Row level permissions - POC 1 (#16599)

## Context
This PR adds the core structure for RLS implementation:
- RLS data model
- RLS service layer
- RLS WorkspaceMigration and Syncable Entity + cache + Validations
- RLS resolver layer
- ORM layer with RLS Predicate to ORM WHERE clause conversion with
workspaceMember record transposition

Tests are missing though

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Establishes core row-level permissions infrastructure and enforcement
across the stack.
> 
> - Backend: new `rowLevelPermissionPredicate` and
`rowLevelPermissionPredicateGroup` entities, TypeORM migration, feature
flag `IS_ROW_LEVEL_PERMISSION_PREDICATES_ENABLED`, flat-entity
maps/cache wiring, services and GraphQL resolvers for CRUD, and
inclusion of `workspaceMember` in auth context
> - ORM: applies row-level permission predicates to SELECT, DELETE, and
SOFT DELETE query builders; propagates context through
GlobalWorkspaceOrmManager/EntityManager
> - GraphQL: generated schema/types/queries/mutations for
creating/updating/deleting/fetching predicates and groups
> - Frontend: settings page adds a gated "Record-level" section
(placeholder) and metadata error handler labels for new entities
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
fe955cc4588a92157afa6795fb574189a4be1e93. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Félix Malfait <felix.malfait@gmail.com>

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/interceptors/utils/from-workspace-migration-builder-exception-to-metadata-validation-response-error.util.ts

@@ -35,6 +35,8 @@ export const fromWorkspaceMigrationBuilderExceptionToMetadataValidationResponseE
         invalidPageLayoutWidget: 0,
         totalErrors: 0,
         invalidPageLayoutTab: 0,
+        invalidRowLevelPermissionPredicate: 0,
+        invalidRowLevelPermissionPredicateGroup: 0,
       },
       errors: translatedReport,
     };

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/services/workspace-migration-build-orchestrator.service.ts

@@ -26,6 +26,8 @@ import { WorkspaceMigrationV2PageLayoutActionsBuilderService } from 'src/engine/
 import { WorkspaceMigrationV2RoleTargetActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/role-target/workspace-migration-v2-role-target-actions-builder.service';
 import { WorkspaceMigrationV2RoleActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/role/workspace-migration-v2-role-actions-builder.service';
 import { WorkspaceMigrationV2RouteTriggerActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/route-trigger/workspace-migration-v2-route-trigger-actions-builder.service';
+import { WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/workspace-migration-v2-row-level-permission-predicate-group-actions-builder.service';
+import { WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/workspace-migration-v2-row-level-permission-predicate-actions-builder.service';
 import { WorkspaceMigrationV2ServerlessFunctionActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/serverless-function/workspace-migration-v2-serverless-function-actions-builder.service';
 import { WorkspaceMigrationV2ViewFieldActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/view-field/workspace-migration-v2-view-field-actions-builder.service';
 import { WorkspaceMigrationV2ViewFilterActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/view-filter/workspace-migration-v2-view-filter-actions-builder.service';
@@ -52,6 +54,8 @@ export class WorkspaceMigrationBuildOrchestratorService {
     private readonly workspaceMigrationV2PageLayoutActionsBuilderService: WorkspaceMigrationV2PageLayoutActionsBuilderService,
     private readonly workspaceMigrationV2PageLayoutWidgetActionsBuilderService: WorkspaceMigrationV2PageLayoutWidgetActionsBuilderService,
     private readonly workspaceMigrationV2PageLayoutTabActionsBuilderService: WorkspaceMigrationV2PageLayoutTabActionsBuilderService,
+    private readonly workspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService: WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService,
+    private readonly workspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService: WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService,
   ) {}
 
   private setupOptimisticCache({
@@ -141,6 +145,8 @@ export class WorkspaceMigrationBuildOrchestratorService {
       flatFieldMetadataMaps,
       flatViewFilterMaps,
       flatViewGroupMaps,
+      flatRowLevelPermissionPredicateMaps,
+      flatRowLevelPermissionPredicateGroupMaps,
       flatRoleMaps,
       flatRoleTargetMaps,
       flatAgentMaps,
@@ -409,6 +415,86 @@ export class WorkspaceMigrationBuildOrchestratorService {
       }
     }
 
