Row level permissions - POC 1 (#16599)

## Context
This PR adds the core structure for RLS implementation:
- RLS data model
- RLS service layer
- RLS WorkspaceMigration and Syncable Entity + cache + Validations
- RLS resolver layer
- ORM layer with RLS Predicate to ORM WHERE clause conversion with
workspaceMember record transposition

Tests are missing though

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Establishes core row-level permissions infrastructure and enforcement
across the stack.
> 
> - Backend: new `rowLevelPermissionPredicate` and
`rowLevelPermissionPredicateGroup` entities, TypeORM migration, feature
flag `IS_ROW_LEVEL_PERMISSION_PREDICATES_ENABLED`, flat-entity
maps/cache wiring, services and GraphQL resolvers for CRUD, and
inclusion of `workspaceMember` in auth context
> - ORM: applies row-level permission predicates to SELECT, DELETE, and
SOFT DELETE query builders; propagates context through
GlobalWorkspaceOrmManager/EntityManager
> - GraphQL: generated schema/types/queries/mutations for
creating/updating/deleting/fetching predicates and groups
> - Frontend: settings page adds a gated "Record-level" section
(placeholder) and metadata error handler labels for new entities
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fe955cc4588a92157afa6795fb574189a4be1e93. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>

packages/twenty-server/src/engine/metadata-modules/flat-entity/constant/all-flat-entity-properties-to-compare-and-stringify.constant.ts

@@ -11,6 +11,8 @@ import { FLAT_PAGE_LAYOUT_WIDGET_EDITABLE_PROPERTIES } from 'src/engine/metadata
 import { FLAT_PAGE_LAYOUT_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-page-layout/constants/flat-page-layout-editable-properties.constant';
 import { FLAT_ROLE_TARGET_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-role-target/constants/flat-role-target-editable-properties.constant';
 import { FLAT_ROLE_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-role/constants/flat-role-editable-properties.constant';
+import { FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/constants/flat-row-level-permission-predicate-group-editable-properties.constant';
+import { FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/constants/flat-row-level-permission-predicate-editable-properties.constant';
 import { FLAT_VIEW_FIELD_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-view-field/constants/flat-view-field-editable-properties.constant';
 import { FLAT_VIEW_FILTER_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-view-filter/constants/flat-view-filter-editable-properties.constant';
 import { FLAT_VIEW_GROUP_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-view-group/constants/flat-view-group-editable-properties.constant';
@@ -132,6 +134,20 @@ export const ALL_FLAT_ENTITY_PROPERTIES_TO_COMPARE_AND_STRINGIFY = {
     ],
     propertiesToStringify: [],
   },
+  rowLevelPermissionPredicate: {
+    propertiesToCompare: [
+      ...FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES,
+      'deletedAt',
+    ],
+    propertiesToStringify: ['value'],
+  },
+  rowLevelPermissionPredicateGroup: {
+    propertiesToCompare: [
+      ...FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES,
+      'deletedAt',
+    ],
+    propertiesToStringify: [],
+  },
 } as const satisfies {
   [P in AllMetadataName]: OneFlatEntityConfiguration<P>;
 };

packages/twenty-server/src/engine/metadata-modules/flat-entity/constant/all-metadata-many-to-one-relations.constant.ts

@@ -122,4 +122,6 @@ export const ALL_METADATA_RELATED_METADATA_BY_FOREIGN_KEY = {
       flatEntityForeignKeyAggregator: 'tabIds',
     },
   },
+  rowLevelPermissionPredicate: {},
+  rowLevelPermissionPredicateGroup: {},
 } as const satisfies MetadataNameAndRelations;

packages/twenty-server/src/engine/metadata-modules/flat-entity/constant/all-metadata-relations-properties.constant.ts

@@ -126,6 +126,23 @@ export const ALL_METADATA_RELATION_PROPERTIES = {
     objectMetadata: true,
     application: true,
   },
+  rowLevelPermissionPredicate: {
+    workspace: true,
+    role: true,
+    fieldMetadata: true,
+    workspaceMemberFieldMetadata: true,
+    objectMetadata: true,
+    rowLevelPermissionPredicateGroup: true,
+    application: true,
+  },
+  rowLevelPermissionPredicateGroup: {
+    workspace: true,
+    role: true,
+    parentRowLevelPermissionPredicateGroup: true,
+    childRowLevelPermissionPredicateGroups: true,
+    rowLevelPermissionPredicates: true,
+    application: true,
+  },
 } as const satisfies {
   [TName in AllMetadataName]: {
     [P in ExtractEntityRelatedEntityProperties<MetadataEntity<TName>>]: true;

packages/twenty-server/src/engine/metadata-modules/flat-entity/constant/all-metadata-required-metadata-for-validation.constant.ts

@@ -64,4 +64,13 @@ export const ALL_METADATA_REQUIRED_METADATA_FOR_VALIDATION = {
   pageLayoutWidget: {
     pageLayoutTab: true,
   },
+  rowLevelPermissionPredicate: {
+    fieldMetadata: true,
+    objectMetadata: true,
+    role: true,
+    rowLevelPermissionPredicateGroup: true,
+  },
+  rowLevelPermissionPredicateGroup: {
+    role: true,
+  },
 } as const satisfies MetadataRequiredForValidation;

packages/twenty-server/src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module.ts

@@ -9,6 +9,8 @@ import { WorkspaceFlatObjectMetadataMapCacheService } from 'src/engine/metadata-
 import { WorkspaceFlatPageLayoutTabMapCacheService } from 'src/engine/metadata-modules/flat-page-layout-tab/services/workspace-flat-page-layout-tab-map-cache.service';
 import { WorkspaceFlatPageLayoutWidgetMapCacheService } from 'src/engine/metadata-modules/flat-page-layout-widget/services/workspace-flat-page-layout-widget-map-cache.service';
 import { WorkspaceFlatPageLayoutMapCacheService } from 'src/engine/metadata-modules/flat-page-layout/services/workspace-flat-page-layout-map-cache.service';
+import { WorkspaceFlatRowLevelPermissionPredicateGroupMapCacheService } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/services/workspace-flat-row-level-permission-predicate-group-map-cache.service';
+import { WorkspaceFlatRowLevelPermissionPredicateMapCacheService } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/services/workspace-flat-row-level-permission-predicate-map-cache.service';
 import { WorkspaceFlatViewFieldMapCacheService } from 'src/engine/metadata-modules/flat-view-field/services/workspace-flat-view-field-map-cache.service';
 import { WorkspaceFlatViewFilterMapCacheService } from 'src/engine/metadata-modules/flat-view-filter/services/workspace-flat-view-filter-map-cache.service';
 import { WorkspaceFlatViewGroupMapCacheService } from 'src/engine/metadata-modules/flat-view-group/services/workspace-flat-view-group-map-cache.service';
@@ -19,6 +21,8 @@ import { ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadat
 import { PageLayoutTabEntity } from 'src/engine/metadata-modules/page-layout-tab/entities/page-layout-tab.entity';
 import { PageLayoutWidgetEntity } from 'src/engine/metadata-modules/page-layout-widget/entities/page-layout-widget.entity';
 import { PageLayoutEntity } from 'src/engine/metadata-modules/page-layout/entities/page-layout.entity';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
 import { ViewFieldEntity } from 'src/engine/metadata-modules/view-field/entities/view-field.entity';
 import { ViewFilterEntity } from 'src/engine/metadata-modules/view-filter/entities/view-filter.entity';
 import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
@@ -40,6 +44,8 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
       PageLayoutEntity,
       PageLayoutTabEntity,
       PageLayoutWidgetEntity,
+      RowLevelPermissionPredicateEntity,
+      RowLevelPermissionPredicateGroupEntity,
     ]),
   ],
   providers: [
@@ -54,6 +60,8 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
     WorkspaceFlatPageLayoutMapCacheService,
     WorkspaceFlatPageLayoutTabMapCacheService,
     WorkspaceFlatPageLayoutWidgetMapCacheService,
+    WorkspaceFlatRowLevelPermissionPredicateMapCacheService,
+    WorkspaceFlatRowLevelPermissionPredicateGroupMapCacheService,
   ],
   exports: [
     WorkspaceManyOrAllFlatEntityMapsCacheService,
@@ -67,6 +75,8 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
     WorkspaceFlatPageLayoutMapCacheService,
     WorkspaceFlatPageLayoutTabMapCacheService,
     WorkspaceFlatPageLayoutWidgetMapCacheService,
+    WorkspaceFlatRowLevelPermissionPredicateMapCacheService,
+    WorkspaceFlatRowLevelPermissionPredicateGroupMapCacheService,
   ],
 })
 export class WorkspaceManyOrAllFlatEntityMapsCacheModule {}

packages/twenty-server/src/engine/metadata-modules/flat-entity/types/all-flat-entity-types-by-metadata-name.ts

