snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/graphql/suites/impersonation/__snapshots__/failing-impersonation-access-token.integration-spec.ts.snap

@@ -0,0 +1,15 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Impersonation - access token validation denial (integration) rejects an invalid impersonation access token on a protected query 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "FORBIDDEN_EXCEPTION",
+    "userFriendlyMessage": {
+      "id": Any<String>,
+      "message": "You do not have permission to impersonate users in this workspace.",
+    },
+  },
+  "message": "Impersonation not allowed",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/__snapshots__/failing-self-impersonation.integration-spec.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Impersonation - self-impersonation denial (integration) rejects a user impersonating themselves 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "FORBIDDEN_EXCEPTION",
+    "userFriendlyMessage": "You do not have permission to perform this action.",
+  },
+  "message": "User cannot impersonate themselves",
+  "name": "ForbiddenError",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/__snapshots__/failing-unauthenticated-impersonation.integration-spec.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Impersonation - unauthenticated request denial (integration) rejects an impersonation request with no authentication 1`] = `
+{
+  "extensions": {
+    "code": "UNAUTHENTICATED",
+    "subCode": "UNAUTHENTICATED",
+    "userFriendlyMessage": "You must be authenticated to perform this action.",
+  },
+  "message": "Missing authentication token",
+  "name": "AuthenticationError",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/failing-impersonation-access-token.integration-spec.ts

@@ -0,0 +1,29 @@
+import gql from 'graphql-tag';
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { makeGraphqlAPIRequest } from 'test/integration/graphql/utils/make-graphql-api-request.util';
+
+// Exercises the per-request JWT validation checkpoint (jwt.auth.strategy):
+// an impersonation access token whose impersonator is not authorized to
+// impersonate the target must be rejected on every protected query.
+describe('Impersonation - access token validation denial (integration)', () => {
+  it('rejects an invalid impersonation access token on a protected query', async () => {
+    const query = gql`
+      query People {
+        people {
+          edges {
+            node {
+              id
+            }
+          }
+        }
+      }
+    `;
+
+    const response = await makeGraphqlAPIRequest(
+      { query },
+      APPLE_SARAH_IMPERSONATE_TIM_INVALID_ACCESS_TOKEN,
+    );
+
+    expectOneNotInternalServerErrorSnapshot({ errors: response.body.errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/failing-self-impersonation.integration-spec.ts

@@ -0,0 +1,18 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+describe('Impersonation - self-impersonation denial (integration)', () => {
+  it('rejects a user impersonating themselves', async () => {
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JANE,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+      accessToken: APPLE_JANE_ADMIN_ACCESS_TOKEN,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/failing-unauthenticated-impersonation.integration-spec.ts

@@ -0,0 +1,32 @@
+import request from 'supertest';
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+const SERVER_URL = `http://localhost:${APP_PORT}`;
+
+describe('Impersonation - unauthenticated request denial (integration)', () => {
+  it('rejects an impersonation request with no authentication', async () => {
+    const response = await request(SERVER_URL)
+      .post('/metadata')
+      .send({
+        query: `
+          mutation Impersonate($userId: UUID!, $workspaceId: UUID!) {
+            impersonate(userId: $userId, workspaceId: $workspaceId) {
+              loginToken {
+                token
+              }
+            }
+          }
+        `,
+        variables: {
+          userId: USER_DATA_SEED_IDS.JONY,
+          workspaceId: SEED_APPLE_WORKSPACE_ID,
+        },
+      })
+      .expect(200);
+
+    expectOneNotInternalServerErrorSnapshot({ errors: response.body.errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/server-level/__snapshots__/failing-server-impersonation.integration-spec.ts.snap

@@ -0,0 +1,25 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Server-level impersonation - authorization denials (integration) rejects a non-admin with only the workspace impersonate permission from impersonating across workspaces 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "FORBIDDEN_EXCEPTION",
+    "userFriendlyMessage": "Server-level impersonation is not enabled for this user or workspace.",
+  },
+  "message": "Server level impersonation not allowed",
+  "name": "ForbiddenError",
+}
+`;
+
+exports[`Server-level impersonation - authorization denials (integration) rejects cross-workspace impersonation when the impersonator has no verified 2FA 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "TWO_FACTOR_AUTHENTICATION_PROVISION_REQUIRED",
+    "userFriendlyMessage": "Set up two-factor authentication before impersonating users in another workspace.",
+  },
+  "message": "Two-factor authentication is required for server-level impersonation. Please enable 2FA in your workspace settings before attempting to impersonate users.",
+  "name": "ForbiddenError",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/server-level/failing-server-impersonation.integration-spec.ts