+    if (isDefined(flatRowLevelPermissionPredicateGroupMaps)) {
+      const {
+        from: fromFlatRowLevelPermissionPredicateGroupMaps,
+        to: toFlatRowLevelPermissionPredicateGroupMaps,
+      } = flatRowLevelPermissionPredicateGroupMaps;
+      const rowLevelPermissionPredicateGroupResult =
+        await this.workspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService.validateAndBuild(
+          {
+            additionalCacheDataMaps,
+            from: fromFlatRowLevelPermissionPredicateGroupMaps,
+            to: toFlatRowLevelPermissionPredicateGroupMaps,
+            buildOptions,
+            dependencyOptimisticFlatEntityMaps: {
+              flatRoleMaps: optimisticAllFlatEntityMaps.flatRoleMaps,
+            },
+            workspaceId,
+          },
+        );
+
+      this.mergeFlatEntityMapsAndRelatedFlatEntityMapsInAllFlatEntityMapsThroughMutation(
+        {
+          allFlatEntityMaps: optimisticAllFlatEntityMaps,
+          flatEntityMapsAndRelatedFlatEntityMaps:
+            rowLevelPermissionPredicateGroupResult.optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+        },
+      );
+
+      if (rowLevelPermissionPredicateGroupResult.status === 'fail') {
+        orchestratorFailureReport.rowLevelPermissionPredicateGroup.push(
+          ...rowLevelPermissionPredicateGroupResult.errors,
+        );
+      } else {
+        orchestratorActionsReport.rowLevelPermissionPredicateGroup =
+          rowLevelPermissionPredicateGroupResult.actions;
+      }
+    }
+
+    if (isDefined(flatRowLevelPermissionPredicateMaps)) {
+      const {
+        from: fromFlatRowLevelPermissionPredicateMaps,
+        to: toFlatRowLevelPermissionPredicateMaps,
+      } = flatRowLevelPermissionPredicateMaps;
+      const rowLevelPermissionPredicateResult =
+        await this.workspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService.validateAndBuild(
+          {
+            additionalCacheDataMaps,
+            from: fromFlatRowLevelPermissionPredicateMaps,
+            to: toFlatRowLevelPermissionPredicateMaps,
+            buildOptions,
+            dependencyOptimisticFlatEntityMaps: {
+              flatFieldMetadataMaps:
+                optimisticAllFlatEntityMaps.flatFieldMetadataMaps,
+              flatObjectMetadataMaps:
+                optimisticAllFlatEntityMaps.flatObjectMetadataMaps,
+              flatRowLevelPermissionPredicateGroupMaps:
+                optimisticAllFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps,
+              flatRoleMaps: optimisticAllFlatEntityMaps.flatRoleMaps,
+            },
+            workspaceId,
+          },
+        );
+
+      this.mergeFlatEntityMapsAndRelatedFlatEntityMapsInAllFlatEntityMapsThroughMutation(
+        {
+          allFlatEntityMaps: optimisticAllFlatEntityMaps,
+          flatEntityMapsAndRelatedFlatEntityMaps:
+            rowLevelPermissionPredicateResult.optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+        },
+      );
+
+      if (rowLevelPermissionPredicateResult.status === 'fail') {
+        orchestratorFailureReport.rowLevelPermissionPredicate.push(
+          ...rowLevelPermissionPredicateResult.errors,
+        );
+      } else {
+        orchestratorActionsReport.rowLevelPermissionPredicate =
+          rowLevelPermissionPredicateResult.actions;
+      }
+    }
+
     if (isDefined(flatServerlessFunctionMaps)) {
       const {
         from: fromFlatServerlessFunctionMaps,
@@ -871,6 +957,24 @@ export class WorkspaceMigrationBuildOrchestratorService {
           ...aggregatedOrchestratorActionsReport.pageLayoutWidget.created,
           ...aggregatedOrchestratorActionsReport.pageLayoutWidget.updated,
           ///
+
+          // Row level permission predicates
+          ...aggregatedOrchestratorActionsReport.rowLevelPermissionPredicate
+            .deleted,
+          ...aggregatedOrchestratorActionsReport.rowLevelPermissionPredicate
+            .created,
+          ...aggregatedOrchestratorActionsReport.rowLevelPermissionPredicate
+            .updated,
+          ///
+
+          // Row level permission predicate groups
+          ...aggregatedOrchestratorActionsReport
+            .rowLevelPermissionPredicateGroup.deleted,
+          ...aggregatedOrchestratorActionsReport
+            .rowLevelPermissionPredicateGroup.created,
+          ...aggregatedOrchestratorActionsReport
+            .rowLevelPermissionPredicateGroup.updated,
+          ///
         ],
         workspaceId,
       },

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type.ts

@@ -0,0 +1,28 @@
+/* @license Enterprise */
+
+import { type FlatEntityPropertiesUpdates } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-properties-updates.type';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+
+export type CreateRowLevelPermissionPredicateGroupAction = {
+  type: 'create_row_level_permission_predicate_group';
+  rowLevelPermissionPredicateGroup: FlatRowLevelPermissionPredicateGroup;
+};
+
+export type UpdateRowLevelPermissionPredicateGroupAction = {
+  type: 'update_row_level_permission_predicate_group';
+  rowLevelPermissionPredicateGroupId: string;
+  updates: FlatEntityPropertiesUpdates<'rowLevelPermissionPredicateGroup'>;
+};
+
+export type DeleteRowLevelPermissionPredicateGroupAction = {
+  type: 'delete_row_level_permission_predicate_group';
+  rowLevelPermissionPredicateGroupId: string;
+};
+
+export type WorkspaceMigrationRowLevelPermissionPredicateGroupActionV2 =
+  | CreateRowLevelPermissionPredicateGroupAction
+  | UpdateRowLevelPermissionPredicateGroupAction
+  | DeleteRowLevelPermissionPredicateGroupAction;
+
+export type WorkspaceMigrationRowLevelPermissionPredicateGroupActionTypeV2 =
+  WorkspaceMigrationRowLevelPermissionPredicateGroupActionV2['type'];

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/workspace-migration-v2-row-level-permission-predicate-group-actions-builder.service.ts

@@ -0,0 +1,121 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { ALL_METADATA_NAME } from 'twenty-shared/metadata';
+
+import { UpdateRowLevelPermissionPredicateGroupAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type';
+import { WorkspaceEntityMigrationBuilderV2Service } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/services/workspace-entity-migration-builder-v2.service';
+import { FlatEntityUpdateValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-update-validation-args.type';
+import { FlatEntityValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-args.type';
+import { FlatEntityValidationReturnType } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-result.type';
+import { FlatRowLevelPermissionPredicateGroupValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-group-validator.service';
+
+@Injectable()
+export class WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService extends WorkspaceEntityMigrationBuilderV2Service<
+  typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+> {
+  constructor(
+    private readonly flatRowLevelPermissionPredicateGroupValidatorService: FlatRowLevelPermissionPredicateGroupValidatorService,
+  ) {
+    super(ALL_METADATA_NAME.rowLevelPermissionPredicateGroup);
+  }
+
+  protected validateFlatEntityCreation(
+    args: FlatEntityValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup,
+    'created'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateGroupValidatorService.validateFlatRowLevelPermissionPredicateGroupCreation(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const { flatEntityToValidate } = args;
+
+    return {
+      status: 'success',
+      action: {
+        type: 'create_row_level_permission_predicate_group',
+        rowLevelPermissionPredicateGroup: flatEntityToValidate,
+      },
+    };
+  }
+
+  protected validateFlatEntityDeletion(
+    args: FlatEntityValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup,
+    'deleted'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateGroupValidatorService.validateFlatRowLevelPermissionPredicateGroupDeletion(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const {
+      flatEntityToValidate: { id: predicateGroupId },
+    } = args;
+
+    return {
+      status: 'success',
+      action: {
+        type: 'delete_row_level_permission_predicate_group',
+        rowLevelPermissionPredicateGroupId: predicateGroupId,
+      },
+    };
+  }
+
+  protected validateFlatEntityUpdate(
+    args: FlatEntityUpdateValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup,
+    'updated'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateGroupValidatorService.validateFlatRowLevelPermissionPredicateGroupUpdate(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const { flatEntityId, flatEntityUpdates } = args;
+
+    const updateAction: UpdateRowLevelPermissionPredicateGroupAction = {
+      type: 'update_row_level_permission_predicate_group',
+      rowLevelPermissionPredicateGroupId: flatEntityId,
+      updates: flatEntityUpdates,
+    };
+
+    return {
+      status: 'success',
+      action: updateAction,
+    };
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type.ts