@@ -8,9 +8,9 @@ import { type FlatAgent } from 'src/engine/metadata-modules/flat-agent/types/fla
 import { type FlatFieldMetadata } from 'src/engine/metadata-modules/flat-field-metadata/types/flat-field-metadata.type';
 import { type FlatIndexMetadata } from 'src/engine/metadata-modules/flat-index-metadata/types/flat-index-metadata.type';
 import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
-import { type FlatPageLayout } from 'src/engine/metadata-modules/flat-page-layout/types/flat-page-layout.type';
 import { type FlatPageLayoutTab } from 'src/engine/metadata-modules/flat-page-layout-tab/types/flat-page-layout-tab.type';
 import { type FlatPageLayoutWidget } from 'src/engine/metadata-modules/flat-page-layout-widget/types/flat-page-layout-widget.type';
+import { type FlatPageLayout } from 'src/engine/metadata-modules/flat-page-layout/types/flat-page-layout.type';
 import { type FlatRoleTarget } from 'src/engine/metadata-modules/flat-role-target/types/flat-role-target.type';
 import { type FlatRole } from 'src/engine/metadata-modules/flat-role/types/flat-role.type';
 import { type FlatViewField } from 'src/engine/metadata-modules/flat-view-field/types/flat-view-field.type';
@@ -19,13 +19,17 @@ import { type FlatViewGroup } from 'src/engine/metadata-modules/flat-view-group/
 import { type FlatView } from 'src/engine/metadata-modules/flat-view/types/flat-view.type';
 import { type IndexMetadataEntity } from 'src/engine/metadata-modules/index-metadata/index-metadata.entity';
 import { type ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
-import { type PageLayoutEntity } from 'src/engine/metadata-modules/page-layout/entities/page-layout.entity';
 import { type PageLayoutTabEntity } from 'src/engine/metadata-modules/page-layout-tab/entities/page-layout-tab.entity';
 import { type PageLayoutWidgetEntity } from 'src/engine/metadata-modules/page-layout-widget/entities/page-layout-widget.entity';
+import { type PageLayoutEntity } from 'src/engine/metadata-modules/page-layout/entities/page-layout.entity';
 import { type RoleTargetEntity } from 'src/engine/metadata-modules/role-target/role-target.entity';
 import { type RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
 import { type RouteTriggerEntity } from 'src/engine/metadata-modules/route-trigger/route-trigger.entity';
 import { type FlatRouteTrigger } from 'src/engine/metadata-modules/route-trigger/types/flat-route-trigger.type';
+import { type RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { type RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
 import { type ServerlessFunctionEntity } from 'src/engine/metadata-modules/serverless-function/serverless-function.entity';
 import { type FlatServerlessFunction } from 'src/engine/metadata-modules/serverless-function/types/flat-serverless-function.type';
 import { type ViewFieldEntity } from 'src/engine/metadata-modules/view-field/entities/view-field.entity';
@@ -61,11 +65,6 @@ import {
   type DeleteObjectAction,
   type UpdateObjectAction,
 } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/object/types/workspace-migration-object-action-v2';
-import {
-  type CreatePageLayoutAction,
-  type DeletePageLayoutAction,
-  type UpdatePageLayoutAction,
-} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout/types/workspace-migration-page-layout-action-v2.type';
 import {
   type CreatePageLayoutTabAction,
   type DeletePageLayoutTabAction,
@@ -76,6 +75,11 @@ import {
   type DeletePageLayoutWidgetAction,
   type UpdatePageLayoutWidgetAction,
 } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout-widget/types/workspace-migration-page-layout-widget-action-v2.type';
+import {
+  type CreatePageLayoutAction,
+  type DeletePageLayoutAction,
+  type UpdatePageLayoutAction,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout/types/workspace-migration-page-layout-action-v2.type';
 import {
   type CreateRoleTargetAction,
   type DeleteRoleTargetAction,
@@ -91,6 +95,17 @@ import {
   type DeleteRouteTriggerAction,
   type UpdateRouteTriggerAction,
 } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/route-trigger/types/workspace-migration-route-trigger-action-v2.type';
+import {
+  type CreateRowLevelPermissionPredicateGroupAction,
+  type DeleteRowLevelPermissionPredicateGroupAction,
+  type UpdateRowLevelPermissionPredicateGroupAction,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type';
+import {
+  type CreateRowLevelPermissionPredicateAction,
+  type DeleteRowLevelPermissionPredicateAction,
+  type DestroyRowLevelPermissionPredicateAction,
+  type UpdateRowLevelPermissionPredicateAction,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type';
 import {
   type CreateServerlessFunctionAction,
   type DeleteServerlessFunctionAction,
@@ -163,6 +178,26 @@ export type AllFlatEntityTypesByMetadataName = {
     flatEntity: FlatViewGroup;
     entity: ViewGroupEntity;
   };
+  rowLevelPermissionPredicate: {
+    actions: {
+      created: CreateRowLevelPermissionPredicateAction;
+      updated: UpdateRowLevelPermissionPredicateAction;
+      deleted:
+        | DeleteRowLevelPermissionPredicateAction
+        | DestroyRowLevelPermissionPredicateAction;
+    };
+    flatEntity: FlatRowLevelPermissionPredicate;
+    entity: RowLevelPermissionPredicateEntity;
+  };
+  rowLevelPermissionPredicateGroup: {
+    actions: {
+      created: CreateRowLevelPermissionPredicateGroupAction;
+      updated: UpdateRowLevelPermissionPredicateGroupAction;
+      deleted: DeleteRowLevelPermissionPredicateGroupAction;
+    };
+    flatEntity: FlatRowLevelPermissionPredicateGroup;
+    entity: RowLevelPermissionPredicateGroupEntity;
+  };
   index: {
     actions: {
       created: CreateIndexAction;

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/constants/flat-row-level-permission-predicate-group-editable-properties.constant.ts

@@ -0,0 +1,9 @@
+/* @license Enterprise */
+
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES = [
+  'logicalOperator',
+  'positionInRowLevelPermissionPredicateGroup',
+  'parentRowLevelPermissionPredicateGroupId',
+] as const satisfies (keyof FlatRowLevelPermissionPredicateGroup)[];

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-create-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-to-create.util.ts

@@ -0,0 +1,55 @@
+/* @license Enterprise */
+
+import { trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties } from 'twenty-shared/utils';
+import { v4 } from 'uuid';
+
+import { type CreateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate-group.input';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const fromCreateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToCreate =
+  ({
+    createRowLevelPermissionPredicateGroupInput:
+      rawCreateRowLevelPermissionPredicateGroupInput,
+    workspaceId,
+  }: {
+    createRowLevelPermissionPredicateGroupInput: CreateRowLevelPermissionPredicateGroupInput;
+    workspaceId: string;
+  }): FlatRowLevelPermissionPredicateGroup => {
+    const sanitizedInput = (
+      trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties as unknown as (
+        input: CreateRowLevelPermissionPredicateGroupInput,
+        keys: string[],
+      ) => CreateRowLevelPermissionPredicateGroupInput
+    )(rawCreateRowLevelPermissionPredicateGroupInput, [
+      'roleId',
+      'parentRowLevelPermissionPredicateGroupId',
+      'logicalOperator',
+    ]);
+
+    const { roleId, ...createRowLevelPermissionPredicateGroupInput } =
+      sanitizedInput;
+
+    const createdAt = new Date().toISOString();
+    const predicateGroupId = v4();
+
+    return {
+      id: predicateGroupId,
+      workspaceId,
+      roleId,
+      childRowLevelPermissionPredicateGroupIds: [],
+      rowLevelPermissionPredicateIds: [],
+      createdAt,
+      updatedAt: createdAt,
+      deletedAt: null,
+      universalIdentifier: predicateGroupId,
+      parentRowLevelPermissionPredicateGroupId:
+        createRowLevelPermissionPredicateGroupInput.parentRowLevelPermissionPredicateGroupId ??
+        null,
+      logicalOperator:
+        createRowLevelPermissionPredicateGroupInput.logicalOperator,
+      positionInRowLevelPermissionPredicateGroup:
+        createRowLevelPermissionPredicateGroupInput.positionInRowLevelPermissionPredicateGroup ??
+        null,
+      applicationId: null,
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-delete-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-or-throw.util.ts

@@ -0,0 +1,45 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+} from 'twenty-shared/utils';
+
+import { type DeleteRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate-group.input';
+import {
+  RowLevelPermissionPredicateGroupException,
+  RowLevelPermissionPredicateGroupExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate-group.exception';
+import { type FlatRowLevelPermissionPredicateGroupMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group-maps.type';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const fromDeleteRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow =
+  ({
+    deleteRowLevelPermissionPredicateGroupInput:
+      rawDeleteRowLevelPermissionPredicateGroupInput,
+    flatRowLevelPermissionPredicateGroupMaps,
+  }: {
+    deleteRowLevelPermissionPredicateGroupInput: DeleteRowLevelPermissionPredicateGroupInput;
+    flatRowLevelPermissionPredicateGroupMaps: FlatRowLevelPermissionPredicateGroupMaps;
+  }): FlatRowLevelPermissionPredicateGroup => {
+    const { id: predicateGroupId } = extractAndSanitizeObjectStringFields(
+      rawDeleteRowLevelPermissionPredicateGroupInput,
+      ['id'],
+    );
+
+    const existingFlatPredicateGroup =
+      flatRowLevelPermissionPredicateGroupMaps.byId[predicateGroupId];
+
+    if (!isDefined(existingFlatPredicateGroup)) {
+      throw new RowLevelPermissionPredicateGroupException(
+        t`Row level permission predicate group to delete not found`,
+        RowLevelPermissionPredicateGroupExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND,
+      );
+    }
+
+    return {
+      ...existingFlatPredicateGroup,
+      deletedAt: new Date().toISOString(),
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-destroy-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-or-throw.util.ts

@@ -0,0 +1,42 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+} from 'twenty-shared/utils';
+
+import { type DestroyRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate-group.input';
+import {
+  RowLevelPermissionPredicateGroupException,
+  RowLevelPermissionPredicateGroupExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate-group.exception';
+import { type FlatRowLevelPermissionPredicateGroupMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group-maps.type';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const fromDestroyRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow =
+  ({
+    destroyRowLevelPermissionPredicateGroupInput:
+      rawDestroyRowLevelPermissionPredicateGroupInput,
+    flatRowLevelPermissionPredicateGroupMaps,
+  }: {
+    destroyRowLevelPermissionPredicateGroupInput: DestroyRowLevelPermissionPredicateGroupInput;
+    flatRowLevelPermissionPredicateGroupMaps: FlatRowLevelPermissionPredicateGroupMaps;
+  }): FlatRowLevelPermissionPredicateGroup => {
+    const { id: predicateGroupId } = extractAndSanitizeObjectStringFields(
+      rawDestroyRowLevelPermissionPredicateGroupInput,
+      ['id'],
+    );
+
+    const existingFlatPredicateGroup =
+      flatRowLevelPermissionPredicateGroupMaps.byId[predicateGroupId];
+
+    if (!isDefined(existingFlatPredicateGroup)) {
+      throw new RowLevelPermissionPredicateGroupException(
+        t`Row level permission predicate group to destroy not found`,
+        RowLevelPermissionPredicateGroupExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND,
+      );
+    }
+
+    return existingFlatPredicateGroup;
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-flat-row-level-permission-predicate-group-to-dto.util.ts

@@ -0,0 +1,10 @@
+/* @license Enterprise */
+
+import { type RowLevelPermissionPredicateGroupDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate-group.dto';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const fromFlatRowLevelPermissionPredicateGroupToDto = (
+  flatGroup: FlatRowLevelPermissionPredicateGroup,
+): RowLevelPermissionPredicateGroupDTO => ({
+  ...flatGroup,
+});

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-update-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-to-update-or-throw.util.ts

