Add settingsPermission gate on the frontend

[Weiko]

Context

With the new permissions system, we now need to hide some items from the settings navigation and gate some routes so they can't be accessed directly.
To avoid having to set permission gates in all the component pages, I'm introducing wrapper at the route level and in the Navigation. This is not required and is mostly for pages that are strictly mapped to a single permission, for the rest we still need to use the different hooks manually but it should avoid a bit of boilerplate for most of the cases.

• currentUserWorkspaceState to access settingsPermissions
• SettingsProtectedRouteWrapper in the router that can take a settingFeature or a featureFlag as a gate logic, if the currentUser does not have access to the settingFeature or the featureFlag is not enabled they will be redirected to the profile page.
• SettingsNavigationItemWrapper & SettingsNavigationSectionWrapper. The former will check the same logic as SettingsProtectedRouteWrapper and not display the item if needed. The later will check if all SettingsNavigationItemWrapper are not visible and hide itself if that's the case.
• useHasSettingsPermission to get a specific permission state for the current user
• useSettingsPermissionMap to get a map of all permissions with their values for the current user
• useFeatureFlagsMap same but for featureFlags

[greptile-apps]

PR Summary

This PR implements a comprehensive settings permission system for controlling access to settings features and routes. Here's a summary of the key changes:

• Added SettingsProtectedRouteWrapper component to gate access to settings routes based on user permissions and feature flags
• Introduced SettingsNavigationSectionWrapper and SettingsNavigationItemWrapper to manage visibility of navigation items based on permissions
• Created new hooks useHasSettingsPermission and useSettingsPermissionMap to check and manage settings permissions
• Added currentUserWorkspaceState to store user workspace permissions in Recoil state
• Integrated permission checks in UserProviderEffect and useApolloFactory for proper state management

Key points to review:

• SettingsNavigationSectionWrapper recursively checks children visibility
• useHasSettingsPermission follows a secure default-deny pattern
• Permission gates are now centralized at route/navigation level instead of individual components
• Mock data structure updated to support testing the new permissions system
• Proper integration with existing feature flag system through useFeatureFlagsMap

_{19 file(s) reviewed, 15 comment(s)
Edit PR Review Bot Settings | Greptile}

[greptile-apps]

style: useIsFeatureEnabled(null) could have unexpected behavior. Consider adding a guard clause or early return when requiresFeatureFlag is undefined.

[prastoin]

Early reviewing to get your opinions on raised points as it seems to re-occurs later in the review ! From so far good job !

[prastoin]

Nitpick: We recently introduced buildRecordFromKeysWithSameValue which could fit our need here and avoid force cast

  const initialPermissions = buildRecordFromKeysWithSameValue(Object.values(SettingsFeatures), false); // strictly typed using predicates
  if (!currentUserWorkspaceSettingsPermissions) {
    return initialPermissions;
  }

---

I don't know if it's something common in the twenty codebase, if yes then just omit this comment.

Concerns: I'm always fearful to manipulate enums like this. As its reliability only comes from the fact that all entries do have an initializer.

enum FooBar {
    FOO,
    BAR = 'BAR',
}
const entries = Object.values(FooBar);
console.log(entries) // [LOG]: ["FOO", 0, "BAR"] 

[ijreilly]

could not reproduce on the main branch so may be related to your changes? :
https://github.com/user-attachments/assets/dd7ed9b9-b660-4348-8392-1c920ce500f7

otherwise works fine !

[Weiko]

could not reproduce on the main branch so may be related to your changes? : https://github.com/user-attachments/assets/dd7ed9b9-b660-4348-8392-1c920ce500f7

otherwise works fine !

Was fixed on main, I rebased!

[lucasbordeau]

Way better thanks ! Also easier for maintaining granular changes about permissions and feature flags