@@ -0,0 +1,34 @@
+/* @license Enterprise */
+
+import { type FlatEntityPropertiesUpdates } from 'src/engine/metadata-modules/flat-entity/types/flat-entity-properties-updates.type';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+
+export type CreateRowLevelPermissionPredicateAction = {
+  type: 'create_row_level_permission_predicate';
+  rowLevelPermissionPredicate: FlatRowLevelPermissionPredicate;
+};
+
+export type UpdateRowLevelPermissionPredicateAction = {
+  type: 'update_row_level_permission_predicate';
+  rowLevelPermissionPredicateId: string;
+  updates: FlatEntityPropertiesUpdates<'rowLevelPermissionPredicate'>;
+};
+
+export type DeleteRowLevelPermissionPredicateAction = {
+  type: 'delete_row_level_permission_predicate';
+  rowLevelPermissionPredicateId: string;
+};
+
+export type DestroyRowLevelPermissionPredicateAction = {
+  type: 'destroy_row_level_permission_predicate';
+  rowLevelPermissionPredicateId: string;
+};
+
+export type WorkspaceMigrationRowLevelPermissionPredicateActionV2 =
+  | CreateRowLevelPermissionPredicateAction
+  | UpdateRowLevelPermissionPredicateAction
+  | DeleteRowLevelPermissionPredicateAction
+  | DestroyRowLevelPermissionPredicateAction;
+
+export type WorkspaceMigrationRowLevelPermissionPredicateActionTypeV2 =
+  WorkspaceMigrationRowLevelPermissionPredicateActionV2['type'];

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/workspace-migration-v2-row-level-permission-predicate-actions-builder.service.ts

@@ -0,0 +1,121 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { ALL_METADATA_NAME } from 'twenty-shared/metadata';
+
+import { UpdateRowLevelPermissionPredicateAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type';
+import { WorkspaceEntityMigrationBuilderV2Service } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/services/workspace-entity-migration-builder-v2.service';
+import { FlatEntityUpdateValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-update-validation-args.type';
+import { FlatEntityValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-args.type';
+import { FlatEntityValidationReturnType } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-result.type';
+import { FlatRowLevelPermissionPredicateValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-validator.service';
+
+@Injectable()
+export class WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService extends WorkspaceEntityMigrationBuilderV2Service<
+  typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+> {
+  constructor(
+    private readonly flatRowLevelPermissionPredicateValidatorService: FlatRowLevelPermissionPredicateValidatorService,
+  ) {
+    super(ALL_METADATA_NAME.rowLevelPermissionPredicate);
+  }
+
+  protected validateFlatEntityCreation(
+    args: FlatEntityValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate,
+    'created'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateValidatorService.validateFlatRowLevelPermissionPredicateCreation(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const { flatEntityToValidate } = args;
+
+    return {
+      status: 'success',
+      action: {
+        type: 'create_row_level_permission_predicate',
+        rowLevelPermissionPredicate: flatEntityToValidate,
+      },
+    };
+  }
+
+  protected validateFlatEntityDeletion(
+    args: FlatEntityValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate,
+    'deleted'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateValidatorService.validateFlatRowLevelPermissionPredicateDeletion(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const {
+      flatEntityToValidate: { id: predicateId },
+    } = args;
+
+    return {
+      status: 'success',
+      action: {
+        type: 'delete_row_level_permission_predicate',
+        rowLevelPermissionPredicateId: predicateId,
+      },
+    };
+  }
+
+  protected validateFlatEntityUpdate(
+    args: FlatEntityUpdateValidationArgs<
+      typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+    >,
+  ): FlatEntityValidationReturnType<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate,
+    'updated'
+  > {
+    const validationResult =
+      this.flatRowLevelPermissionPredicateValidatorService.validateFlatRowLevelPermissionPredicateUpdate(
+        args,
+      );
+
+    if (validationResult.errors.length > 0) {
+      return {
+        status: 'fail',
+        ...validationResult,
+      };
+    }
+
+    const { flatEntityId, flatEntityUpdates } = args;
+
+    const updateAction: UpdateRowLevelPermissionPredicateAction = {
+      type: 'update_row_level_permission_predicate',
+      rowLevelPermissionPredicateId: flatEntityId,
+      updates: flatEntityUpdates,
+    };
+
+    return {
+      status: 'success',
+      action: updateAction,
+    };
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-group-validator.service.ts

