[field-level permissions] Upsert fieldPermission + use fieldPermission to compute permissions #13050
Conversation
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
There was a problem hiding this comment.
PR Summary
Major PR introducing granular field-level permissions system with Redis caching optimization.
- Adds new
fieldPermissionentity withcanReadFieldRecordsandcanUpdateFieldRecordsflags, connected to roles, object metadata, and field metadata - Implements Redis caching optimization storing only field restrictions in format
XXX:{restrictedFields:{YYY:{canRead:false,canUpdate:null}}} - Creates new
upsertFieldPermissionsmutation in RoleResolver for managing field-level access controls - Introduces
IS_FIELDS_PERMISSIONS_ENABLEDfeature flag for controlled rollout - Adds migration
1751637682801-addFieldPermission.tscreating field permissions table with appropriate cascading relationships
19 files reviewed, 15 comments
Edit PR Review Bot Settings | Greptile
...-server/src/engine/metadata-modules/object-permission/dtos/upsert-field-permissions.input.ts
Show resolved
Hide resolved
| @Unique('IDX_FIELD_PERMISSION_FIELD_METADATA_ID_ROLE_ID_UNIQUE', [ | ||
| 'fieldMetadataId', | ||
| 'roleId', | ||
| ]) |
There was a problem hiding this comment.
style: Consider adding a composite index including objectMetadataId since it's a required field and would likely be queried together with fieldMetadataId and roleId
...r/src/engine/metadata-modules/object-permission/field-permission/field-permission.service.ts
Outdated
Show resolved
Hide resolved
| @Column({ nullable: false, type: 'uuid' }) | ||
| workspaceId: string; |
There was a problem hiding this comment.
logic: workspaceId relation and cascade behavior not defined - should match pattern from ObjectPermissionEntity
...r/src/engine/metadata-modules/object-permission/field-permission/field-permission.service.ts
Show resolved
Hide resolved
packages/twenty-server/src/engine/metadata-modules/role/role.resolver.ts
Show resolved
Hide resolved
| import { Field, ObjectType } from '@nestjs/graphql'; | ||
|
|
||
| @ObjectType('FieldPermission') | ||
| export class FieldPermissionDTO { |
There was a problem hiding this comment.
style: Add JSDoc comment to document the DTO's purpose and usage
...c/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache.service.ts
Show resolved
Hide resolved
|
🚀 Preview Environment Ready! Your preview environment is available at: http://bore.pub:46776 This environment will automatically shut down when the PR is closed or after 5 hours. |
In this PR
"XXX":{"canRead":true,"canUpdate":false,"canSoftDelete":false,"canDestroy":false,"restrictedFields":{"YYY":{"canRead":false,"canUpdate":null}}}TO DO: write integration tests on upsertFieldPermission once logic is approved