@@ -0,0 +1,55 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+  trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties,
+} from 'twenty-shared/utils';
+
+import { FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/constants/flat-row-level-permission-predicate-group-editable-properties.constant';
+import { type UpdateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate-group.input';
+import {
+  RowLevelPermissionPredicateGroupException,
+  RowLevelPermissionPredicateGroupExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate-group.exception';
+import { type FlatRowLevelPermissionPredicateGroupMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group-maps.type';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+import { mergeUpdateInExistingRecord } from 'src/utils/merge-update-in-existing-record.util';
+
+export const fromUpdateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToUpdateOrThrow =
+  ({
+    updateRowLevelPermissionPredicateGroupInput:
+      rawUpdateRowLevelPermissionPredicateGroupInput,
+    flatRowLevelPermissionPredicateGroupMaps,
+  }: {
+    updateRowLevelPermissionPredicateGroupInput: UpdateRowLevelPermissionPredicateGroupInput;
+    flatRowLevelPermissionPredicateGroupMaps: FlatRowLevelPermissionPredicateGroupMaps;
+  }): FlatRowLevelPermissionPredicateGroup => {
+    const { id: predicateGroupId } =
+      trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties(
+        rawUpdateRowLevelPermissionPredicateGroupInput,
+        ['id'],
+      );
+
+    const existingFlatPredicateGroup =
+      flatRowLevelPermissionPredicateGroupMaps.byId[predicateGroupId];
+
+    if (!isDefined(existingFlatPredicateGroup)) {
+      throw new RowLevelPermissionPredicateGroupException(
+        t`Row level permission predicate group to update not found`,
+        RowLevelPermissionPredicateGroupExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND,
+      );
+    }
+
+    const sanitizedUpdate = extractAndSanitizeObjectStringFields(
+      rawUpdateRowLevelPermissionPredicateGroupInput,
+      FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES,
+    );
+
+    return mergeUpdateInExistingRecord({
+      existing: existingFlatPredicateGroup,
+      properties: FLAT_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_EDITABLE_PROPERTIES,
+      update: sanitizedUpdate,
+    });
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/constants/flat-row-level-permission-predicate-editable-properties.constant.ts

@@ -0,0 +1,13 @@
+/* @license Enterprise */
+
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES = [
+  'operand',
+  'value',
+  'rowLevelPermissionPredicateGroupId',
+  'positionInRowLevelPermissionPredicateGroup',
+  'subFieldName',
+  'workspaceMemberFieldMetadataId',
+  'workspaceMemberSubFieldName',
+] as const satisfies (keyof FlatRowLevelPermissionPredicate)[];

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/constants/row-level-permission-predicate-entity-relation-properties.constant.ts

@@ -0,0 +1,11 @@
+/* @license Enterprise */
+
+export const ROW_LEVEL_PERMISSION_PREDICATE_ENTITY_RELATION_PROPERTIES = [
+  'workspace',
+  'role',
+  'fieldMetadata',
+  'workspaceMemberFieldMetadata',
+  'objectMetadata',
+  'rowLevelPermissionPredicateGroup',
+  'application',
+] as const;

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/constants/row-level-permission-predicate-group-entity-relation-properties.constant.ts

@@ -0,0 +1,10 @@
+/* @license Enterprise */
+
+export const ROW_LEVEL_PERMISSION_PREDICATE_GROUP_ENTITY_RELATION_PROPERTIES = [
+  'workspace',
+  'role',
+  'parentRowLevelPermissionPredicateGroup',
+  'childRowLevelPermissionPredicateGroups',
+  'rowLevelPermissionPredicates',
+  'application',
+] as const;

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/services/workspace-flat-row-level-permission-predicate-group-map-cache.service.ts

@@ -0,0 +1,55 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { Repository } from 'typeorm';
+
+import { WorkspaceCacheProvider } from 'src/engine/workspace-cache/interfaces/workspace-cache-provider.service';
+
+import { createEmptyFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/constant/create-empty-flat-entity-maps.constant';
+import { fromRowLevelPermissionPredicateGroupEntityToFlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-row-level-permission-predicate-group-entity-to-flat-row-level-permission-predicate-group.util';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { type FlatRowLevelPermissionPredicateGroupMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group-maps.type';
+import { WorkspaceCache } from 'src/engine/workspace-cache/decorators/workspace-cache.decorator';
+import { addFlatEntityToFlatEntityMapsThroughMutationOrThrow } from 'src/engine/workspace-manager/workspace-migration-v2/utils/add-flat-entity-to-flat-entity-maps-through-mutation-or-throw.util';
+
+@Injectable()
+@WorkspaceCache('flatRowLevelPermissionPredicateGroupMaps')
+export class WorkspaceFlatRowLevelPermissionPredicateGroupMapCacheService extends WorkspaceCacheProvider<FlatRowLevelPermissionPredicateGroupMaps> {
+  constructor(
+    @InjectRepository(RowLevelPermissionPredicateGroupEntity)
+    private readonly rowLevelPermissionPredicateGroupRepository: Repository<RowLevelPermissionPredicateGroupEntity>,
+  ) {
+    super();
+  }
+
+  async computeForCache(
+    workspaceId: string,
+  ): Promise<FlatRowLevelPermissionPredicateGroupMaps> {
+    const rowLevelPermissionPredicateGroups =
+      await this.rowLevelPermissionPredicateGroupRepository.find({
+        where: {
+          workspaceId,
+        },
+        withDeleted: true,
+      });
+
+    const flatRowLevelPermissionPredicateGroupMaps =
+      createEmptyFlatEntityMaps();
+
+    for (const rowLevelPermissionPredicateGroupEntity of rowLevelPermissionPredicateGroups) {
+      const flatRowLevelPermissionPredicateGroup =
+        fromRowLevelPermissionPredicateGroupEntityToFlatRowLevelPermissionPredicateGroup(
+          rowLevelPermissionPredicateGroupEntity,
+        );
+
+      addFlatEntityToFlatEntityMapsThroughMutationOrThrow({
+        flatEntity: flatRowLevelPermissionPredicateGroup,
+        flatEntityMapsToMutate: flatRowLevelPermissionPredicateGroupMaps,
+      });
+    }
+
+    return flatRowLevelPermissionPredicateGroupMaps;
+  }
+}

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/services/workspace-flat-row-level-permission-predicate-map-cache.service.ts

@@ -0,0 +1,54 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { Repository } from 'typeorm';
+
+import { WorkspaceCacheProvider } from 'src/engine/workspace-cache/interfaces/workspace-cache-provider.service';
+
+import { createEmptyFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/constant/create-empty-flat-entity-maps.constant';
+import { fromRowLevelPermissionPredicateEntityToFlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-row-level-permission-predicate-entity-to-flat-row-level-permission-predicate.util';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { type FlatRowLevelPermissionPredicateMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-maps.type';
+import { WorkspaceCache } from 'src/engine/workspace-cache/decorators/workspace-cache.decorator';
+import { addFlatEntityToFlatEntityMapsThroughMutationOrThrow } from 'src/engine/workspace-manager/workspace-migration-v2/utils/add-flat-entity-to-flat-entity-maps-through-mutation-or-throw.util';
+
+@Injectable()
+@WorkspaceCache('flatRowLevelPermissionPredicateMaps')
+export class WorkspaceFlatRowLevelPermissionPredicateMapCacheService extends WorkspaceCacheProvider<FlatRowLevelPermissionPredicateMaps> {
+  constructor(
+    @InjectRepository(RowLevelPermissionPredicateEntity)
+    private readonly rowLevelPermissionPredicateRepository: Repository<RowLevelPermissionPredicateEntity>,
+  ) {
+    super();
+  }
+
+  async computeForCache(
+    workspaceId: string,
+  ): Promise<FlatRowLevelPermissionPredicateMaps> {
+    const rowLevelPermissionPredicates =
+      await this.rowLevelPermissionPredicateRepository.find({
+        where: {
+          workspaceId,
+        },
+        withDeleted: true,
+      });
+
+    const flatRowLevelPermissionPredicateMaps = createEmptyFlatEntityMaps();
+
+    for (const rowLevelPermissionPredicateEntity of rowLevelPermissionPredicates) {
+      const flatRowLevelPermissionPredicate =
+        fromRowLevelPermissionPredicateEntityToFlatRowLevelPermissionPredicate(
+          rowLevelPermissionPredicateEntity,
+        );
+
+      addFlatEntityToFlatEntityMapsThroughMutationOrThrow({
+        flatEntity: flatRowLevelPermissionPredicate,
+        flatEntityMapsToMutate: flatRowLevelPermissionPredicateMaps,
+      });
+    }
+
+    return flatRowLevelPermissionPredicateMaps;
+  }
+}

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-create-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-to-create.util.ts

@@ -0,0 +1,72 @@
+/* @license Enterprise */
+
+import { trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties } from 'twenty-shared/utils';
+import { v4 } from 'uuid';
+
+import { type CreateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate.input';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const fromCreateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToCreate =
+  ({
+    createRowLevelPermissionPredicateInput:
+      rawCreateRowLevelPermissionPredicateInput,
+    workspaceId,
+  }: {
+    createRowLevelPermissionPredicateInput: CreateRowLevelPermissionPredicateInput;
+    workspaceId: string;
+  }): FlatRowLevelPermissionPredicate => {
+    const sanitizedInput = (
+      trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties as unknown as (
+        input: CreateRowLevelPermissionPredicateInput,
+        keys: string[],
+      ) => CreateRowLevelPermissionPredicateInput
+    )(rawCreateRowLevelPermissionPredicateInput, [
+      'fieldMetadataId',
+      'objectMetadataId',
+      'roleId',
+      'rowLevelPermissionPredicateGroupId',
+      'workspaceMemberFieldMetadataId',
+      'subFieldName',
+      'workspaceMemberSubFieldName',
+      'operand',
+    ]);
+
+    const {
+      fieldMetadataId,
+      objectMetadataId,
+      roleId,
+      value,
+      ...createRowLevelPermissionPredicateInput
+    } = sanitizedInput;
+
+    const createdAt = new Date().toISOString();
+    const predicateId = v4();
+
+    return {
+      id: predicateId,
+      fieldMetadataId,
+      objectMetadataId,
+      roleId,
+      workspaceId,
+      createdAt,
+      updatedAt: createdAt,
+      deletedAt: null,
+      universalIdentifier: predicateId,
+      operand: createRowLevelPermissionPredicateInput.operand,
+      value: value,
+      rowLevelPermissionPredicateGroupId:
+        createRowLevelPermissionPredicateInput.rowLevelPermissionPredicateGroupId ??
+        null,
+      positionInRowLevelPermissionPredicateGroup:
+        createRowLevelPermissionPredicateInput.positionInRowLevelPermissionPredicateGroup ??
+        null,
+      subFieldName: createRowLevelPermissionPredicateInput.subFieldName ?? null,
+      workspaceMemberFieldMetadataId:
+        createRowLevelPermissionPredicateInput.workspaceMemberFieldMetadataId ??
+        null,
+      workspaceMemberSubFieldName:
+        createRowLevelPermissionPredicateInput.workspaceMemberSubFieldName ??
+        null,
+      applicationId: null,
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-delete-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-or-throw.util.ts