@@ -0,0 +1,40 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { getAccessTokenForCredentials } from 'test/integration/graphql/utils/get-access-token-for-credentials.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+
+import { SEED_YCOMBINATOR_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+// Jony has the server-level canImpersonate capability but no verified 2FA
+// method. Outside development, server-level (cross-workspace) impersonation
+// requires verified 2FA, so the attempt to impersonate Tim in the YCombinator
+// workspace must be denied at the token-generation checkpoint.
+const IMPERSONATOR_WITHOUT_2FA_ACCESS_TOKEN = APPLE_JONY_MEMBER_ACCESS_TOKEN;
+
+describe('Server-level impersonation - authorization denials (integration)', () => {
+  it('rejects cross-workspace impersonation when the impersonator has no verified 2FA', async () => {
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.TIM,
+      workspaceId: SEED_YCOMBINATOR_WORKSPACE_ID,
+      accessToken: IMPERSONATOR_WITHOUT_2FA_ACCESS_TOKEN,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+
+  it('rejects a non-admin with only the workspace impersonate permission from impersonating across workspaces', async () => {
+    const scottAccessToken = await getAccessTokenForCredentials({
+      email: 'scott.forstall@apple.dev',
+    });
+
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JONY,
+      workspaceId: SEED_YCOMBINATOR_WORKSPACE_ID,
+      accessToken: scottAccessToken,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/server-level/successful-server-impersonation.integration-spec.ts

@@ -0,0 +1,58 @@
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+
+import { SEED_YCOMBINATOR_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+// Jane (authenticated in Apple) can impersonate across workspaces because she
+// has the server-level canImpersonate capability and a seeded verified 2FA
+// method. The target, Tim, is impersonated in the YCombinator workspace.
+const SERVER_IMPERSONATOR_ACCESS_TOKEN = APPLE_JANE_ADMIN_ACCESS_TOKEN;
+
+describe('Server-level impersonation - successful flow (integration)', () => {
+  it('lets a server admin with verified 2FA impersonate a user in another workspace', async () => {
+    const { data: impersonateData, errors: impersonateErrors } =
+      await impersonate({
+        userId: USER_DATA_SEED_IDS.TIM,
+        workspaceId: SEED_YCOMBINATOR_WORKSPACE_ID,
+        accessToken: SERVER_IMPERSONATOR_ACCESS_TOKEN,
+        expectToFail: false,
+      });
+
+    expect(impersonateErrors).toBeUndefined();
+
+    const loginToken = impersonateData.impersonate.loginToken.token;
+    const origin = impersonateData.impersonate.workspace.workspaceUrls
+      .subdomainUrl as string;
+
+    expect(loginToken).toBeDefined();
+    expect(impersonateData.impersonate.workspace.id).toBe(
+      SEED_YCOMBINATOR_WORKSPACE_ID,
+    );
+
+    const { data: tokensData, errors: tokensErrors } =
+      await getAuthTokensFromLoginToken({
+        loginToken,
+        origin,
+        expectToFail: false,
+      });
+
+    expect(tokensErrors).toBeUndefined();
+
+    const impersonationAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+
+    expect(impersonationAccessToken).toBeDefined();
+
+    const { data: currentUserData, errors: currentUserErrors } =
+      await getCurrentUser({
+        accessToken: impersonationAccessToken,
+        expectToFail: false,
+      });
+
+    expect(currentUserErrors).toBeUndefined();
+    expect(currentUserData.currentUser.id).toBe(USER_DATA_SEED_IDS.TIM);
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/__snapshots__/failing-workspace-impersonation.integration-spec.ts.snap

@@ -0,0 +1,25 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Workspace-level impersonation - authorization denials (integration) rejects a non-admin with the impersonate permission impersonating an admin 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "FORBIDDEN_EXCEPTION",
+    "userFriendlyMessage": "Only administrators can impersonate users with admin privileges.",
+  },
+  "message": "Cannot impersonate a user with admin privileges. Only administrators can impersonate other administrators.",
+  "name": "ForbiddenError",
+}
+`;
+
+exports[`Workspace-level impersonation - authorization denials (integration) rejects a user without the impersonate permission 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "PERMISSION_DENIED",
+    "userFriendlyMessage": "User does not have permission.",
+  },
+  "message": "Entity performing the request does not have permission",
+  "name": "ForbiddenError",
+}
+`;