@@ -0,0 +1,209 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { msg, t } from '@lingui/core/macro';
+import { ALL_METADATA_NAME } from 'twenty-shared/metadata';
+import { isDefined } from 'twenty-shared/utils';
+
+import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
+import { RowLevelPermissionPredicateGroupExceptionCode } from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate-group.exception';
+import { type FlatRowLevelPermissionPredicateGroup } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate-group.type';
+import { FailedFlatEntityValidation } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/types/failed-flat-entity-validation.type';
+import { FlatEntityUpdateValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-update-validation-args.type';
+import { FlatEntityValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-args.type';
+import { fromFlatEntityPropertiesUpdatesToPartialFlatEntity } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/utils/from-flat-entity-properties-updates-to-partial-flat-entity';
+
+@Injectable()
+export class FlatRowLevelPermissionPredicateGroupValidatorService {
+  validateFlatRowLevelPermissionPredicateGroupCreation({
+    flatEntityToValidate: flatPredicateGroupToValidate,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> {
+    const {
+      flatRowLevelPermissionPredicateGroupMaps:
+        optimisticFlatPredicateGroupMaps,
+      flatRoleMaps,
+    } = optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+      flatRowLevelPermissionPredicateGroupMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps;
+      flatRoleMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRoleMaps;
+    }>;
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> =
+      {
+        type: 'create_row_level_permission_predicate_group',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatPredicateGroupToValidate.id,
+        },
+      };
+
+    const existingPredicateGroup =
+      optimisticFlatPredicateGroupMaps?.byId[flatPredicateGroupToValidate.id];
+
+    if (isDefined(existingPredicateGroup)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateGroupExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA,
+        message: t`Row level permission predicate group with this id already exists`,
+        userFriendlyMessage: msg`Row level permission predicate group with this id already exists`,
+      });
+    }
+
+    if (
+      isDefined(
+        flatPredicateGroupToValidate.parentRowLevelPermissionPredicateGroupId,
+      ) &&
+      optimisticFlatPredicateGroupMaps
+    ) {
+      const parentGroup = findFlatEntityByIdInFlatEntityMaps({
+        flatEntityId:
+          flatPredicateGroupToValidate.parentRowLevelPermissionPredicateGroupId,
+        flatEntityMaps: optimisticFlatPredicateGroupMaps,
+      });
+
+      if (!isDefined(parentGroup)) {
+        validationResult.errors.push({
+          code: RowLevelPermissionPredicateGroupExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA,
+          message: t`Parent row level permission predicate group not found`,
+          userFriendlyMessage: msg`Parent row level permission predicate group not found`,
+        });
+      }
+    }
+
+    const role = flatRoleMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: flatPredicateGroupToValidate.roleId,
+          flatEntityMaps: flatRoleMaps,
+        })
+      : undefined;
+
+    if (!isDefined(role)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateGroupExceptionCode.ROLE_NOT_FOUND,
+        message: t`Role not found`,
+        userFriendlyMessage: msg`Role not found`,
+      });
+    }
+
+    return validationResult;
+  }
+
+  validateFlatRowLevelPermissionPredicateGroupDeletion({
+    flatEntityToValidate: flatPredicateGroupToDelete,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> {
+    const {
+      flatRowLevelPermissionPredicateGroupMaps:
+        optimisticFlatPredicateGroupMaps,
+    } = optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+      flatRowLevelPermissionPredicateGroupMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps;
+    }>;
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> =
+      {
+        type: 'delete_row_level_permission_predicate_group',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatPredicateGroupToDelete.id,
+        },
+      };
+
+    const existingPredicateGroup =
+      optimisticFlatPredicateGroupMaps?.byId[flatPredicateGroupToDelete.id];
+
+    if (!isDefined(existingPredicateGroup)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateGroupExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND,
+        message: t`Row level permission predicate group to delete not found`,
+        userFriendlyMessage: msg`Row level permission predicate group to delete not found`,
+      });
+    }
+
+    return validationResult;
+  }
+
+  validateFlatRowLevelPermissionPredicateGroupUpdate({
+    flatEntityId,
+    flatEntityUpdates,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityUpdateValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicateGroup
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> {
+    const {
+      flatRowLevelPermissionPredicateGroupMaps:
+        optimisticFlatPredicateGroupMaps,
+      flatRoleMaps,
+    } = optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+      flatRowLevelPermissionPredicateGroupMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps;
+      flatRoleMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRoleMaps;
+    }>;
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicateGroup> =
+      {
+        type: 'update_row_level_permission_predicate_group',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatEntityId,
+        },
+      };
+
+    const existingPredicateGroup =
+      optimisticFlatPredicateGroupMaps?.byId[flatEntityId];
+
+    if (!isDefined(existingPredicateGroup)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateGroupExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_GROUP_NOT_FOUND,
+        message: t`Row level permission predicate group to update not found`,
+        userFriendlyMessage: msg`Row level permission predicate group to update not found`,
+      });
+
+      return validationResult;
+    }
+
+    const updatedPredicateGroup = {
+      ...existingPredicateGroup,
+      ...fromFlatEntityPropertiesUpdatesToPartialFlatEntity({
+        updates: flatEntityUpdates,
+      }),
+    };
+
+    if (
+      isDefined(
+        updatedPredicateGroup.parentRowLevelPermissionPredicateGroupId,
+      ) &&
+      optimisticFlatPredicateGroupMaps
+    ) {
+      const parentGroup = findFlatEntityByIdInFlatEntityMaps({
+        flatEntityId:
+          updatedPredicateGroup.parentRowLevelPermissionPredicateGroupId,
+        flatEntityMaps: optimisticFlatPredicateGroupMaps,
+      });
+
+      if (!isDefined(parentGroup)) {
+        validationResult.errors.push({
+          code: RowLevelPermissionPredicateGroupExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_GROUP_DATA,
+          message: t`Parent row level permission predicate group not found`,
+          userFriendlyMessage: msg`Parent row level permission predicate group not found`,
+        });
+      }
+    }
+
+    const role = flatRoleMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: updatedPredicateGroup.roleId,
+          flatEntityMaps: flatRoleMaps,
+        })
+      : undefined;
+
+    if (!isDefined(role)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateGroupExceptionCode.ROLE_NOT_FOUND,
+        message: t`Role not found`,
+        userFriendlyMessage: msg`Role not found`,
+      });
+    }
+
+    return validationResult;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-validator.service.ts