@@ -0,0 +1,45 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+} from 'twenty-shared/utils';
+
+import { type DeleteRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate.input';
+import {
+  RowLevelPermissionPredicateException,
+  RowLevelPermissionPredicateExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate.exception';
+import { type FlatRowLevelPermissionPredicateMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-maps.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const fromDeleteRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow =
+  ({
+    deleteRowLevelPermissionPredicateInput:
+      rawDeleteRowLevelPermissionPredicateInput,
+    flatRowLevelPermissionPredicateMaps,
+  }: {
+    deleteRowLevelPermissionPredicateInput: DeleteRowLevelPermissionPredicateInput;
+    flatRowLevelPermissionPredicateMaps: FlatRowLevelPermissionPredicateMaps;
+  }): FlatRowLevelPermissionPredicate => {
+    const { id: predicateId } = extractAndSanitizeObjectStringFields(
+      rawDeleteRowLevelPermissionPredicateInput,
+      ['id'],
+    );
+
+    const existingFlatPredicate =
+      flatRowLevelPermissionPredicateMaps.byId[predicateId];
+
+    if (!isDefined(existingFlatPredicate)) {
+      throw new RowLevelPermissionPredicateException(
+        t`Row level permission predicate to delete not found`,
+        RowLevelPermissionPredicateExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND,
+      );
+    }
+
+    return {
+      ...existingFlatPredicate,
+      deletedAt: new Date().toISOString(),
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-destroy-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-or-throw.util.ts

@@ -0,0 +1,42 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+} from 'twenty-shared/utils';
+
+import { type DestroyRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate.input';
+import {
+  RowLevelPermissionPredicateException,
+  RowLevelPermissionPredicateExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate.exception';
+import { type FlatRowLevelPermissionPredicateMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-maps.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const fromDestroyRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow =
+  ({
+    destroyRowLevelPermissionPredicateInput:
+      rawDestroyRowLevelPermissionPredicateInput,
+    flatRowLevelPermissionPredicateMaps,
+  }: {
+    destroyRowLevelPermissionPredicateInput: DestroyRowLevelPermissionPredicateInput;
+    flatRowLevelPermissionPredicateMaps: FlatRowLevelPermissionPredicateMaps;
+  }): FlatRowLevelPermissionPredicate => {
+    const { id: predicateId } = extractAndSanitizeObjectStringFields(
+      rawDestroyRowLevelPermissionPredicateInput,
+      ['id'],
+    );
+
+    const existingFlatPredicate =
+      flatRowLevelPermissionPredicateMaps.byId[predicateId];
+
+    if (!isDefined(existingFlatPredicate)) {
+      throw new RowLevelPermissionPredicateException(
+        t`Row level permission predicate to destroy not found`,
+        RowLevelPermissionPredicateExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND,
+      );
+    }
+
+    return existingFlatPredicate;
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-flat-row-level-permission-predicate-to-dto.util.ts

@@ -0,0 +1,10 @@
+/* @license Enterprise */
+
+import { type RowLevelPermissionPredicateDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate.dto';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const fromFlatRowLevelPermissionPredicateToDto = (
+  flatPredicate: FlatRowLevelPermissionPredicate,
+): RowLevelPermissionPredicateDTO => ({
+  ...flatPredicate,
+});

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-row-level-permission-predicate-entity-to-flat-row-level-permission-predicate.util.ts

@@ -0,0 +1,28 @@
+/* @license Enterprise */
+
+import { removePropertiesFromRecord } from 'twenty-shared/utils';
+
+import { ROW_LEVEL_PERMISSION_PREDICATE_ENTITY_RELATION_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/constants/row-level-permission-predicate-entity-relation-properties.constant';
+import { type RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export const fromRowLevelPermissionPredicateEntityToFlatRowLevelPermissionPredicate =
+  (
+    rowLevelPermissionPredicateEntity: RowLevelPermissionPredicateEntity,
+  ): FlatRowLevelPermissionPredicate => {
+    const rowLevelPermissionPredicateEntityWithoutRelations =
+      removePropertiesFromRecord(rowLevelPermissionPredicateEntity, [
+        ...ROW_LEVEL_PERMISSION_PREDICATE_ENTITY_RELATION_PROPERTIES,
+      ] as (typeof ROW_LEVEL_PERMISSION_PREDICATE_ENTITY_RELATION_PROPERTIES)[number][]);
+
+    return {
+      ...rowLevelPermissionPredicateEntityWithoutRelations,
+      createdAt: rowLevelPermissionPredicateEntity.createdAt.toISOString(),
+      updatedAt: rowLevelPermissionPredicateEntity.updatedAt.toISOString(),
+      deletedAt:
+        rowLevelPermissionPredicateEntity.deletedAt?.toISOString() ?? null,
+      universalIdentifier:
+        rowLevelPermissionPredicateEntityWithoutRelations.universalIdentifier ??
+        rowLevelPermissionPredicateEntityWithoutRelations.id,
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-row-level-permission-predicate-group-entity-to-flat-row-level-permission-predicate-group.util.ts

@@ -0,0 +1,36 @@
+/* @license Enterprise */
+
+import { removePropertiesFromRecord } from 'twenty-shared/utils';
+
+import { ROW_LEVEL_PERMISSION_PREDICATE_GROUP_ENTITY_RELATION_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/constants/row-level-permission-predicate-group-entity-relation-properties.constant';
+import { type RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export const fromRowLevelPermissionPredicateGroupEntityToFlatRowLevelPermissionPredicateGroup =
+  (
+    rowLevelPermissionPredicateGroupEntity: RowLevelPermissionPredicateGroupEntity,
+  ): FlatRowLevelPermissionPredicateGroup => {
+    const rowLevelPermissionPredicateGroupEntityWithoutRelations =
+      removePropertiesFromRecord(rowLevelPermissionPredicateGroupEntity, [
+        ...ROW_LEVEL_PERMISSION_PREDICATE_GROUP_ENTITY_RELATION_PROPERTIES,
+      ] as (typeof ROW_LEVEL_PERMISSION_PREDICATE_GROUP_ENTITY_RELATION_PROPERTIES)[number][]);
+
+    return {
+      ...rowLevelPermissionPredicateGroupEntityWithoutRelations,
+      createdAt: rowLevelPermissionPredicateGroupEntity.createdAt.toISOString(),
+      updatedAt: rowLevelPermissionPredicateGroupEntity.updatedAt.toISOString(),
+      deletedAt:
+        rowLevelPermissionPredicateGroupEntity.deletedAt?.toISOString() ?? null,
+      universalIdentifier:
+        rowLevelPermissionPredicateGroupEntityWithoutRelations.universalIdentifier ??
+        rowLevelPermissionPredicateGroupEntityWithoutRelations.id,
+      childRowLevelPermissionPredicateGroupIds:
+        rowLevelPermissionPredicateGroupEntity.childRowLevelPermissionPredicateGroups.map(
+          ({ id }) => id,
+        ),
+      rowLevelPermissionPredicateIds:
+        rowLevelPermissionPredicateGroupEntity.rowLevelPermissionPredicates.map(
+          ({ id }) => id,
+        ),
+    };
+  };

packages/twenty-server/src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-update-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-to-update-or-throw.util.ts

@@ -0,0 +1,55 @@
+/* @license Enterprise */
+
+import { t } from '@lingui/core/macro';
+import {
+  extractAndSanitizeObjectStringFields,
+  isDefined,
+  trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties,
+} from 'twenty-shared/utils';
+
+import { FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/constants/flat-row-level-permission-predicate-editable-properties.constant';
+import { type UpdateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate.input';
+import {
+  RowLevelPermissionPredicateException,
+  RowLevelPermissionPredicateExceptionCode,
+} from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate.exception';
+import { type FlatRowLevelPermissionPredicateMaps } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-maps.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+import { mergeUpdateInExistingRecord } from 'src/utils/merge-update-in-existing-record.util';
+
+export const fromUpdateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToUpdateOrThrow =
+  ({
+    updateRowLevelPermissionPredicateInput:
+      rawUpdateRowLevelPermissionPredicateInput,
+    flatRowLevelPermissionPredicateMaps,
+  }: {
+    updateRowLevelPermissionPredicateInput: UpdateRowLevelPermissionPredicateInput;
+    flatRowLevelPermissionPredicateMaps: FlatRowLevelPermissionPredicateMaps;
+  }): FlatRowLevelPermissionPredicate => {
+    const { id: predicateId } =
+      trimAndRemoveDuplicatedWhitespacesFromObjectStringProperties(
+        rawUpdateRowLevelPermissionPredicateInput,
+        ['id'],
+      );
+
+    const existingFlatPredicate =
+      flatRowLevelPermissionPredicateMaps.byId[predicateId];
+
+    if (!isDefined(existingFlatPredicate)) {
+      throw new RowLevelPermissionPredicateException(
+        t`Row level permission predicate to update not found`,
+        RowLevelPermissionPredicateExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND,
+      );
+    }
+
+    const sanitizedUpdate = extractAndSanitizeObjectStringFields(
+      rawUpdateRowLevelPermissionPredicateInput,
+      FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES,
+    );
+
+    return mergeUpdateInExistingRecord({
+      existing: existingFlatPredicate,
+      properties: FLAT_ROW_LEVEL_PERMISSION_PREDICATE_EDITABLE_PROPERTIES,
+      update: sanitizedUpdate,
+    });
+  };

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate-group.input.ts

@@ -0,0 +1,20 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+import { RowLevelPermissionPredicateGroupLogicalOperator } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum';
+
+@InputType()
+export class CreateRowLevelPermissionPredicateGroupInput {
+  @Field(() => String, { nullable: true })
+  parentRowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => RowLevelPermissionPredicateGroupLogicalOperator)
+  logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+
+  @Field(() => String)
+  roleId: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate.input.ts

@@ -0,0 +1,41 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+import GraphQLJSON from 'graphql-type-json';
+
+import { RowLevelPermissionPredicateOperand } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand';
+import { RowLevelPermissionPredicateValue } from 'src/engine/metadata-modules/row-level-permission-predicate/types/row-level-permission-predicate-value.type';
+
+@InputType()
+export class CreateRowLevelPermissionPredicateInput {
+  @Field(() => String)
+  fieldMetadataId: string;
+
+  @Field(() => String)
+  objectMetadataId: string;
+
+  @Field(() => RowLevelPermissionPredicateOperand)
+  operand: RowLevelPermissionPredicateOperand;
+
+  @Field(() => GraphQLJSON, { nullable: true })
+  value: RowLevelPermissionPredicateValue | null;
+
+  @Field(() => String, { nullable: true })
+  subFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberFieldMetadataId?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberSubFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  rowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+
+  @Field(() => String)
+  roleId: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate-group.input.ts

@@ -0,0 +1,9 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+@InputType()
+export class DeleteRowLevelPermissionPredicateGroupInput {
+  @Field(() => String)
+  id: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate.input.ts

@@ -0,0 +1,9 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+@InputType()
+export class DeleteRowLevelPermissionPredicateInput {
+  @Field(() => String)
+  id: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate-group.input.ts

