feat(twenty-server): add trusted domain - backend crud #10290

AMoreaux · 2025-02-18T12:52:38Z

No description provided.

Introduced WorkspaceTrustedDomain entity, service, and module for managing trusted domains within workspaces. Updated Workspace entity to include a relation to trusted domains, enabling domain management tied to specific workspaces. This provides a foundation for validating and managing trusted domains.

Introduce functionality for managing workspace trusted domains, including creation, validation, and deletion. Added corresponding migrations, services, DTOs, resolvers, validations, and tests to support the feature.

Removed validation token field and related methods, replacing it with a secure hash-based validation approach. Introduced email validation during trusted domain creation, updating the workflow and database constraints to ensure uniqueness. Cleaned up unused input classes and streamlined service methods for better maintainability.

Added support for input validation, resolver methods, and domain manager integration within the WorkspaceTrustedDomain module. Removed unused SSO IDP input and adjusted resolver method names for clarity and consistency. Updated the core engine module to include WorkspaceTrustedDomainModule.

Replaces the existing migration for workspace trusted domains with an updated version. Introduces a unique constraint on the domain and workspaceId combination to ensure data integrity. Other migration logic remains unchanged.

Introduce validation logic for workspace trusted domains, including a new mutation to validate domains using a token. Updated GraphQL schema, service, resolver, DTOs, and tests to support this functionality.

Introduced types, inputs, and mutations for managing and validating workspace trusted domains. Added health status types and queries for system and worker queue monitoring, along with updates to roles and permissions handling.

Added a new validation check to prevent re-validation of trusted domains. Updated exception codes and messages for better clarity and consistency. Enhanced test cases to cover these new scenarios.

…-allowed-domains # Conflicts: # packages/twenty-front/src/generated-metadata/graphql.ts

Introduced types and mutations for managing workspace trusted domains, including creation, deletion, validation, and retrieval. This enhancement enables better control and flexibility for workspace domain management.

greptile-apps

PR Summary

This PR introduces a comprehensive workspace trusted domain management system, enabling domain validation and security controls for workspaces.

Added WorkspaceTrustedDomain entity with validation flow in /packages/twenty-server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.entity.ts
Implemented secure domain validation via email with hash-based tokens in /packages/twenty-server/src/engine/core-modules/workspace-trusted-domain/services/workspace-trusted-domain.service.ts
Created new GraphQL mutations and queries for CRUD operations in /packages/twenty-front/src/generated/graphql.tsx
Added database migration 1739955345446-add-workspace-trusted-domain.ts with unique constraint on domain/workspace pairs
Removed potentially breaking FindAvailableSSOIDPInput class from SSO module without clear replacement

_{20 file(s) reviewed, 16 comment(s)}
_{Edit PR Review Bot Settings | Greptile}

greptile-apps · 2025-02-19T16:47:42Z

packages/twenty-emails/src/emails/validate-trust-domain.email.tsx

+        {capitalize(sender.firstName)} (
+        <Link
+          href={`mailto:${sender.email}`}
+          value={sender.email}
+          color={emailTheme.font.colors.blue}
+        />
+        )<Trans>has added a trust domain: </Trans>


syntax: Missing space after closing parenthesis before the Trans component. This creates incorrect spacing in the rendered email.

greptile-apps · 2025-02-19T16:48:15Z

...er/src/database/typeorm/core/migrations/common/1739955345446-add-workspace-trusted-domain.ts

+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "core"."workspaceTrustedDomain" ("id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "domain" character varying NOT NULL, "isValidated" boolean NOT NULL DEFAULT false, "workspaceId" uuid NOT NULL, CONSTRAINT "IndexOnDomainAndWorkspaceId" UNIQUE ("domain", "workspaceId"), CONSTRAINT "PK_afa04c0f75f54a5e2c570c83cd6" PRIMARY KEY ("id"))`,


style: Consider adding a length constraint to the 'domain' character varying field to prevent excessively long domains

