(): Promise<U[]> {

to avoid having to pass any everywhere anyway (or casting)

yes right ! actually that's what they do in typeORM's SelectQueryBuilder. thanks

sentry-io · 2025-05-13T15:12:10Z

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

‼️ QueryFailedError: deadlock detected {WorkspaceRepository#2}.save(workspace.repository) View Issue

_{Did you find this useful? React with a 👍 or 👎}

ijreilly added 5 commits April 30, 2025 16:17

Update WorkspaceEntityManager to integrate permission check

3c9a836

adapt entityManager.createQueryBuilder and bypass checks in seeds

1d2b648

update entityManager type

a327c23

remove optional arg transactionManager from signature when it is neve…

c33a6d0

…r used

add test

981a4cb

ijreilly added 2 commits April 30, 2025 16:58

Merge branch 'main' of github.com:twentyhq/twenty into perm--repo

008d320

fix entity manager stale featureFlagMap issue + api key

4d639be

ijreilly commented May 2, 2025

View reviewed changes

packages/twenty-server/src/database/typeorm-seeds/workspace/api-key.ts Show resolved Hide resolved

replace comments with explicity type declaration

6928956

ijreilly commented May 2, 2025

View reviewed changes

ijreilly changed the title ~~Perm repo~~ [permissions] Add permissions check layer in entityManager May 2, 2025

ijreilly marked this pull request as ready for review May 2, 2025 12:54

ijreilly added 2 commits May 2, 2025 14:55

Merge branch 'main' of github.com:twentyhq/twenty into perm--repo

180d047

fix + missing methods in WorkspaceSelectQueryBuilder

c722d22

greptile-apps bot reviewed May 2, 2025

View reviewed changes

prastoin added -PR: wip -PR: awaiting author labels May 2, 2025

Weiko reviewed May 2, 2025

View reviewed changes

ijreilly commented May 5, 2025

View reviewed changes

ijreilly added 4 commits May 5, 2025 13:21

rename file entityManager -> workspaceEntityManager

f42fea9

minor fixes and improvements

5770d52

fix

eb8f681

Merge branch 'main' of github.com:twentyhq/twenty into perm--repo

b8a2900

Weiko approved these changes May 5, 2025

View reviewed changes

minor fixes

55f914e

ijreilly enabled auto-merge (squash) May 5, 2025 13:59

ijreilly merged commit a9e73c6 into main May 5, 2025
37 checks passed

ijreilly deleted the perm--repo branch May 5, 2025 14:06

bosiraphael mentioned this pull request Jun 19, 2025

12690-error-unknown-error-importing-calendar-events-reafcto-required #12711

Merged

	override getRawMany<U>(): Promise<U[]> {
	override getRawMany<U = any>(): Promise<U[]> {

[permissions] Add permissions check layer in entityManager #11818

[permissions] Add permissions check layer in entityManager #11818

Uh oh!

Conversation

ijreilly commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Apr 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

PR Summary

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot May 2, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps bot May 2, 2025

Choose a reason for hiding this comment

Uh oh!

Weiko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ijreilly May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Weiko left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ijreilly commented Apr 30, 2025 •

edited

Loading

github-actions bot commented Apr 30, 2025 •

edited

Loading

ijreilly May 5, 2025 •

edited

Loading