@@ -0,0 +1,18 @@
+/* @license Enterprise */
+
+import { InputType } from '@nestjs/graphql';
+
+import { IDField } from '@ptc-org/nestjs-query-graphql';
+import { IsUUID } from 'class-validator';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+
+@InputType()
+export class DestroyRowLevelPermissionPredicateGroupInput {
+  @IDField(() => UUIDScalarType, {
+    description:
+      'The id of the row level permission predicate group to destroy.',
+  })
+  @IsUUID()
+  id: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate.input.ts

@@ -0,0 +1,17 @@
+/* @license Enterprise */
+
+import { InputType } from '@nestjs/graphql';
+
+import { IDField } from '@ptc-org/nestjs-query-graphql';
+import { IsUUID } from 'class-validator';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+
+@InputType()
+export class DestroyRowLevelPermissionPredicateInput {
+  @IDField(() => UUIDScalarType, {
+    description: 'The id of the row level permission predicate to destroy.',
+  })
+  @IsUUID()
+  id: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate-group.input.ts

@@ -0,0 +1,22 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+import { RowLevelPermissionPredicateGroupLogicalOperator } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum';
+
+@InputType()
+export class UpdateRowLevelPermissionPredicateGroupInput {
+  @Field(() => String)
+  id: string;
+
+  @Field(() => String, { nullable: true })
+  parentRowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => RowLevelPermissionPredicateGroupLogicalOperator, {
+    nullable: true,
+  })
+  logicalOperator?: RowLevelPermissionPredicateGroupLogicalOperator;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate.input.ts

@@ -0,0 +1,35 @@
+/* @license Enterprise */
+
+import { Field, InputType } from '@nestjs/graphql';
+
+import GraphQLJSON from 'graphql-type-json';
+
+import { RowLevelPermissionPredicateOperand } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand';
+import { RowLevelPermissionPredicateValue } from 'src/engine/metadata-modules/row-level-permission-predicate/types/row-level-permission-predicate-value.type';
+
+@InputType()
+export class UpdateRowLevelPermissionPredicateInput {
+  @Field(() => String)
+  id: string;
+
+  @Field(() => RowLevelPermissionPredicateOperand, { nullable: true })
+  operand?: RowLevelPermissionPredicateOperand;
+
+  @Field(() => GraphQLJSON, { nullable: true })
+  value?: RowLevelPermissionPredicateValue;
+
+  @Field(() => String, { nullable: true })
+  subFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberFieldMetadataId?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberSubFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  rowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate-group.dto.ts

@@ -0,0 +1,26 @@
+/* @license Enterprise */
+
+import { Field, ObjectType, registerEnumType } from '@nestjs/graphql';
+
+import { RowLevelPermissionPredicateGroupLogicalOperator } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum';
+
+registerEnumType(RowLevelPermissionPredicateGroupLogicalOperator, {
+  name: 'RowLevelPermissionPredicateGroupLogicalOperator',
+});
+@ObjectType('RowLevelPermissionPredicateGroup')
+export class RowLevelPermissionPredicateGroupDTO {
+  @Field(() => String)
+  id: string;
+
+  @Field(() => String, { nullable: true })
+  parentRowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => RowLevelPermissionPredicateGroupLogicalOperator)
+  logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+
+  @Field(() => String)
+  roleId: string;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate.dto.ts

@@ -0,0 +1,47 @@
+/* @license Enterprise */
+
+import { Field, ObjectType, registerEnumType } from '@nestjs/graphql';
+
+import GraphQLJSON from 'graphql-type-json';
+
+import { RowLevelPermissionPredicateOperand } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand';
+import { RowLevelPermissionPredicateValue } from 'src/engine/metadata-modules/row-level-permission-predicate/types/row-level-permission-predicate-value.type';
+
+registerEnumType(RowLevelPermissionPredicateOperand, {
+  name: 'RowLevelPermissionPredicateOperand',
+});
+@ObjectType('RowLevelPermissionPredicate')
+export class RowLevelPermissionPredicateDTO {
+  @Field(() => String)
+  id: string;
+
+  @Field(() => String)
+  fieldMetadataId: string;
+
+  @Field(() => String)
+  objectMetadataId: string;
+
+  @Field(() => RowLevelPermissionPredicateOperand)
+  operand: RowLevelPermissionPredicateOperand;
+
+  @Field(() => String, { nullable: true })
+  subFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberFieldMetadataId?: string | null;
+
+  @Field(() => String, { nullable: true })
+  workspaceMemberSubFieldName?: string | null;
+
+  @Field(() => String, { nullable: true })
+  rowLevelPermissionPredicateGroupId?: string | null;
+
+  @Field(() => Number, { nullable: true })
+  positionInRowLevelPermissionPredicateGroup?: number | null;
+
+  @Field(() => String)
+  roleId: string;
+
+  @Field(() => GraphQLJSON, { nullable: true })
+  value: RowLevelPermissionPredicateValue | null;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity.ts

@@ -0,0 +1,82 @@
+/* @license Enterprise */
+
+import {
+  Column,
+  CreateDateColumn,
+  DeleteDateColumn,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  OneToMany,
+  PrimaryGeneratedColumn,
+  Relation,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { RowLevelPermissionPredicateGroupLogicalOperator } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum';
+import { SyncableEntity } from 'src/engine/workspace-manager/workspace-sync/types/syncable-entity.interface';
+
+@Entity({ name: 'rowLevelPermissionPredicateGroup', schema: 'core' })
+@Index('IDX_RLPPG_WORKSPACE_ID_ROLE_ID', ['workspaceId', 'roleId'])
+export class RowLevelPermissionPredicateGroupEntity
+  extends SyncableEntity
+  implements Required<RowLevelPermissionPredicateGroupEntity>
+{
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ nullable: true, type: 'uuid' })
+  parentRowLevelPermissionPredicateGroupId: string | null;
+
+  @Column({
+    type: 'enum',
+    enum: Object.values(RowLevelPermissionPredicateGroupLogicalOperator),
+    nullable: false,
+    default: RowLevelPermissionPredicateGroupLogicalOperator.AND,
+  })
+  logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator;
+
+  @Column({ nullable: true, type: 'double precision' })
+  positionInRowLevelPermissionPredicateGroup: number | null;
+
+  @Column({ nullable: false, type: 'uuid' })
+  roleId: string;
+
+  @CreateDateColumn({ type: 'timestamptz' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ type: 'timestamptz' })
+  updatedAt: Date;
+
+  @DeleteDateColumn({ type: 'timestamptz' })
+  deletedAt: Date | null;
+
+  @ManyToOne(() => RoleEntity, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'roleId' })
+  role: Relation<RoleEntity>;
+
+  @ManyToOne(
+    () => RowLevelPermissionPredicateGroupEntity,
+    (rowLevelPermissionPredicateGroup) =>
+      rowLevelPermissionPredicateGroup.childRowLevelPermissionPredicateGroups,
+    { onDelete: 'CASCADE' },
+  )
+  @JoinColumn({ name: 'parentRowLevelPermissionPredicateGroupId' })
+  parentRowLevelPermissionPredicateGroup: Relation<RowLevelPermissionPredicateGroupEntity>;
+
+  @OneToMany(
+    () => RowLevelPermissionPredicateGroupEntity,
+    (rowLevelPermissionPredicateGroup) =>
+      rowLevelPermissionPredicateGroup.parentRowLevelPermissionPredicateGroup,
+  )
+  childRowLevelPermissionPredicateGroups: Relation<RowLevelPermissionPredicateGroupEntity>[];
+
+  @OneToMany(
+    () => RowLevelPermissionPredicateEntity,
+    (predicate) => predicate.rowLevelPermissionPredicateGroup,
+  )
+  rowLevelPermissionPredicates: Relation<RowLevelPermissionPredicateEntity>[];
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity.ts

@@ -0,0 +1,115 @@
+/* @license Enterprise */
+
+import {
+  Column,
+  CreateDateColumn,
+  DeleteDateColumn,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  PrimaryGeneratedColumn,
+  Relation,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { FieldMetadataEntity } from 'src/engine/metadata-modules/field-metadata/field-metadata.entity';
+import { ObjectMetadataEntity } from 'src/engine/metadata-modules/object-metadata/object-metadata.entity';
+import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { RowLevelPermissionPredicateOperand } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand';
+import { type RowLevelPermissionPredicateValue } from 'src/engine/metadata-modules/row-level-permission-predicate/types/row-level-permission-predicate-value.type';
+import { SyncableEntity } from 'src/engine/workspace-manager/workspace-sync/types/syncable-entity.interface';
+
+@Entity({ name: 'rowLevelPermissionPredicate', schema: 'core' })
+@Index('IDX_RLPP_WORKSPACE_ID_ROLE_ID_OBJECT_METADATA_ID', [
+  'workspaceId',
+  'roleId',
+  'objectMetadataId',
+])
+@Index('IDX_RLPP_FIELD_METADATA_ID', ['fieldMetadataId'])
+@Index('IDX_RLPP_GROUP_ID', ['rowLevelPermissionPredicateGroupId'])
+export class RowLevelPermissionPredicateEntity
+  extends SyncableEntity
+  implements Required<RowLevelPermissionPredicateEntity>
+{
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ nullable: false, type: 'uuid' })
+  fieldMetadataId: string;
+
+  @ManyToOne(() => FieldMetadataEntity, {
+    onDelete: 'CASCADE',
+  })
+  @JoinColumn({ name: 'fieldMetadataId' })
+  fieldMetadata: Relation<FieldMetadataEntity>;
+
+  @Column({ nullable: false, type: 'uuid' })
+  objectMetadataId: string;
+
+  @ManyToOne(() => ObjectMetadataEntity, {
+    onDelete: 'CASCADE',
+  })
+  @JoinColumn({ name: 'objectMetadataId' })
+  objectMetadata: Relation<ObjectMetadataEntity>;
+
+  @Column({
+    nullable: false,
+    type: 'enum',
+    enum: Object.values(RowLevelPermissionPredicateOperand),
+    default: RowLevelPermissionPredicateOperand.CONTAINS,
+  })
+  operand: RowLevelPermissionPredicateOperand;
+
+  @Column({ nullable: true, type: 'jsonb' })
+  value: RowLevelPermissionPredicateValue | null;
+
+  @Column({ nullable: true, type: 'text', default: null })
+  subFieldName: string | null;
+
+  @Column({ nullable: true, type: 'uuid' })
+  workspaceMemberFieldMetadataId: string | null;
+
+  @Column({ nullable: true, type: 'text', default: null })
+  workspaceMemberSubFieldName: string | null;
+
+  @ManyToOne(() => FieldMetadataEntity, {
+    onDelete: 'SET NULL',
+  })
+  @JoinColumn({ name: 'workspaceMemberFieldMetadataId' })
+  workspaceMemberFieldMetadata: Relation<FieldMetadataEntity>;
+
+  @Column({ nullable: true, type: 'uuid' })
+  rowLevelPermissionPredicateGroupId: string | null;
+
+  @Column({ nullable: true, type: 'double precision' })
+  positionInRowLevelPermissionPredicateGroup: number | null;
+
+  @Column({ nullable: false, type: 'uuid' })
+  roleId: string;
+
+  @CreateDateColumn({ type: 'timestamptz' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ type: 'timestamptz' })
+  updatedAt: Date;
+
+  @DeleteDateColumn({ type: 'timestamptz' })
+  deletedAt: Date | null;
+
+  @ManyToOne(() => RoleEntity, { onDelete: 'CASCADE' })
+  @JoinColumn({ name: 'roleId' })
+  role: Relation<RoleEntity>;
+
+  @ManyToOne(
+    () => RowLevelPermissionPredicateGroupEntity,
+    (rowLevelPermissionPredicateGroup) =>
+      rowLevelPermissionPredicateGroup.rowLevelPermissionPredicates,
+    {
+      onDelete: 'CASCADE',
+    },
+  )
+  @JoinColumn({ name: 'rowLevelPermissionPredicateGroupId' })
+  rowLevelPermissionPredicateGroup: Relation<RowLevelPermissionPredicateGroupEntity>;
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum.ts