Suggested change

`CREATE TABLE "core"."workspaceTrustedDomain" ("id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "domain" character varying NOT NULL, "isValidated" boolean NOT NULL DEFAULT false, "workspaceId" uuid NOT NULL, CONSTRAINT "IndexOnDomainAndWorkspaceId" UNIQUE ("domain", "workspaceId"), CONSTRAINT "PK_afa04c0f75f54a5e2c570c83cd6" PRIMARY KEY ("id"))`,

`CREATE TABLE "core"."workspaceTrustedDomain" ("id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "domain" character varying(253) NOT NULL, "isValidated" boolean NOT NULL DEFAULT false, "workspaceId" uuid NOT NULL, CONSTRAINT "IndexOnDomainAndWorkspaceId" UNIQUE ("domain", "workspaceId"), CONSTRAINT "PK_afa04c0f75f54a5e2c570c83cd6" PRIMARY KEY ("id"))`,

greptile-apps · 2025-02-19T16:49:21Z

...-server/src/engine/core-modules/workspace-trusted-domain/dtos/create-trusted-domain.input.ts

+  @Field(() => String)
+  @IsString()
+  @IsNotEmpty()
+  domain: string;


style: Consider adding @IsDomain() or custom domain validation to ensure proper domain format (e.g., example.com)

Suggested change

domain: string;

@IsDomain()

domain: string;

greptile-apps · 2025-02-19T16:49:22Z

packages/twenty-server/src/engine/core-modules/sso/dtos/find-available-SSO-IDP.input.ts

logic: This class's removal may break GraphQL schemas and queries that depend on FindAvailableSSOIDPInput type

greptile-apps · 2025-02-19T16:49:36Z

...-server/src/engine/core-modules/workspace-trusted-domain/dtos/delete-trusted-domain.input.ts

+  @Field()
+  @IsString()


style: Consider adding () => String type to @field for consistency with other DTOs in the codebase

greptile-apps · 2025-02-19T16:51:31Z

...r/src/engine/core-modules/workspace-trusted-domain/services/workspace-trusted-domain.spec.ts

+      await expect(
+        service.deleteTrustedDomain(workspace, trustedDomainId),
+      ).rejects.toThrow();
+


logic: test expects generic throw() but should check for specific WorkspaceTrustedDomainException and code

Suggested change

await expect(

service.deleteTrustedDomain(workspace, trustedDomainId),

).rejects.toThrow();

await expect(

service.deleteTrustedDomain(workspace, trustedDomainId),

).rejects.toThrow(new WorkspaceTrustedDomainException(

'Trusted domain not found',

WorkspaceTrustedDomainExceptionCode.WORKSPACE_TRUSTED_DOMAIN_NOT_FOUND,

));

greptile-apps · 2025-02-19T16:52:35Z

...erver/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.exception.ts

+
+export enum WorkspaceTrustedDomainExceptionCode {
+  WORKSPACE_TRUSTED_DOMAIN_NOT_FOUND = 'WORKSPACE_TRUSTED_DOMAIN_NOT_FOUND',
+  WORKSPACE_TRUSTED_DOMAIN_ALREADY_VERIFIED = 'WORKSPACE_TRUSTED_DOMAIN_ALREADY_VERIFIED',


logic: ALREADY_VERIFIED and ALREADY_VALIDATED (line 14) appear to be duplicate error codes for the same condition

greptile-apps · 2025-02-19T16:53:07Z

...server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.resolver.ts

+  @Mutation(() => Boolean)
+  async validateWorkspaceTrustedDomain(
+    @Args('input')
+    { validationToken, workspaceTrustedDomainId }: ValidateTrustedDomainInput,
+  ): Promise<boolean> {


logic: validateWorkspaceTrustedDomain mutation missing @AuthWorkspace guard which could allow unauthorized validation of domains

greptile-apps · 2025-02-19T16:53:08Z

...server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.resolver.ts

+    return await this.workspaceTrustedDomainService.getAllTrustedDomainsByWorkspace(
+      currentWorkspace,
+    );


style: unnecessary await on return statement since the function is already async

greptile-apps · 2025-02-19T16:53:19Z

packages/twenty-server/src/engine/core-modules/workspace/workspace.entity.ts

+  @OneToMany(
+    () => WorkspaceTrustedDomain,
+    (trustDomain) => trustDomain.workspace,
+  )
+  trustDomains: Relation<WorkspaceTrustedDomain[]>;


logic: Missing onDelete cascade behavior for trusted domains relation. Other similar relations like workspaceUsers have this defined.