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/failing-workspace-impersonation.integration-spec.ts

@@ -0,0 +1,44 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { getAccessTokenForCredentials } from 'test/integration/graphql/utils/get-access-token-for-credentials.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+import { signUpInWorkspaceAndGetAccessToken } from 'test/integration/graphql/utils/sign-up-in-workspace-and-get-access-token.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+describe('Workspace-level impersonation - authorization denials (integration)', () => {
+  it('rejects a user without the impersonate permission', async () => {
+    const memberWithoutPermissionAccessToken =
+      await signUpInWorkspaceAndGetAccessToken(
+        'impersonation-no-permission@apple.dev',
+      );
+
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JONY,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+      accessToken: memberWithoutPermissionAccessToken,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+
+  // Scott is a seeded non-admin Apple member (canImpersonate /
+  // canAccessFullAdminPanel both false) whose role grants only the IMPERSONATE
+  // permission flag. He passes the impersonate permission guard but must still
+  // be blocked from impersonating an admin (Jony) by the escalation check.
+  it('rejects a non-admin with the impersonate permission impersonating an admin', async () => {
+    const scottAccessToken = await getAccessTokenForCredentials({
+      email: 'scott.forstall@apple.dev',
+    });
+
+    const { errors } = await impersonate({
+      userId: USER_DATA_SEED_IDS.JONY,
+      workspaceId: SEED_APPLE_WORKSPACE_ID,
+      accessToken: scottAccessToken,
+      expectToFail: true,
+    });
+
+    expectOneNotInternalServerErrorSnapshot({ errors });
+  });
+});

packages/twenty-server/test/integration/graphql/suites/impersonation/workspace-level/successful-workspace-impersonation.integration-spec.ts

@@ -0,0 +1,57 @@
+import { getAuthTokensFromLoginToken } from 'test/integration/graphql/utils/get-auth-tokens-from-login-token.util';
+import { getCurrentUser } from 'test/integration/graphql/utils/get-current-user.util';
+import { impersonate } from 'test/integration/graphql/utils/impersonate.util';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-users.util';
+
+// Jane holds the Apple admin role (so she has the IMPERSONATE workspace
+// permission). Scott is a non-admin Apple member (canImpersonate /
+// canAccessFullAdminPanel both false), so this exercises the member-only
+// workspace impersonation path: an admin impersonating a regular member, with
+// the admin-target escalation guard correctly not triggering.
+const IMPERSONATOR_ACCESS_TOKEN = APPLE_JANE_ADMIN_ACCESS_TOKEN;
+
+describe('Workspace-level impersonation - successful flow (integration)', () => {
+  it('lets a workspace admin impersonate a member and obtain a usable access token', async () => {
+    const { data: impersonateData, errors: impersonateErrors } =
+      await impersonate({
+        userId: USER_DATA_SEED_IDS.SCOTT,
+        workspaceId: SEED_APPLE_WORKSPACE_ID,
+        accessToken: IMPERSONATOR_ACCESS_TOKEN,
+        expectToFail: false,
+      });
+
+    expect(impersonateErrors).toBeUndefined();
+
+    const loginToken = impersonateData.impersonate.loginToken.token;
+    const origin = impersonateData.impersonate.workspace.workspaceUrls
+      .subdomainUrl as string;
+
+    expect(loginToken).toBeDefined();
+
+    const { data: tokensData, errors: tokensErrors } =
+      await getAuthTokensFromLoginToken({
+        loginToken,
+        origin,
+        expectToFail: false,
+      });
+
+    expect(tokensErrors).toBeUndefined();
+
+    const impersonationAccessToken =
+      tokensData.getAuthTokensFromLoginToken.tokens
+        .accessOrWorkspaceAgnosticToken.token;
+
+    expect(impersonationAccessToken).toBeDefined();
+
+    const { data: currentUserData, errors: currentUserErrors } =
+      await getCurrentUser({
+        accessToken: impersonationAccessToken,
+        expectToFail: false,
+      });
+
+    expect(currentUserErrors).toBeUndefined();
+    expect(currentUserData.currentUser.id).toBe(USER_DATA_SEED_IDS.SCOTT);
+  });
+});