@@ -0,0 +1,6 @@
+/* @license Enterprise */
+
+export enum RowLevelPermissionPredicateGroupLogicalOperator {
+  AND = 'AND',
+  OR = 'OR',
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand.ts

@@ -0,0 +1,20 @@
+/* @license Enterprise */
+
+export enum RowLevelPermissionPredicateOperand {
+  IS = 'IS',
+  IS_NOT_NULL = 'IS_NOT_NULL',
+  IS_NOT = 'IS_NOT',
+  LESS_THAN_OR_EQUAL = 'LESS_THAN_OR_EQUAL',
+  GREATER_THAN_OR_EQUAL = 'GREATER_THAN_OR_EQUAL',
+  IS_BEFORE = 'IS_BEFORE',
+  IS_AFTER = 'IS_AFTER',
+  CONTAINS = 'CONTAINS',
+  DOES_NOT_CONTAIN = 'DOES_NOT_CONTAIN',
+  IS_EMPTY = 'IS_EMPTY',
+  IS_NOT_EMPTY = 'IS_NOT_EMPTY',
+  IS_RELATIVE = 'IS_RELATIVE',
+  IS_IN_PAST = 'IS_IN_PAST',
+  IS_IN_FUTURE = 'IS_IN_FUTURE',
+  IS_TODAY = 'IS_TODAY',
+  VECTOR_SEARCH = 'VECTOR_SEARCH',
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate-group.exception.ts

@@ -0,0 +1,44 @@
+/* @license Enterprise */
+
+import { type MessageDescriptor } from '@lingui/core';
+import { msg } from '@lingui/core/macro';
+
+import {
+  appendCommonExceptionCode,
+  CustomException,
+} from 'src/utils/custom-exception';
+
+export const RowLevelPermissionPredicateGroupExceptionCode =
+  appendCommonExceptionCode({
+    ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND:
+      'ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND',
+    INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA:
+      'INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA',
+    ROLE_NOT_FOUND: 'ROLE_NOT_FOUND',
+  } as const);
+
+const rowLevelPermissionPredicateGroupExceptionUserFriendlyMessages: Record<
+  keyof typeof RowLevelPermissionPredicateGroupExceptionCode,
+  MessageDescriptor
+> = {
+  ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND: msg`Row level permission predicate group not found.`,
+  INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA: msg`Invalid row level permission predicate group data.`,
+  ROLE_NOT_FOUND: msg`Role not found.`,
+  INTERNAL_SERVER_ERROR: msg`An unexpected error occurred.`,
+};
+
+export class RowLevelPermissionPredicateGroupException extends CustomException<
+  keyof typeof RowLevelPermissionPredicateGroupExceptionCode
+> {
+  constructor(
+    message: string,
+    code: keyof typeof RowLevelPermissionPredicateGroupExceptionCode,
+    { userFriendlyMessage }: { userFriendlyMessage?: MessageDescriptor } = {},
+  ) {
+    super(message, code, {
+      userFriendlyMessage:
+        userFriendlyMessage ??
+        rowLevelPermissionPredicateGroupExceptionUserFriendlyMessages[code],
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate.exception.ts

@@ -0,0 +1,48 @@
+/* @license Enterprise */
+
+import { type MessageDescriptor } from '@lingui/core';
+import { msg } from '@lingui/core/macro';
+
+import {
+  appendCommonExceptionCode,
+  CustomException,
+} from 'src/utils/custom-exception';
+
+export const RowLevelPermissionPredicateExceptionCode =
+  appendCommonExceptionCode({
+    ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND:
+      'ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND',
+    INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA:
+      'INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA',
+    FIELD_METADATA_NOT_FOUND: 'FIELD_METADATA_NOT_FOUND',
+    OBJECT_METADATA_NOT_FOUND: 'OBJECT_METADATA_NOT_FOUND',
+    ROLE_NOT_FOUND: 'ROLE_NOT_FOUND',
+  } as const);
+
+const rowLevelPermissionPredicateExceptionUserFriendlyMessages: Record<
+  keyof typeof RowLevelPermissionPredicateExceptionCode,
+  MessageDescriptor
+> = {
+  ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND: msg`Row level permission predicate not found.`,
+  INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA: msg`Invalid row level permission predicate data.`,
+  FIELD_METADATA_NOT_FOUND: msg`Field metadata not found.`,
+  OBJECT_METADATA_NOT_FOUND: msg`Object metadata not found.`,
+  ROLE_NOT_FOUND: msg`Role not found.`,
+  INTERNAL_SERVER_ERROR: msg`An unexpected error occurred.`,
+};
+
+export class RowLevelPermissionPredicateException extends CustomException<
+  keyof typeof RowLevelPermissionPredicateExceptionCode
+> {
+  constructor(
+    message: string,
+    code: keyof typeof RowLevelPermissionPredicateExceptionCode,
+    { userFriendlyMessage }: { userFriendlyMessage?: MessageDescriptor } = {},
+  ) {
+    super(message, code, {
+      userFriendlyMessage:
+        userFriendlyMessage ??
+        rowLevelPermissionPredicateExceptionUserFriendlyMessages[code],
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/resolvers/row-level-permission-predicate-group.resolver.ts

@@ -0,0 +1,81 @@
+/* @license Enterprise */
+
+import { UseGuards } from '@nestjs/common';
+import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
+
+import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
+import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
+import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
+import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
+import { CreateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate-group.input';
+import { DeleteRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate-group.input';
+import { UpdateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate-group.input';
+import { RowLevelPermissionPredicateGroupDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate-group.dto';
+import { RowLevelPermissionPredicateGroupLogicalOperator } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-group-logical-operator.enum';
+import { RowLevelPermissionPredicateGroupService } from 'src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate-group.service';
+
+@Resolver(() => RowLevelPermissionPredicateGroupDTO)
+@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
+export class RowLevelPermissionPredicateGroupResolver {
+  constructor(
+    private readonly predicateGroupService: RowLevelPermissionPredicateGroupService,
+  ) {}
+
+  @Query(() => [RowLevelPermissionPredicateGroupDTO])
+  async getRowLevelPermissionPredicateGroups(
+    @AuthWorkspace() workspace: WorkspaceEntity,
+    @Args('roleId', { type: () => String, nullable: true }) roleId?: string,
+  ): Promise<RowLevelPermissionPredicateGroupDTO[]> {
+    if (roleId) {
+      return this.predicateGroupService.findByRole(workspace.id, roleId);
+    }
+
+    return this.predicateGroupService.findByWorkspaceId(workspace.id);
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateGroupDTO)
+  async createRowLevelPermissionPredicateGroup(
+    @Args('input')
+    input: CreateRowLevelPermissionPredicateGroupInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateGroupDTO> {
+    return this.predicateGroupService.createOne({
+      createRowLevelPermissionPredicateGroupInput: {
+        ...input,
+        logicalOperator:
+          input.logicalOperator as RowLevelPermissionPredicateGroupLogicalOperator,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateGroupDTO)
+  async updateRowLevelPermissionPredicateGroup(
+    @Args('input')
+    input: UpdateRowLevelPermissionPredicateGroupInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateGroupDTO> {
+    return this.predicateGroupService.updateOne({
+      updateRowLevelPermissionPredicateGroupInput: {
+        ...input,
+        logicalOperator:
+          input.logicalOperator as RowLevelPermissionPredicateGroupLogicalOperator,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateGroupDTO)
+  async deleteRowLevelPermissionPredicateGroup(
+    @Args('input')
+    input: DeleteRowLevelPermissionPredicateGroupInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateGroupDTO> {
+    return this.predicateGroupService.deleteOne({
+      deleteRowLevelPermissionPredicateGroupInput: {
+        ...input,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/resolvers/row-level-permission-predicate.resolver.ts

@@ -0,0 +1,95 @@
+/* @license Enterprise */
+
+import { UseGuards } from '@nestjs/common';
+import { Args, Mutation, Query, Resolver } from '@nestjs/graphql';
+
+import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
+import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
+import { NoPermissionGuard } from 'src/engine/guards/no-permission.guard';
+import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
+import { CreateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate.input';
+import { DeleteRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate.input';
+import { UpdateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate.input';
+import { RowLevelPermissionPredicateDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate.dto';
+import { RowLevelPermissionPredicateOperand } from 'src/engine/metadata-modules/row-level-permission-predicate/enums/row-level-permission-predicate-operand';
+import { RowLevelPermissionPredicateService } from 'src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate.service';
+
+@Resolver(() => RowLevelPermissionPredicateDTO)
+@UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
+export class RowLevelPermissionPredicateResolver {
+  constructor(
+    private readonly predicateService: RowLevelPermissionPredicateService,
+  ) {}
+
+  @Query(() => [RowLevelPermissionPredicateDTO])
+  async getRowLevelPermissionPredicates(
+    @AuthWorkspace() workspace: WorkspaceEntity,
+    @Args('roleId', { type: () => String, nullable: true }) roleId?: string,
+    @Args('objectMetadataId', { type: () => String, nullable: true })
+    objectMetadataId?: string,
+  ): Promise<RowLevelPermissionPredicateDTO[]> {
+    if (roleId && objectMetadataId) {
+      return this.predicateService.findByRoleAndObject(
+        workspace.id,
+        roleId,
+        objectMetadataId,
+      );
+    }
+
+    return this.predicateService.findByWorkspaceId(workspace.id);
+  }
+
+  @Query(() => RowLevelPermissionPredicateDTO, { nullable: true })
+  async getRowLevelPermissionPredicate(
+    @Args('id', { type: () => String }) id: string,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateDTO | null> {
+    return this.predicateService.findById(id, workspace.id);
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateDTO)
+  async createRowLevelPermissionPredicate(
+    @Args('input')
+    input: CreateRowLevelPermissionPredicateInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateDTO> {
+    return this.predicateService.createOne({
+      createRowLevelPermissionPredicateInput: {
+        ...input,
+        operand: input.operand as RowLevelPermissionPredicateOperand,
+        value: input.value,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateDTO)
+  async updateRowLevelPermissionPredicate(
+    @Args('input')
+    input: UpdateRowLevelPermissionPredicateInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateDTO> {
+    return this.predicateService.updateOne({
+      updateRowLevelPermissionPredicateInput: {
+        ...input,
+        operand: input.operand as RowLevelPermissionPredicateOperand,
+        value: input.value,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+
+  @Mutation(() => RowLevelPermissionPredicateDTO)
+  async deleteRowLevelPermissionPredicate(
+    @Args('input')
+    input: DeleteRowLevelPermissionPredicateInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<RowLevelPermissionPredicateDTO> {
+    return this.predicateService.deleteOne({
+      deleteRowLevelPermissionPredicateInput: {
+        ...input,
+      },
+      workspaceId: workspace.id,
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/row-level-permission.module.ts