Yes need some for of cascading logic? (workspace deleted -> trustedDomains deleted)

packages/twenty-server/src/engine/core-modules/workspace/workspace.entity.ts

packages/twenty-emails/src/emails/validate-trust-domain.email.tsx

...server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.resolver.ts

...rc/engine/core-modules/workspace-trusted-domain/services/workspace-trusted-domain.service.ts

FelixMalfait

Great work!!!

Changed mutation to return the validated domain instead of a boolean, streamlined domain validation logic, and clarified error messages. Removed redundant utility function and adjusted email template for better user guidance. These changes enhance clarity, reduce complexity, and improve user feedback when validating trusted domains.

Removed redundant tests for checkIsVerified functionality to simplify the test suite. Updated createTrustedDomain tests to reflect changes in domain validation logic and naming conventions. This improves maintainability and aligns with updated business logic.

…main Replaced all instances of WorkspaceTrustedDomain with ApprovedAccessDomain across the application. Updated related entities, migrations, services, resolvers, and schemas to reflect the new naming convention, improving clarity and alignment with domain naming standards.

Renamed "TrustedDomain" to "ApprovedAccessDomain" for better clarity and consistency. Updated related types, inputs, and mutations accordingly to reflect the new naming convention. Removed redundant exports and adjusted queries and mutations to align with the changes.

packages/twenty-front/codegen-metadata.cjs

packages/twenty-front/codegen.cjs

Removed the process.env.NODE_TLS_REJECT_UNAUTHORIZED setting, which bypassed TLS verification. This improves security by preventing the acceptance of unauthorized or self-signed certificates.

Updated the formatting of the AddApprovedAccessDomain migration for better readability and consistency. No changes were made to the functionality or logic of the migration.

FelixMalfait · 2025-02-20T15:49:20Z

packages/twenty-emails/src/emails/validate-trust-domain.email.tsx

+import { capitalize } from 'src/utils/capitalize';
+import { APP_LOCALES, getImageAbsoluteURI } from 'twenty-shared';
+
+type SendTrustDomainValidationProps = {


Still need to rename Trustxxx before we can merge?

Yes it's in the next PR

Co-authored-by: Etienne <[email protected]> Co-authored-by: Paul Rastoin <[email protected]>

AMoreaux added 2 commits February 18, 2025 10:37

feat(workspace-trusted-domain): implement trusted domain management

bdd1535

Introduce functionality for managing workspace trusted domains, including creation, validation, and deletion. Added corresponding migrations, services, DTOs, resolvers, validations, and tests to support the feature.

AMoreaux self-assigned this Feb 18, 2025

AMoreaux added 8 commits February 18, 2025 13:52

Merge branch 'main' into feat/add-allowed-domains

4d42841

Merge branch 'main' into feat/add-allowed-domains

fbcecce

feat(workspace-trusted-domain): add validation flow

2703282

Introduce validation logic for workspace trusted domains, including a new mutation to validate domains using a token. Updated GraphQL schema, service, resolver, DTOs, and tests to support this functionality.

feat(graphql): add support for workspace trusted domains

11c45aa

Introduced types, inputs, and mutations for managing and validating workspace trusted domains. Added health status types and queries for system and worker queue monitoring, along with updates to roles and permissions handling.

feat(workspace-trusted-domain): enhance validation logic

c820e96

Added a new validation check to prevent re-validation of trusted domains. Updated exception codes and messages for better clarity and consistency. Enhanced test cases to cover these new scenarios.

