Files
huly-platform/foundations/server
Ignat RemizovandGitHub f4f3d30bf1 fix(contact): enforce employee contact edit permissions (#10890)
Enforce contact edit boundaries for regular users on both the UI and transaction middleware so users can maintain their own profile details without being able to change other employees' person records or communication channels.

Changes:
- Reject regular-user CUD transactions that update another employee Person or channels attached to that employee, including nested TxApplyIf payloads.
- Allow regular users to edit their own contact details and non-employee contacts, while Maintainers and Owners continue to manage employee records.
- Share contact editability logic in contact resources and use it in person editing, channel editors, and channel presenters so the UI hides or disables blocked actions.
- Add middleware tests covering own-person edits, blocked cross-employee person/channel edits, and maintainer bypass behavior.

Validation:
- git diff --check
- rushx svelte-check in plugins/contact-resources
- targeted Rush tests for @hcengineering/middleware and @hcengineering/contact-resources
- targeted Rush build for @hcengineering/middleware and @hcengineering/contact-resources

Behavioral effect:
Regular users can update their own profile contact details, but attempts to edit another employee's person record or attached email, phone, or GitHub channels are blocked even if sent directly to the server.
2026-09-26 05:07:17 +02:00
..
2025-11-26 19:15:30 +05:00

Huly Server

GitHub License

⭐️ Your star shines on us. Star us on GitHub!

About

Huly Server is a collection of server-side packages extracted from the Huly Platform. This repository contains backend infrastructure components, storage adapters, and server-side utilities that power the Huly ecosystem.

These packages provide essential server-side functionality including database adapters (MongoDB, PostgreSQL, Elasticsearch), storage providers (MinIO, S3), messaging infrastructure (Kafka), and collaborative editing capabilities. They are designed to be modular, scalable, and production-ready for building robust backend services.

Packages

This repository includes the following server packages:

Server Core

Database Adapters

Storage Providers

Infrastructure

Pre-requisites

Before proceeding, ensure that your system meets the following requirements:

  • Node.js (v20.11.0 or higher is required)
  • Rush - Microsoft's scalable monorepo manager
  • Docker - For running development services
  • Docker Compose - For orchestrating development environment

Verification

To verify the installation, perform the following checks in your terminal:

  • Ensure that the docker commands are available:
docker --version
docker compose version
  • Verify Node.js version:
node --version

Installation

You need Microsoft's rush to install the application.

  1. Install Rush globally using the command:

    npm install -g @microsoft/rush
    
  2. Navigate to the repository root and run the following commands:

    rush install
    rush build
    

Build

To build all packages:

rush build

To rebuild (ignoring cache):

rush rebuild

Build & Watch

For development purposes, rush build:watch action could be used:

rush build:watch

It includes build and validate phases in watch mode.

Update project structure

If the project's structure is updated, it may be necessary to relink and rebuild the projects:

rush update
rush build

Troubleshooting

If a build fails, but the code is correct, try to delete the build cache and retry:

rm -rf common/temp/build-cache
rush rebuild

Tests

To execute all tests:

rush test

For individual test execution inside a package directory:

rushx test

Running Integration Tests

The repository includes integration tests that require Docker services:

cd tests
./prepare-tests.sh
rush test

Test Coverage

To generate test coverage reports:

# Run tests with coverage
rush test

# Merge coverage reports from all packages
node common/scripts/merge-coverage.js

# Generate HTML coverage report
node common/scripts/generate-coverage-html.js

# View coverage summary
sh common/scripts/show-coverage-summary.sh

The coverage report will be available in coverage/html/index.html.

Package Publishing

To bump a package version:

node ./common/scripts/bump.js -p projectName

Development Environment

Setting Up Services

The repository includes a Docker Compose configuration for development services:

cd tests
docker compose up -d

This will start:

  • MongoDB - Document database
  • PostgreSQL - Relational database
  • Elasticsearch - Search engine
  • MinIO - Object storage
  • Kafka - Message broker

Environment Variables

Create a .env file in the tests directory with the following variables:

MONGO_URL=mongodb://localhost:27017
POSTGRES_URL=postgresql://localhost:5432/huly
ELASTIC_URL=http://localhost:9200
MINIO_ENDPOINT=localhost
MINIO_PORT=9000
KAFKA_BROKERS=localhost:9092

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

Licensed under the EPL-2.0 license.

© 2025 Hardcore Engineering Inc.