@@ -0,0 +1,37 @@
+/* @license Enterprise */
+
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+
+import { WorkspaceManyOrAllFlatEntityMapsCacheModule } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.module';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { RowLevelPermissionPredicateGroupResolver } from 'src/engine/metadata-modules/row-level-permission-predicate/resolvers/row-level-permission-predicate-group.resolver';
+import { RowLevelPermissionPredicateResolver } from 'src/engine/metadata-modules/row-level-permission-predicate/resolvers/row-level-permission-predicate.resolver';
+import { RowLevelPermissionPredicateGroupService } from 'src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate-group.service';
+import { RowLevelPermissionPredicateService } from 'src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate.service';
+import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache.module';
+import { WorkspaceMigrationV2Module } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-v2.module';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([
+      RowLevelPermissionPredicateEntity,
+      RowLevelPermissionPredicateGroupEntity,
+    ]),
+    WorkspaceCacheModule,
+    WorkspaceManyOrAllFlatEntityMapsCacheModule,
+    WorkspaceMigrationV2Module,
+  ],
+  providers: [
+    RowLevelPermissionPredicateService,
+    RowLevelPermissionPredicateGroupService,
+    RowLevelPermissionPredicateResolver,
+    RowLevelPermissionPredicateGroupResolver,
+  ],
+  exports: [
+    RowLevelPermissionPredicateService,
+    RowLevelPermissionPredicateGroupService,
+  ],
+})
+export class RowLevelPermissionModule {}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate-group.service.ts

@@ -0,0 +1,298 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { isDefined } from 'twenty-shared/utils';
+
+import { WorkspaceManyOrAllFlatEntityMapsCacheService } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.service';
+import { findFlatEntityByIdInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps-or-throw.util';
+import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
+import { fromCreateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToCreate } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-create-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-to-create.util';
+import { fromDeleteRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-delete-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-or-throw.util';
+import { fromDestroyRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-destroy-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-or-throw.util';
+import { fromFlatRowLevelPermissionPredicateGroupToDto } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-flat-row-level-permission-predicate-group-to-dto.util';
+import { fromUpdateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToUpdateOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate-group/utils/from-update-row-level-permission-predicate-group-input-to-flat-row-level-permission-predicate-group-to-update-or-throw.util';
+import { type CreateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate-group.input';
+import { type DeleteRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate-group.input';
+import { type DestroyRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate-group.input';
+import { type UpdateRowLevelPermissionPredicateGroupInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate-group.input';
+import { RowLevelPermissionPredicateGroupDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate-group.dto';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+import { WorkspaceMigrationBuilderExceptionV2 } from 'src/engine/workspace-manager/workspace-migration-v2/exceptions/workspace-migration-builder-exception-v2';
+import { WorkspaceMigrationValidateBuildAndRunService } from 'src/engine/workspace-manager/workspace-migration-v2/services/workspace-migration-validate-build-and-run-service';
+
+const RLP_CACHE_KEYS = [
+  'flatRowLevelPermissionPredicateMaps',
+  'flatRowLevelPermissionPredicateGroupMaps',
+] as const;
+
+@Injectable()
+export class RowLevelPermissionPredicateGroupService {
+  constructor(
+    private readonly workspaceMigrationValidateBuildAndRunService: WorkspaceMigrationValidateBuildAndRunService,
+    private readonly flatEntityMapsCacheService: WorkspaceManyOrAllFlatEntityMapsCacheService,
+  ) {}
+
+  async createOne({
+    createRowLevelPermissionPredicateGroupInput,
+    workspaceId,
+  }: {
+    createRowLevelPermissionPredicateGroupInput: CreateRowLevelPermissionPredicateGroupInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateGroupDTO> {
+    const flatGroupToCreate =
+      fromCreateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToCreate(
+        {
+          createRowLevelPermissionPredicateGroupInput,
+          workspaceId,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToCreate: [flatGroupToCreate],
+    });
+
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateGroupToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatGroupToCreate.id,
+        flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+      }),
+    );
+  }
+
+  async updateOne({
+    updateRowLevelPermissionPredicateGroupInput,
+    workspaceId,
+  }: {
+    updateRowLevelPermissionPredicateGroupInput: UpdateRowLevelPermissionPredicateGroupInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateGroupDTO> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    const flatGroupToUpdate =
+      fromUpdateRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupToUpdateOrThrow(
+        {
+          flatRowLevelPermissionPredicateGroupMaps,
+          updateRowLevelPermissionPredicateGroupInput,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToUpdate: [flatGroupToUpdate],
+    });
+
+    const { flatRowLevelPermissionPredicateGroupMaps: recomputedFlatMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateGroupToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatGroupToUpdate.id,
+        flatEntityMaps: recomputedFlatMaps,
+      }),
+    );
+  }
+
+  async deleteOne({
+    deleteRowLevelPermissionPredicateGroupInput,
+    workspaceId,
+  }: {
+    deleteRowLevelPermissionPredicateGroupInput: DeleteRowLevelPermissionPredicateGroupInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateGroupDTO> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    const flatGroupWithDeletedAt =
+      fromDeleteRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow(
+        {
+          deleteRowLevelPermissionPredicateGroupInput,
+          flatRowLevelPermissionPredicateGroupMaps,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToUpdate: [flatGroupWithDeletedAt],
+    });
+
+    const { flatRowLevelPermissionPredicateGroupMaps: recomputedFlatMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateGroupToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatGroupWithDeletedAt.id,
+        flatEntityMaps: recomputedFlatMaps,
+      }),
+    );
+  }
+
+  async destroyOne({
+    destroyRowLevelPermissionPredicateGroupInput,
+    workspaceId,
+  }: {
+    destroyRowLevelPermissionPredicateGroupInput: DestroyRowLevelPermissionPredicateGroupInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateGroupDTO> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    const flatGroupToDelete =
+      fromDestroyRowLevelPermissionPredicateGroupInputToFlatRowLevelPermissionPredicateGroupOrThrow(
+        {
+          destroyRowLevelPermissionPredicateGroupInput,
+          flatRowLevelPermissionPredicateGroupMaps,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToDelete: [flatGroupToDelete],
+    });
+
+    return fromFlatRowLevelPermissionPredicateGroupToDto(flatGroupToDelete);
+  }
+
+  async findByWorkspaceId(
+    workspaceId: string,
+  ): Promise<RowLevelPermissionPredicateGroupDTO[]> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    return Object.values(flatRowLevelPermissionPredicateGroupMaps.byId)
+      .filter(isDefined)
+      .filter((group) => group.deletedAt === null)
+      .sort(
+        (a, b) =>
+          (a.positionInRowLevelPermissionPredicateGroup ?? 0) -
+          (b.positionInRowLevelPermissionPredicateGroup ?? 0),
+      )
+      .map(fromFlatRowLevelPermissionPredicateGroupToDto);
+  }
+
+  async findByRole(
+    workspaceId: string,
+    roleId: string,
+  ): Promise<RowLevelPermissionPredicateGroupDTO[]> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    return Object.values(flatRowLevelPermissionPredicateGroupMaps.byId)
+      .filter(isDefined)
+      .filter((group) => group.deletedAt === null && group.roleId === roleId)
+      .sort(
+        (a, b) =>
+          (a.positionInRowLevelPermissionPredicateGroup ?? 0) -
+          (b.positionInRowLevelPermissionPredicateGroup ?? 0),
+      )
+      .map(fromFlatRowLevelPermissionPredicateGroupToDto);
+  }
+
+  async findById(
+    id: string,
+    workspaceId: string,
+  ): Promise<RowLevelPermissionPredicateGroupDTO | null> {
+    const { flatRowLevelPermissionPredicateGroupMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateGroupMaps'],
+        },
+      );
+
+    const flatGroup = findFlatEntityByIdInFlatEntityMaps({
+      flatEntityId: id,
+      flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+    });
+
+    if (!isDefined(flatGroup) || flatGroup.deletedAt !== null) {
+      return null;
+    }
+
+    return fromFlatRowLevelPermissionPredicateGroupToDto(flatGroup);
+  }
+
+  private async runMigration({
+    workspaceId,
+    flatEntityToCreate = [],
+    flatEntityToUpdate = [],
+    flatEntityToDelete = [],
+  }: {
+    workspaceId: string;
+    flatEntityToCreate?: FlatRowLevelPermissionPredicateGroup[];
+    flatEntityToUpdate?: FlatRowLevelPermissionPredicateGroup[];
+    flatEntityToDelete?: FlatRowLevelPermissionPredicateGroup[];
+  }): Promise<void> {
+    const validateAndBuildResult =
+      await this.workspaceMigrationValidateBuildAndRunService.validateBuildAndRunWorkspaceMigration(
+        {
+          allFlatEntityOperationByMetadataName: {
+            rowLevelPermissionPredicateGroup: {
+              flatEntityToCreate,
+              flatEntityToDelete,
+              flatEntityToUpdate,
+            },
+          },
+          workspaceId,
+          isSystemBuild: false,
+        },
+      );
+
+    if (isDefined(validateAndBuildResult)) {
+      throw new WorkspaceMigrationBuilderExceptionV2(
+        validateAndBuildResult,
+        'Validation errors occurred while applying row level permission predicate group mutation',
+      );
+    }
+
+    await this.flatEntityMapsCacheService.invalidateFlatEntityMaps({
+      workspaceId,
+      flatMapsKeys: [...RLP_CACHE_KEYS],
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/services/row-level-permission-predicate.service.ts

