Repository: twentyhq/twenty
File: packages/twenty-front/src/modules/activities/calendar/components/CalendarEventDetails.tsx (TypeScript)

Code before:

      setIsUpdating(true);
      void updateOneRecord({
        idToUpdate: variables.where.id as string,
        updateOneRecordInput: variables.updateOneRecordInput,
      }).finally(() => setIsUpdating(false));
    },
    [updateOneRecord],
  );

  const useUpdateOneCalendarEventRecordMutation: RecordUpdateHook = useCallback(
    () => [updateEntity, { loading: isUpdating }],
    [isUpdating, updateEntity],
  );

  const objectPermissions = useObjectPermissionsForObject(
    objectMetadataItem.id,
  );
  const isRecordDeleted = useIsRecordDeleted({ recordId: calendarEvent.id });

  const isFieldReadOnly = (fieldMetadataItem: FieldMetadataItem) => {
    if (standardFieldNames.has(fieldMetadataItem.name)) {
      return true;
    }

    const fieldReadOnlyByPermissions = isFieldMetadataReadOnlyByPermissions({
      objectPermissions,
      fieldMetadataId: fieldMetadataItem.id,
    });

    return (
      isRecordDeleted ||
      fieldMetadataItem.isUIReadOnly ||
      fieldReadOnlyByPermissions
    );
  };

  const renderField = (fieldMetadataItem: FieldMetadataItem) => (
    <StyledPropertyBox key={fieldMetadataItem.id}>
      <FieldContext.Provider
        value={{
          recordId: calendarEvent.id,
          isLabelIdentifier: false,
          fieldDefinition: formatFieldMetadataItemAsFieldDefinition({
            field: fieldMetadataItem,
            objectMetadataItem,
            showLabel: true,
            labelWidth: 72,
          }),
          useUpdateRecord: useUpdateOneCalendarEventRecordMutation,
          maxWidth: 300,

Review comment (security):
i'm surprised we don't already have a hook to compute permissions based on objectPermissions, isRecordDeleted

Let's check how other implementations are done (for workflow for instance) and if we really need to do that. I think these fields are already isUIReadOnly which should be enough, no need to check standardFieldNames (let's double check that)


Code after:
        idToUpdate: variables.where.id as string,
        updateOneRecordInput: variables.updateOneRecordInput,
      }).finally(() => setIsUpdating(false));
    },
    [updateOneRecord],
  );

  const useUpdateOneCalendarEventRecordMutation: RecordUpdateHook = () => [
    updateEntity,
    { loading: isUpdating },
  ];

  const objectPermissions = useObjectPermissionsForObject(
    objectMetadataItem.id,
  );
  const isRecordReadOnly = useIsRecordReadOnly({
    recordId: calendarEvent.id,
    objectMetadataId: objectMetadataItem.id,
  });

  const renderField = (fieldMetadataItem: FieldMetadataItem) => {
    const isReadOnly = isRecordFieldReadOnly({
      isRecordReadOnly,
      objectPermissions,
      fieldMetadataItem: {
        id: fieldMetadataItem.id,
        isUIReadOnly: fieldMetadataItem.isUIReadOnly ?? false,
      },
    });

    return (
      <StyledPropertyBox key={fieldMetadataItem.id}>
        <FieldContext.Provider
          value={{
            recordId: calendarEvent.id,
            isLabelIdentifier: false,
            fieldDefinition: formatFieldMetadataItemAsFieldDefinition({
              field: fieldMetadataItem,
              objectMetadataItem,
              showLabel: true,
              labelWidth: 72,
            }),
            useUpdateRecord: useUpdateOneCalendarEventRecordMutation,
            maxWidth: 300,
            isRecordFieldReadOnly: isReadOnly,
          }}
        >
          <RecordFieldComponentInstanceContext.Provider
            value={{
              instanceId: getRecordFieldInputInstanceId({
                recordId: calendarEvent.id,