@@ -0,0 +1,272 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import { msg, t } from '@lingui/core/macro';
+import { ALL_METADATA_NAME } from 'twenty-shared/metadata';
+import { isDefined } from 'twenty-shared/utils';
+
+import { findFlatEntityByIdInFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps.util';
+import { RowLevelPermissionPredicateExceptionCode } from 'src/engine/metadata-modules/row-level-permission-predicate/exceptions/row-level-permission-predicate.exception';
+import { type FlatRowLevelPermissionPredicate } from 'src/engine/metadata-modules/row-level-permission-predicate/types/flat-row-level-permission-predicate.type';
+import { FailedFlatEntityValidation } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/types/failed-flat-entity-validation.type';
+import { FlatEntityUpdateValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-update-validation-args.type';
+import { FlatEntityValidationArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/types/flat-entity-validation-args.type';
+import { fromFlatEntityPropertiesUpdatesToPartialFlatEntity } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/utils/from-flat-entity-properties-updates-to-partial-flat-entity';
+
+@Injectable()
+export class FlatRowLevelPermissionPredicateValidatorService {
+  validateFlatRowLevelPermissionPredicateCreation({
+    flatEntityToValidate: flatPredicateToValidate,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> {
+    const {
+      flatRowLevelPermissionPredicateMaps: optimisticFlatPredicateMaps,
+      flatFieldMetadataMaps,
+      flatObjectMetadataMaps,
+      flatRowLevelPermissionPredicateGroupMaps,
+      flatRoleMaps,
+    } = optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+      flatRowLevelPermissionPredicateMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateMaps;
+      flatFieldMetadataMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatFieldMetadataMaps;
+      flatObjectMetadataMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatObjectMetadataMaps;
+      flatRowLevelPermissionPredicateGroupMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps;
+      flatRoleMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRoleMaps;
+    }>;
+
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> =
+      {
+        type: 'create_row_level_permission_predicate',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatPredicateToValidate.id,
+        },
+      };
+
+    const existingPredicate =
+      optimisticFlatPredicateMaps?.byId[flatPredicateToValidate.id];
+
+    if (isDefined(existingPredicate)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA,
+        message: t`Row level permission predicate with this id already exists`,
+        userFriendlyMessage: msg`Row level permission predicate with this id already exists`,
+      });
+    }
+
+    const fieldMetadata = flatFieldMetadataMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: flatPredicateToValidate.fieldMetadataId,
+          flatEntityMaps: flatFieldMetadataMaps,
+        })
+      : undefined;
+
+    if (!isDefined(fieldMetadata)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.FIELD_METADATA_NOT_FOUND,
+        message: t`Field metadata not found`,
+        userFriendlyMessage: msg`Field metadata not found`,
+      });
+    }
+
+    const objectMetadata = flatObjectMetadataMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: flatPredicateToValidate.objectMetadataId,
+          flatEntityMaps: flatObjectMetadataMaps,
+        })
+      : undefined;
+
+    if (!isDefined(objectMetadata)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.OBJECT_METADATA_NOT_FOUND,
+        message: t`Object metadata not found`,
+        userFriendlyMessage: msg`Object metadata not found`,
+      });
+    }
+
+    if (
+      isDefined(flatPredicateToValidate.rowLevelPermissionPredicateGroupId) &&
+      flatRowLevelPermissionPredicateGroupMaps
+    ) {
+      const predicateGroup = findFlatEntityByIdInFlatEntityMaps({
+        flatEntityId:
+          flatPredicateToValidate.rowLevelPermissionPredicateGroupId,
+        flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+      });
+
+      if (!isDefined(predicateGroup)) {
+        validationResult.errors.push({
+          code: RowLevelPermissionPredicateExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA,
+          message: t`Row level permission predicate group not found`,
+          userFriendlyMessage: msg`Row level permission predicate group not found`,
+        });
+      }
+    }
+
+    const role = flatRoleMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: flatPredicateToValidate.roleId,
+          flatEntityMaps: flatRoleMaps,
+        })
+      : undefined;
+
+    if (!isDefined(role)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.ROLE_NOT_FOUND,
+        message: t`Role not found`,
+        userFriendlyMessage: msg`Role not found`,
+      });
+    }
+
+    return validationResult;
+  }
+
+  validateFlatRowLevelPermissionPredicateDeletion({
+    flatEntityToValidate: flatPredicateToDelete,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> {
+    const { flatRowLevelPermissionPredicateMaps: optimisticFlatPredicateMaps } =
+      optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+        flatRowLevelPermissionPredicateMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateMaps;
+      }>;
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> =
+      {
+        type: 'delete_row_level_permission_predicate',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatPredicateToDelete.id,
+        },
+      };
+
+    const existingPredicate =
+      optimisticFlatPredicateMaps?.byId[flatPredicateToDelete.id];
+
+    if (!isDefined(existingPredicate)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND,
+        message: t`Row level permission predicate to delete not found`,
+        userFriendlyMessage: msg`Row level permission predicate to delete not found`,
+      });
+    }
+
+    return validationResult;
+  }
+
+  validateFlatRowLevelPermissionPredicateUpdate({
+    flatEntityId,
+    flatEntityUpdates,
+    optimisticFlatEntityMapsAndRelatedFlatEntityMaps,
+  }: FlatEntityUpdateValidationArgs<
+    typeof ALL_METADATA_NAME.rowLevelPermissionPredicate
+  >): FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> {
+    const {
+      flatRowLevelPermissionPredicateMaps: optimisticFlatPredicateMaps,
+      flatFieldMetadataMaps,
+      flatObjectMetadataMaps,
+      flatRowLevelPermissionPredicateGroupMaps,
+      flatRoleMaps,
+    } = optimisticFlatEntityMapsAndRelatedFlatEntityMaps as Partial<{
+      flatRowLevelPermissionPredicateMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateMaps;
+      flatFieldMetadataMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatFieldMetadataMaps;
+      flatObjectMetadataMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatObjectMetadataMaps;
+      flatRowLevelPermissionPredicateGroupMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRowLevelPermissionPredicateGroupMaps;
+      flatRoleMaps: typeof optimisticFlatEntityMapsAndRelatedFlatEntityMaps.flatRoleMaps;
+    }>;
+    const validationResult: FailedFlatEntityValidation<FlatRowLevelPermissionPredicate> =
+      {
+        type: 'update_row_level_permission_predicate',
+        errors: [],
+        flatEntityMinimalInformation: {
+          id: flatEntityId,
+        },
+      };
+
+    const existingPredicate = optimisticFlatPredicateMaps?.byId[flatEntityId];
+
+    if (!isDefined(existingPredicate)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.ROW_LEVEL_PERMISSION_PREDICATE_NOT_FOUND,
+        message: t`Row level permission predicate to update not found`,
+        userFriendlyMessage: msg`Row level permission predicate to update not found`,
+      });
+
+      return validationResult;
+    }
+
+    const updatedPredicate = {
+      ...existingPredicate,
+      ...fromFlatEntityPropertiesUpdatesToPartialFlatEntity({
+        updates: flatEntityUpdates,
+      }),
+    };
+
+    const fieldMetadata = flatFieldMetadataMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: updatedPredicate.fieldMetadataId,
+          flatEntityMaps: flatFieldMetadataMaps,
+        })
+      : undefined;
+
+    if (!isDefined(fieldMetadata)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.FIELD_METADATA_NOT_FOUND,
+        message: t`Field metadata not found`,
+        userFriendlyMessage: msg`Field metadata not found`,
+      });
+    }
+
+    const objectMetadata = flatObjectMetadataMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: updatedPredicate.objectMetadataId,
+          flatEntityMaps: flatObjectMetadataMaps,
+        })
+      : undefined;
+
+    if (!isDefined(objectMetadata)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.OBJECT_METADATA_NOT_FOUND,
+        message: t`Object metadata not found`,
+        userFriendlyMessage: msg`Object metadata not found`,
+      });
+    }
+
+    if (
+      isDefined(updatedPredicate.rowLevelPermissionPredicateGroupId) &&
+      flatRowLevelPermissionPredicateGroupMaps
+    ) {
+      const predicateGroup = findFlatEntityByIdInFlatEntityMaps({
+        flatEntityId: updatedPredicate.rowLevelPermissionPredicateGroupId,
+        flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+      });
+
+      if (!isDefined(predicateGroup)) {
+        validationResult.errors.push({
+          code: RowLevelPermissionPredicateExceptionCode.INVALID_ROW_LEVEL_PERMISSION_PREDICATE_DATA,
+          message: t`Row level permission predicate group not found`,
+          userFriendlyMessage: msg`Row level permission predicate group not found`,
+        });
+      }
+    }
+
+    const role = flatRoleMaps
+      ? findFlatEntityByIdInFlatEntityMaps({
+          flatEntityId: updatedPredicate.roleId,
+          flatEntityMaps: flatRoleMaps,
+        })
+      : undefined;
+
+    if (!isDefined(role)) {
+      validationResult.errors.push({
+        code: RowLevelPermissionPredicateExceptionCode.ROLE_NOT_FOUND,
+        message: t`Role not found`,
+        userFriendlyMessage: msg`Role not found`,
+      });
+    }
+
+    return validationResult;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/workspace-migration-builder-validators.module.ts