AMoreaux marked this pull request as ready for review February 19, 2025 16:45

AMoreaux requested a review from FelixMalfait February 19, 2025 16:46

AMoreaux added 2 commits February 19, 2025 17:46

Merge remote-tracking branch 'refs/remotes/origin/main' into feat/add…

94b64cc

…-allowed-domains # Conflicts: # packages/twenty-front/src/generated-metadata/graphql.ts

feat(graphql): add support for workspace trusted domains

444003a

Introduced types and mutations for managing workspace trusted domains, including creation, deletion, validation, and retrieval. This enhancement enables better control and flexibility for workspace domain management.

greptile-apps bot reviewed Feb 19, 2025

View reviewed changes

Merge branch 'main' into feat/add-allowed-domains

0ac2f23

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

packages/twenty-server/src/engine/core-modules/workspace/workspace.entity.ts Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

packages/twenty-emails/src/emails/validate-trust-domain.email.tsx Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

packages/twenty-emails/src/emails/validate-trust-domain.email.tsx Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

...server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.resolver.ts Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

...server/src/engine/core-modules/workspace-trusted-domain/workspace-trusted-domain.resolver.ts Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

...rc/engine/core-modules/workspace-trusted-domain/services/workspace-trusted-domain.service.ts Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

...rc/engine/core-modules/workspace-trusted-domain/services/workspace-trusted-domain.service.ts Outdated Show resolved Hide resolved

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

AMoreaux added 5 commits February 20, 2025 10:29

Merge remote-tracking branch 'origin/main' into feat/add-allowed-domains

49d71d1

github-advanced-security bot found potential problems Feb 20, 2025

View reviewed changes

packages/twenty-front/codegen-metadata.cjs Fixed Show fixed Hide fixed

packages/twenty-front/codegen.cjs Fixed Show fixed Hide fixed

AMoreaux added 2 commits February 20, 2025 16:11

chore: remove insecure TLS bypass configuration

21e4e12

Removed the process.env.NODE_TLS_REJECT_UNAUTHORIZED setting, which bypassed TLS verification. This improves security by preventing the acceptance of unauthorized or self-signed certificates.

refactor(database): adjust migration formatting for clarity

70ec628

Updated the formatting of the AddApprovedAccessDomain migration for better readability and consistency. No changes were made to the functionality or logic of the migration.

FelixMalfait reviewed Feb 20, 2025

View reviewed changes

FelixMalfait approved these changes Feb 20, 2025

View reviewed changes

feat(trusted-domain): add frontend management (without ui) (#10337)

605073b

Co-authored-by: Etienne <[email protected]> Co-authored-by: Paul Rastoin <[email protected]>

AMoreaux enabled auto-merge (squash) February 21, 2025 15:54

AMoreaux merged commit bf92860 into main Feb 21, 2025
47 checks passed

AMoreaux deleted the feat/add-allowed-domains branch February 21, 2025 16:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(twenty-server): add trusted domain - backend crud #10290

feat(twenty-server): add trusted domain - backend crud #10290

AMoreaux commented Feb 18, 2025

greptile-apps bot left a comment

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

greptile-apps bot Feb 19, 2025

FelixMalfait Feb 20, 2025

FelixMalfait left a comment

FelixMalfait Feb 20, 2025

AMoreaux Feb 20, 2025

feat(twenty-server): add trusted domain - backend crud #10290

feat(twenty-server): add trusted domain - backend crud #10290

Conversation

AMoreaux commented Feb 18, 2025

greptile-apps bot left a comment

Choose a reason for hiding this comment

PR Summary

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

greptile-apps bot Feb 19, 2025

Choose a reason for hiding this comment

FelixMalfait Feb 20, 2025

Choose a reason for hiding this comment

FelixMalfait left a comment

Choose a reason for hiding this comment

FelixMalfait Feb 20, 2025

Choose a reason for hiding this comment

AMoreaux Feb 20, 2025

Choose a reason for hiding this comment