fix: team member Imports access denial + configurable per-column image size - #1194
Merged
Merged
Conversation
getApiKeyForUserId compared apiKey._userId.toString() against a raw userId that is actually a Mongoose ObjectId at runtime (UserEntity._id is typed string but never coerced). string === ObjectId is always false, so every login/refresh resolved role: null for non-owner team members, silently denying them all CASL permissions (e.g. Imports) despite having a correct role in the DB. Owners were unaffected since they bypass role checks via isOwner. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lv59iJ7gFt1HyhFNYbkPHw
Adds a per-column max image size (MB) setting for Image type columns, defaulting to 5 MB. Configurable from the column add/edit UI, enforced end to end: - Column schema/entity/DTOs/commands carry maxImageSize (validated, only applicable to Image type columns) - Column form UI exposes a Max Image Size (MB) field when column type is Image - Widget resolves the max size per selected column (from the embedded schema or fetched template columns) and enforces it in the image dropzone and file-select validation, replacing the previous global hardcoded 5 MB limit Addresses part 1 of #986. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lv59iJ7gFt1HyhFNYbkPHw
|
View your CI Pipeline Execution ↗ for commit 74ffa56
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗ ☁️ Nx Cloud last updated this comment at |
3 tasks
chavda-bhavik
added a commit
that referenced
this pull request
Sep 1, 2026
…nt flow (#1195) ## Summary - Completes the per-column max image size feature from #1194: caps it at 20MB (was unbounded), enforces it during auto-import validation via HEAD-request size checks against uploaded image URLs, and tweaks widget copy to not hardcode "5 MB". - Improves the column add/edit/manage UI/UX in the Schema tab: - Extracts a reusable `GatedField` component, replacing ~8 copy-pasted plan-gating (lock/badge/upsell) blocks - Column Key now visibly auto-syncs from Name (until manually edited), with client-side duplicate-key validation instead of a generic API error - Confirms before a column type change would silently drop already-configured Range/Length/Digits validations - Unifies column creation into a single modal-based flow (previously two divergent code paths: a quick inline-submit and a "Validations" modal path that both ended up calling create, inconsistently) - Adds a drag-and-drop target highlight when reordering columns ## Bugs fixed along the way - JSON bulk-editor error parsing (`useColumnsEditor.tsx`) mis-attributed/mis-trimmed validation errors for templates with 10+ columns (character-index parsing instead of proper index extraction), and a typo (`Array.isArray[...]` instead of `Array.isArray(...)`) caused a second error on the same column to silently overwrite the first instead of appending. - Bulk column update failures (`useUpdateBulkColumns.ts`) rendered a **blank** notification toast (`notify(error.message + 'Hola')` passed a raw string as the notification key, which doesn't exist, so nothing displayed) — now shows the actual error. ## Test plan - [x] `apps/web` type-checks cleanly (`tsc --noEmit`) - [ ] Manually verify: add/edit a column of each type, confirm duplicate-key validation, confirm type-change warning, confirm JSON bulk-editor surfaces per-column errors correctly with 10+ columns - [ ] Manually verify auto-import rejects images over the configured per-column max size Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> https://claude.ai/code/session_01Hqy3rtwmRHKRsqKY5ntuT9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getApiKeyForUserIdcomparedapiKey._userId.toString()against a rawuserIdthat is actually a MongooseObjectIdat login/refresh time (not a string, despite theUserEntity._id: stringtype).string === ObjectIdis alwaysfalse, sorolesilently resolved tonullin the JWT for every non-owner team member, giving them zero CASL permissions. Owners were unaffected since they bypass role checks viaisOwner.Imagetype columns, addressing part 1 of Image Import Settings & Multi-Image Selection Support #986. Configurable from the column add/edit UI; enforced end-to-end through the widget's image upload flow (dropzone + file-select validation), replacing the previous hardcoded global 5 MB limit.Test plan
@impler/shared,@impler/dal,@impler/api,@impler/web,@impler/widgetall build cleanly🤖 Generated with Claude Code
https://claude.ai/code/session_01Lv59iJ7gFt1HyhFNYbkPHw