@@ -3,17 +3,19 @@ import { Module } from '@nestjs/common';
 import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
 import { FlatFieldMetadataTypeValidatorService } from 'src/engine/metadata-modules/flat-field-metadata/services/flat-field-metadata-type-validator.service';
 import { FlatAgentValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-agent-validator.service';
-import { FlatPageLayoutValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-page-layout-validator.service';
 import { FlatCronTriggerValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-cron-trigger-validator.service';
 import { FlatDatabaseEventTriggerValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-database-event-trigger-validator.service';
 import { FlatFieldMetadataValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-field-metadata-validator.service';
 import { FlatIndexValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-index-metadata-validator.service';
 import { FlatObjectMetadataValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-object-metadata-validator.service';
 import { FlatPageLayoutTabValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-page-layout-tab-validator.service';
+import { FlatPageLayoutValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-page-layout-validator.service';
 import { FlatPageLayoutWidgetValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-page-layout-widget-validator.service';
 import { FlatRoleTargetValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-role-target-validator.service';
 import { FlatRoleValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-role-validator.service';
 import { FlatRouteTriggerValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-route-trigger-validator.service';
+import { FlatRowLevelPermissionPredicateGroupValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-group-validator.service';
+import { FlatRowLevelPermissionPredicateValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-row-level-permission-predicate-validator.service';
 import { FlatServerlessFunctionValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-serverless-function-validator.service';
 import { FlatViewFieldValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-view-field-validator.service';
 import { FlatViewFilterValidatorService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/validators/services/flat-view-filter-validator.service';
@@ -41,6 +43,8 @@ import { FlatViewValidatorService } from 'src/engine/workspace-manager/workspace
     FlatPageLayoutValidatorService,
     FlatPageLayoutWidgetValidatorService,
     FlatPageLayoutTabValidatorService,
+    FlatRowLevelPermissionPredicateValidatorService,
+    FlatRowLevelPermissionPredicateGroupValidatorService,
   ],
   exports: [
     FlatViewValidatorService,
@@ -61,6 +65,8 @@ import { FlatViewValidatorService } from 'src/engine/workspace-manager/workspace
     FlatPageLayoutValidatorService,
     FlatPageLayoutWidgetValidatorService,
     FlatPageLayoutTabValidatorService,
+    FlatRowLevelPermissionPredicateValidatorService,
+    FlatRowLevelPermissionPredicateGroupValidatorService,
   ],
 })
 export class WorkspaceMigrationBuilderValidatorsModule {}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/workspace-migration-builder-v2.module.ts

@@ -8,12 +8,14 @@ import { WorkspaceMigrationV2DatabaseEventTriggerActionsBuilderService } from 's
 import { WorkspaceMigrationV2FieldActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/field/workspace-migration-v2-field-actions-builder.service';
 import { WorkspaceMigrationV2IndexActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/index/workspace-migration-v2-index-actions-builder.service';
 import { WorkspaceMigrationV2ObjectActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/object/workspace-migration-v2-object-actions-builder.service';
-import { WorkspaceMigrationV2PageLayoutActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout/workspace-migration-v2-page-layout-actions-builder.service';
 import { WorkspaceMigrationV2PageLayoutTabActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout-tab/workspace-migration-v2-page-layout-tab-actions-builder.service';
 import { WorkspaceMigrationV2PageLayoutWidgetActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout-widget/workspace-migration-v2-page-layout-widget-actions-builder.service';
+import { WorkspaceMigrationV2PageLayoutActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/page-layout/workspace-migration-v2-page-layout-actions-builder.service';
 import { WorkspaceMigrationV2RoleTargetActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/role-target/workspace-migration-v2-role-target-actions-builder.service';
 import { WorkspaceMigrationV2RoleActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/role/workspace-migration-v2-role-actions-builder.service';
 import { WorkspaceMigrationV2RouteTriggerActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/route-trigger/workspace-migration-v2-route-trigger-actions-builder.service';
+import { WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/workspace-migration-v2-row-level-permission-predicate-group-actions-builder.service';
+import { WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/workspace-migration-v2-row-level-permission-predicate-actions-builder.service';
 import { WorkspaceMigrationV2ServerlessFunctionActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/serverless-function/workspace-migration-v2-serverless-function-actions-builder.service';
 import { WorkspaceMigrationV2ViewFieldActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/view-field/workspace-migration-v2-view-field-actions-builder.service';
 import { WorkspaceMigrationV2ViewFilterActionsBuilderService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/view-filter/workspace-migration-v2-view-filter-actions-builder.service';
@@ -42,6 +44,8 @@ import { WorkspaceMigrationBuilderValidatorsModule } from 'src/engine/workspace-
     WorkspaceMigrationV2PageLayoutActionsBuilderService,
     WorkspaceMigrationV2PageLayoutWidgetActionsBuilderService,
     WorkspaceMigrationV2PageLayoutTabActionsBuilderService,
+    WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService,
+    WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService,
   ],
   exports: [
     WorkspaceMigrationV2ViewActionsBuilderService,
@@ -61,6 +65,8 @@ import { WorkspaceMigrationBuilderValidatorsModule } from 'src/engine/workspace-
     WorkspaceMigrationV2PageLayoutActionsBuilderService,
     WorkspaceMigrationV2PageLayoutWidgetActionsBuilderService,
     WorkspaceMigrationV2PageLayoutTabActionsBuilderService,
+    WorkspaceMigrationV2RowLevelPermissionPredicateActionsBuilderService,
+    WorkspaceMigrationV2RowLevelPermissionPredicateGroupActionsBuilderService,
     FlatFieldMetadataTypeValidatorService,
   ],
 })

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/create-row-level-permission-predicate-group-action-handler.service.ts