@@ -0,0 +1,304 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { isDefined } from 'twenty-shared/utils';
+
+import { WorkspaceManyOrAllFlatEntityMapsCacheService } from 'src/engine/metadata-modules/flat-entity/services/workspace-many-or-all-flat-entity-maps-cache.service';
+import { findFlatEntityByIdInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps-or-throw.util';
+import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
+import { fromCreateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToCreate } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-create-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-to-create.util';
+import { fromDeleteRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-delete-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-or-throw.util';
+import { fromDestroyRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-destroy-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-or-throw.util';
+import { fromFlatRowLevelPermissionPredicateToDto } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-flat-row-level-permission-predicate-to-dto.util';
+import { fromUpdateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToUpdateOrThrow } from 'src/engine/metadata-modules/flat-row-level-permission-predicate/utils/from-update-row-level-permission-predicate-input-to-flat-row-level-permission-predicate-to-update-or-throw.util';
+import { type CreateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/create-row-level-permission-predicate.input';
+import { type DeleteRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/delete-row-level-permission-predicate.input';
+import { type DestroyRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/destroy-row-level-permission-predicate.input';
+import { type UpdateRowLevelPermissionPredicateInput } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/inputs/update-row-level-permission-predicate.input';
+import { RowLevelPermissionPredicateDTO } from 'src/engine/metadata-modules/row-level-permission-predicate/dtos/row-level-permission-predicate.dto';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+import { WorkspaceMigrationBuilderExceptionV2 } from 'src/engine/workspace-manager/workspace-migration-v2/exceptions/workspace-migration-builder-exception-v2';
+import { WorkspaceMigrationValidateBuildAndRunService } from 'src/engine/workspace-manager/workspace-migration-v2/services/workspace-migration-validate-build-and-run-service';
+
+const RLP_CACHE_KEYS = [
+  'flatRowLevelPermissionPredicateMaps',
+  'flatRowLevelPermissionPredicateGroupMaps',
+] as const;
+
+@Injectable()
+export class RowLevelPermissionPredicateService {
+  constructor(
+    private readonly workspaceMigrationValidateBuildAndRunService: WorkspaceMigrationValidateBuildAndRunService,
+    private readonly flatEntityMapsCacheService: WorkspaceManyOrAllFlatEntityMapsCacheService,
+  ) {}
+
+  async createOne({
+    createRowLevelPermissionPredicateInput,
+    workspaceId,
+  }: {
+    createRowLevelPermissionPredicateInput: CreateRowLevelPermissionPredicateInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateDTO> {
+    const flatPredicateToCreate =
+      fromCreateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToCreate(
+        {
+          createRowLevelPermissionPredicateInput,
+          workspaceId,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToCreate: [flatPredicateToCreate],
+    });
+
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatPredicateToCreate.id,
+        flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+      }),
+    );
+  }
+
+  async updateOne({
+    updateRowLevelPermissionPredicateInput,
+    workspaceId,
+  }: {
+    updateRowLevelPermissionPredicateInput: UpdateRowLevelPermissionPredicateInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateDTO> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    const flatPredicateToUpdate =
+      fromUpdateRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateToUpdateOrThrow(
+        {
+          flatRowLevelPermissionPredicateMaps,
+          updateRowLevelPermissionPredicateInput,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToUpdate: [flatPredicateToUpdate],
+    });
+
+    const { flatRowLevelPermissionPredicateMaps: recomputedFlatMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatPredicateToUpdate.id,
+        flatEntityMaps: recomputedFlatMaps,
+      }),
+    );
+  }
+
+  async deleteOne({
+    deleteRowLevelPermissionPredicateInput,
+    workspaceId,
+  }: {
+    deleteRowLevelPermissionPredicateInput: DeleteRowLevelPermissionPredicateInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateDTO> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    const flatPredicateWithDeletedAt =
+      fromDeleteRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow(
+        {
+          deleteRowLevelPermissionPredicateInput,
+          flatRowLevelPermissionPredicateMaps,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToUpdate: [flatPredicateWithDeletedAt],
+    });
+
+    const { flatRowLevelPermissionPredicateMaps: recomputedFlatMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    return fromFlatRowLevelPermissionPredicateToDto(
+      findFlatEntityByIdInFlatEntityMapsOrThrow({
+        flatEntityId: flatPredicateWithDeletedAt.id,
+        flatEntityMaps: recomputedFlatMaps,
+      }),
+    );
+  }
+
+  async destroyOne({
+    destroyRowLevelPermissionPredicateInput,
+    workspaceId,
+  }: {
+    destroyRowLevelPermissionPredicateInput: DestroyRowLevelPermissionPredicateInput;
+    workspaceId: string;
+  }): Promise<RowLevelPermissionPredicateDTO> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    const flatPredicateToDelete =
+      fromDestroyRowLevelPermissionPredicateInputToFlatRowLevelPermissionPredicateOrThrow(
+        {
+          destroyRowLevelPermissionPredicateInput,
+          flatRowLevelPermissionPredicateMaps,
+        },
+      );
+
+    await this.runMigration({
+      workspaceId,
+      flatEntityToDelete: [flatPredicateToDelete],
+    });
+
+    return fromFlatRowLevelPermissionPredicateToDto(flatPredicateToDelete);
+  }
+
+  async findByWorkspaceId(
+    workspaceId: string,
+  ): Promise<RowLevelPermissionPredicateDTO[]> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    return Object.values(flatRowLevelPermissionPredicateMaps.byId)
+      .filter(isDefined)
+      .filter((predicate) => predicate.deletedAt === null)
+      .sort(
+        (a, b) =>
+          (a.positionInRowLevelPermissionPredicateGroup ?? 0) -
+          (b.positionInRowLevelPermissionPredicateGroup ?? 0),
+      )
+      .map(fromFlatRowLevelPermissionPredicateToDto);
+  }
+
+  async findByRoleAndObject(
+    workspaceId: string,
+    roleId: string,
+    objectMetadataId: string,
+  ): Promise<RowLevelPermissionPredicateDTO[]> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    return Object.values(flatRowLevelPermissionPredicateMaps.byId)
+      .filter(isDefined)
+      .filter(
+        (predicate) =>
+          predicate.deletedAt === null &&
+          predicate.roleId === roleId &&
+          predicate.objectMetadataId === objectMetadataId,
+      )
+      .sort(
+        (a, b) =>
+          (a.positionInRowLevelPermissionPredicateGroup ?? 0) -
+          (b.positionInRowLevelPermissionPredicateGroup ?? 0),
+      )
+      .map(fromFlatRowLevelPermissionPredicateToDto);
+  }
+
+  async findById(
+    id: string,
+    workspaceId: string,
+  ): Promise<RowLevelPermissionPredicateDTO | null> {
+    const { flatRowLevelPermissionPredicateMaps } =
+      await this.flatEntityMapsCacheService.getOrRecomputeManyOrAllFlatEntityMaps(
+        {
+          workspaceId,
+          flatMapsKeys: ['flatRowLevelPermissionPredicateMaps'],
+        },
+      );
+
+    const flatPredicate = findFlatEntityByIdInFlatEntityMaps({
+      flatEntityId: id,
+      flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+    });
+
+    if (!isDefined(flatPredicate) || flatPredicate.deletedAt !== null) {
+      return null;
+    }
+
+    return fromFlatRowLevelPermissionPredicateToDto(flatPredicate);
+  }
+
+  private async runMigration({
+    workspaceId,
+    flatEntityToCreate = [],
+    flatEntityToUpdate = [],
+    flatEntityToDelete = [],
+  }: {
+    workspaceId: string;
+    flatEntityToCreate?: FlatRowLevelPermissionPredicate[];
+    flatEntityToUpdate?: FlatRowLevelPermissionPredicate[];
+    flatEntityToDelete?: FlatRowLevelPermissionPredicate[];
+  }): Promise<void> {
+    const validateAndBuildResult =
+      await this.workspaceMigrationValidateBuildAndRunService.validateBuildAndRunWorkspaceMigration(
+        {
+          allFlatEntityOperationByMetadataName: {
+            rowLevelPermissionPredicate: {
+              flatEntityToCreate,
+              flatEntityToDelete,
+              flatEntityToUpdate,
+            },
+          },
+          workspaceId,
+          isSystemBuild: false,
+        },
+      );
+
+    if (isDefined(validateAndBuildResult)) {
+      throw new WorkspaceMigrationBuilderExceptionV2(
+        validateAndBuildResult,
+        'Validation errors occurred while applying row level permission predicate mutation',
+      );
+    }
+
+    await this.flatEntityMapsCacheService.invalidateFlatEntityMaps({
+      workspaceId,
+      flatMapsKeys: [...RLP_CACHE_KEYS],
+    });
+  }
+}

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group-maps.type.ts

@@ -0,0 +1,7 @@
+/* @license Enterprise */
+
+import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export type FlatRowLevelPermissionPredicateGroupMaps =
+  FlatEntityMaps<FlatRowLevelPermissionPredicateGroup>;

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type.ts

@@ -0,0 +1,10 @@
+/* @license Enterprise */
+
+import { type FlatEntityFrom } from 'src/engine/metadata-modules/flat-entity/types/flat-entity.type';
+import { type RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+
+export type FlatRowLevelPermissionPredicateGroup =
+  FlatEntityFrom<RowLevelPermissionPredicateGroupEntity> & {
+    childRowLevelPermissionPredicateGroupIds: string[];
+    rowLevelPermissionPredicateIds: string[];
+  };

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-maps.type.ts

@@ -0,0 +1,7 @@
+/* @license Enterprise */
+
+import { type FlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-maps.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export type FlatRowLevelPermissionPredicateMaps =
+  FlatEntityMaps<FlatRowLevelPermissionPredicate>;

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type.ts

@@ -0,0 +1,7 @@
+/* @license Enterprise */
+
+import { type FlatEntityFrom } from 'src/engine/metadata-modules/flat-entity/types/flat-entity.type';
+import { type RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+
+export type FlatRowLevelPermissionPredicate =
+  FlatEntityFrom<RowLevelPermissionPredicateEntity>;

packages/twenty-server/src/engine/metadata-modules/row-level-permission-predicate/types/row-level-permission-predicate-value.type.ts

@@ -0,0 +1,16 @@
+/* @license Enterprise */
+
+export type RelationPredicateValue = {
+  isCurrentWorkspaceMemberSelected?: boolean;
+  selectedRecordIds: string[];
+};
+
+export type RowLevelPermissionPredicateValue =
+  | string
+  | string[]
+  | boolean
+  | number
+  | RelationPredicateValue
+  | Record<string, unknown>
+  | null
+  | undefined;