@@ -0,0 +1,59 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { addFlatEntityToFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/add-flat-entity-to-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { CreateRowLevelPermissionPredicateGroupAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+
+@Injectable()
+export class CreateRowLevelPermissionPredicateGroupActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'create_row_level_permission_predicate_group',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<CreateRowLevelPermissionPredicateGroupAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateGroupMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicateGroup } = action;
+
+    const updatedFlatMaps = addFlatEntityToFlatEntityMapsOrThrow({
+      flatEntity: rowLevelPermissionPredicateGroup,
+      flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateGroupMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<CreateRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    const { action, queryRunner, workspaceId } = context;
+    const { rowLevelPermissionPredicateGroup } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateGroupEntity>(
+        RowLevelPermissionPredicateGroupEntity,
+      );
+
+    await repository.insert({
+      ...rowLevelPermissionPredicateGroup,
+      workspaceId,
+    });
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<CreateRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/delete-row-level-permission-predicate-group-action-handler.service.ts

@@ -0,0 +1,59 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { deleteFlatEntityFromFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/delete-flat-entity-from-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { DeleteRowLevelPermissionPredicateGroupAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+
+@Injectable()
+export class DeleteRowLevelPermissionPredicateGroupActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'delete_row_level_permission_predicate_group',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<DeleteRowLevelPermissionPredicateGroupAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateGroupMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicateGroupId } = action;
+
+    const updatedFlatMaps = deleteFlatEntityFromFlatEntityMapsOrThrow({
+      entityToDeleteId: rowLevelPermissionPredicateGroupId,
+      flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateGroupMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<DeleteRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    const { action, queryRunner, workspaceId } = context;
+    const { rowLevelPermissionPredicateGroupId } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateGroupEntity>(
+        RowLevelPermissionPredicateGroupEntity,
+      );
+
+    await repository.delete({
+      id: rowLevelPermissionPredicateGroupId,
+      workspaceId,
+    });
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<DeleteRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/update-row-level-permission-predicate-group-action-handler.service.ts

@@ -0,0 +1,70 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { findFlatEntityByIdInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps-or-throw.util';
+import { replaceFlatEntityInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/replace-flat-entity-in-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateGroupEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate-group.entity';
+import { UpdateRowLevelPermissionPredicateGroupAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate-group/types/workspace-migration-row-level-permission-predicate-group-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+import { fromFlatEntityPropertiesUpdatesToPartialFlatEntity } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/utils/from-flat-entity-properties-updates-to-partial-flat-entity';
+
+@Injectable()
+export class UpdateRowLevelPermissionPredicateGroupActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'update_row_level_permission_predicate_group',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<UpdateRowLevelPermissionPredicateGroupAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateGroupMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicateGroupId } = action;
+
+    const existingGroup = findFlatEntityByIdInFlatEntityMapsOrThrow({
+      flatEntityId: rowLevelPermissionPredicateGroupId,
+      flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+    });
+
+    const updatedGroup = {
+      ...existingGroup,
+      ...fromFlatEntityPropertiesUpdatesToPartialFlatEntity(action),
+    };
+
+    const updatedFlatMaps = replaceFlatEntityInFlatEntityMapsOrThrow({
+      flatEntity: updatedGroup,
+      flatEntityMaps: flatRowLevelPermissionPredicateGroupMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateGroupMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<UpdateRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    const { action, queryRunner } = context;
+    const { rowLevelPermissionPredicateGroupId } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateGroupEntity>(
+        RowLevelPermissionPredicateGroupEntity,
+      );
+
+    const update = fromFlatEntityPropertiesUpdatesToPartialFlatEntity(action);
+
+    await repository.update(rowLevelPermissionPredicateGroupId, update);
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<UpdateRowLevelPermissionPredicateGroupAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/create-row-level-permission-predicate-action-handler.service.ts

@@ -0,0 +1,59 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { addFlatEntityToFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/add-flat-entity-to-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { CreateRowLevelPermissionPredicateAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+
+@Injectable()
+export class CreateRowLevelPermissionPredicateActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'create_row_level_permission_predicate',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<CreateRowLevelPermissionPredicateAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicate } = action;
+
+    const updatedFlatMaps = addFlatEntityToFlatEntityMapsOrThrow({
+      flatEntity: rowLevelPermissionPredicate,
+      flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<CreateRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    const { action, queryRunner, workspaceId } = context;
+    const { rowLevelPermissionPredicate } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateEntity>(
+        RowLevelPermissionPredicateEntity,
+      );
+
+    await repository.insert({
+      ...rowLevelPermissionPredicate,
+      workspaceId,
+    });
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<CreateRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/delete-row-level-permission-predicate-action-handler.service.ts

@@ -0,0 +1,59 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { deleteFlatEntityFromFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/delete-flat-entity-from-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { DeleteRowLevelPermissionPredicateAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+
+@Injectable()
+export class DeleteRowLevelPermissionPredicateActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'delete_row_level_permission_predicate',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<DeleteRowLevelPermissionPredicateAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicateId } = action;
+
+    const updatedFlatMaps = deleteFlatEntityFromFlatEntityMapsOrThrow({
+      entityToDeleteId: rowLevelPermissionPredicateId,
+      flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<DeleteRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    const { action, queryRunner, workspaceId } = context;
+    const { rowLevelPermissionPredicateId } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateEntity>(
+        RowLevelPermissionPredicateEntity,
+      );
+
+    await repository.delete({
+      id: rowLevelPermissionPredicateId,
+      workspaceId,
+    });
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<DeleteRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/update-row-level-permission-predicate-action-handler.service.ts

@@ -0,0 +1,70 @@
+/* @license Enterprise */
+
+import { Injectable } from '@nestjs/common';
+
+import {
+  OptimisticallyApplyActionOnAllFlatEntityMapsArgs,
+  WorkspaceMigrationRunnerActionHandler,
+} from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/interfaces/workspace-migration-runner-action-handler-service.interface';
+
+import { AllFlatEntityMaps } from 'src/engine/metadata-modules/flat-entity/types/all-flat-entity-maps.type';
+import { findFlatEntityByIdInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/find-flat-entity-by-id-in-flat-entity-maps-or-throw.util';
+import { replaceFlatEntityInFlatEntityMapsOrThrow } from 'src/engine/metadata-modules/flat-entity/utils/replace-flat-entity-in-flat-entity-maps-or-throw.util';
+import { RowLevelPermissionPredicateEntity } from 'src/engine/metadata-modules/row-level-permission-predicate/entities/row-level-permission-predicate.entity';
+import { UpdateRowLevelPermissionPredicateAction } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-builder-v2/builders/row-level-permission-predicate/types/workspace-migration-row-level-permission-predicate-action-v2.type';
+import { WorkspaceMigrationActionRunnerArgs } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/types/workspace-migration-action-runner-args.type';
+import { fromFlatEntityPropertiesUpdatesToPartialFlatEntity } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/utils/from-flat-entity-properties-updates-to-partial-flat-entity';
+
+@Injectable()
+export class UpdateRowLevelPermissionPredicateActionHandlerService extends WorkspaceMigrationRunnerActionHandler(
+  'update_row_level_permission_predicate',
+) {
+  optimisticallyApplyActionOnAllFlatEntityMaps({
+    action,
+    allFlatEntityMaps,
+  }: OptimisticallyApplyActionOnAllFlatEntityMapsArgs<UpdateRowLevelPermissionPredicateAction>): Partial<AllFlatEntityMaps> {
+    const { flatRowLevelPermissionPredicateMaps } = allFlatEntityMaps;
+    const { rowLevelPermissionPredicateId } = action;
+
+    const existingPredicate = findFlatEntityByIdInFlatEntityMapsOrThrow({
+      flatEntityId: rowLevelPermissionPredicateId,
+      flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+    });
+
+    const updatedPredicate = {
+      ...existingPredicate,
+      ...fromFlatEntityPropertiesUpdatesToPartialFlatEntity(action),
+    };
+
+    const updatedFlatMaps = replaceFlatEntityInFlatEntityMapsOrThrow({
+      flatEntity: updatedPredicate,
+      flatEntityMaps: flatRowLevelPermissionPredicateMaps,
+    });
+
+    return {
+      flatRowLevelPermissionPredicateMaps: updatedFlatMaps,
+    };
+  }
+
+  async executeForMetadata(
+    context: WorkspaceMigrationActionRunnerArgs<UpdateRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    const { action, queryRunner } = context;
+    const { rowLevelPermissionPredicateId } = action;
+
+    const repository =
+      queryRunner.manager.getRepository<RowLevelPermissionPredicateEntity>(
+        RowLevelPermissionPredicateEntity,
+      );
+
+    const update = fromFlatEntityPropertiesUpdatesToPartialFlatEntity(action);
+
+    await repository.update(rowLevelPermissionPredicateId, update);
+  }
+
+  async executeForWorkspaceSchema(
+    _context: WorkspaceMigrationActionRunnerArgs<UpdateRowLevelPermissionPredicateAction>,
+  ): Promise<void> {
+    return;
+  }
+}

packages/twenty-server/src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/workspace-schema-migration-runner-action-handlers.module.ts

@@ -4,9 +4,6 @@ import { WorkspaceSchemaManagerModule } from 'src/engine/twenty-orm/workspace-sc
 import { CreateAgentActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/agent/services/create-agent-action-handler.service';
 import { DeleteAgentActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/agent/services/delete-agent-action-handler.service';
 import { UpdateAgentActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/agent/services/update-agent-action-handler.service';
-import { CreatePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/create-page-layout-action-handler.service';
-import { DeletePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/delete-page-layout-action-handler.service';
-import { UpdatePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/update-page-layout-action-handler.service';
 import { CreateCronTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/cron-trigger/services/create-cron-trigger-action-handler.service';
 import { DeleteCronTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/cron-trigger/services/delete-cron-trigger-action-handler.service';
 import { UpdateCronTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/cron-trigger/services/update-cron-trigger-action-handler.service';
@@ -27,6 +24,9 @@ import { UpdatePageLayoutTabActionHandlerService } from 'src/engine/workspace-ma
 import { CreatePageLayoutWidgetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout-widget/services/create-page-layout-widget-action-handler.service';
 import { DeletePageLayoutWidgetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout-widget/services/delete-page-layout-widget-action-handler.service';
 import { UpdatePageLayoutWidgetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout-widget/services/update-page-layout-widget-action-handler.service';
+import { CreatePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/create-page-layout-action-handler.service';
+import { DeletePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/delete-page-layout-action-handler.service';
+import { UpdatePageLayoutActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/page-layout/services/update-page-layout-action-handler.service';
 import { CreateRoleTargetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/role-target/services/create-role-target-action-handler.service';
 import { DeleteRoleTargetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/role-target/services/delete-role-target-action-handler.service';
 import { UpdateRoleTargetActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/role-target/services/update-role-target-action-handler.service';
@@ -36,6 +36,12 @@ import { UpdateRoleActionHandlerService } from 'src/engine/workspace-manager/wor
 import { CreateRouteTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/route-trigger/services/create-route-trigger-action-handler.service';
 import { DeleteRouteTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/route-trigger/services/delete-route-trigger-action-handler.service';
 import { UpdateRouteTriggerActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/route-trigger/services/update-route-trigger-action-handler.service';
+import { CreateRowLevelPermissionPredicateGroupActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/create-row-level-permission-predicate-group-action-handler.service';
+import { DeleteRowLevelPermissionPredicateGroupActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/delete-row-level-permission-predicate-group-action-handler.service';
+import { UpdateRowLevelPermissionPredicateGroupActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate-group/services/update-row-level-permission-predicate-group-action-handler.service';
+import { CreateRowLevelPermissionPredicateActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/create-row-level-permission-predicate-action-handler.service';
+import { DeleteRowLevelPermissionPredicateActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/delete-row-level-permission-predicate-action-handler.service';
+import { UpdateRowLevelPermissionPredicateActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/row-level-permission-predicate/services/update-row-level-permission-predicate-action-handler.service';
 import { CreateServerlessFunctionActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/serverless-function/services/create-serverless-function-action-handler.service';
 import { DeleteServerlessFunctionActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/serverless-function/services/delete-serverless-function-action-handler.service';
 import { UpdateServerlessFunctionActionHandlerService } from 'src/engine/workspace-manager/workspace-migration-v2/workspace-migration-runner-v2/action-handlers/serverless-function/services/update-serverless-function-action-handler.service';
@@ -121,6 +127,14 @@ import { UpdateViewActionHandlerService } from 'src/engine/workspace-manager/wor
     CreatePageLayoutTabActionHandlerService,
     UpdatePageLayoutTabActionHandlerService,
     DeletePageLayoutTabActionHandlerService,
+
+    CreateRowLevelPermissionPredicateActionHandlerService,
+    UpdateRowLevelPermissionPredicateActionHandlerService,
+    DeleteRowLevelPermissionPredicateActionHandlerService,
+
+    CreateRowLevelPermissionPredicateGroupActionHandlerService,
+    UpdateRowLevelPermissionPredicateGroupActionHandlerService,
+    DeleteRowLevelPermissionPredicateGroupActionHandlerService,
   ],
 })
 export class WorkspaceSchemaMigrationRunnerActionHandlersModule {}