fix oauth permission check (#19829)

was regressed due to https://github.com/twentyhq/twenty/pull/19441

packages/twenty-server/src/database/commands/upgrade-version-command/1-21/1-21-workspace-command-1775500012000-migrate-messaging-infrastructure-to-metadata.command.ts

@@ -359,6 +359,7 @@ export class MigrateMessagingInfrastructureToMetadataCommand extends ActiveOrSus
       await this.twentyORMGlobalManager.getRepository<WorkspaceMemberWorkspaceEntity>(
         workspaceId,
         'workspaceMember',
+        { shouldBypassPermissionChecks: true },
       );
 
     const workspaceMembers = await workspaceMemberRepository.find();

packages/twenty-server/src/engine/core-modules/auth/services/create-connected-account.service.ts

@@ -7,7 +7,9 @@ import { EntityManager, Repository } from 'typeorm';
 import { UserWorkspaceEntity } from 'src/engine/core-modules/user-workspace/user-workspace.entity';
 import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
 import { GlobalWorkspaceOrmManager } from 'src/engine/twenty-orm/global-workspace-datasource/global-workspace-orm.manager';
+import { getWorkspaceContext } from 'src/engine/twenty-orm/storage/orm-workspace-context.storage';
 import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
+import { resolveRolePermissionConfig } from 'src/engine/twenty-orm/utils/resolve-role-permission-config.util';
 import { type WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
 
 export type CreateConnectedAccountInput = {
@@ -47,10 +49,18 @@ export class CreateConnectedAccountService {
     const authContext = buildSystemAuthContext(workspaceId);
 
     await this.globalWorkspaceOrmManager.executeInWorkspaceContext(async () => {
+      const workspaceContext = getWorkspaceContext();
+      const rolePermissionConfig = resolveRolePermissionConfig({
+        authContext,
+        userWorkspaceRoleMap: workspaceContext.userWorkspaceRoleMap,
+        apiKeyRoleMap: workspaceContext.apiKeyRoleMap,
+      });
+
       const workspaceMemberRepo =
         await this.globalWorkspaceOrmManager.getRepository<WorkspaceMemberWorkspaceEntity>(
           workspaceId,
           'workspaceMember',
+          rolePermissionConfig ?? undefined,
         );
 
       const member = await workspaceMemberRepo.findOne({

packages/twenty-server/src/modules/connected-account/jobs/delete-workspace-member-connected-accounts.job.ts

@@ -39,6 +39,7 @@ export class DeleteWorkspaceMemberConnectedAccountsCleanupJob {
         await this.globalWorkspaceOrmManager.getRepository<WorkspaceMemberWorkspaceEntity>(
           workspaceId,
           'workspaceMember',
+          { shouldBypassPermissionChecks: true },
         );
 
       const member = await workspaceMemberRepo.findOne({

packages/twenty-server/src/modules/connected-account/services/imap-smtp-caldav-apis.service.spec.ts

@@ -18,6 +18,26 @@ jest.mock('uuid', () => ({
   v4: jest.fn(() => 'mocked-uuid'),
 }));
 
+jest.mock(
+  'src/engine/twenty-orm/storage/orm-workspace-context.storage',
+  () => ({
+    getWorkspaceContext: jest.fn(() => ({
+      authContext: { type: 'user', workspace: { id: 'workspace-id' } },
+      userWorkspaceRoleMap: {},
+      apiKeyRoleMap: {},
+    })),
+  }),
+);
+
+jest.mock(
+  'src/engine/twenty-orm/utils/resolve-role-permission-config.util',
+  () => ({
+    resolveRolePermissionConfig: jest.fn(() => ({
+      intersectionOf: ['role-id'],
+    })),
+  }),
+);
+
 describe('ImapSmtpCalDavAPIService', () => {
   let service: ImapSmtpCalDavAPIService;
 

packages/twenty-server/src/modules/connected-account/services/imap-smtp-caldav-apis.service.ts

@@ -15,7 +15,9 @@ import { CalendarChannelEntity } from 'src/engine/metadata-modules/calendar-chan
 import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
 import { MessageChannelEntity } from 'src/engine/metadata-modules/message-channel/entities/message-channel.entity';
 import { GlobalWorkspaceOrmManager } from 'src/engine/twenty-orm/global-workspace-datasource/global-workspace-orm.manager';
+import { getWorkspaceContext } from 'src/engine/twenty-orm/storage/orm-workspace-context.storage';
 import { buildSystemAuthContext } from 'src/engine/twenty-orm/utils/build-system-auth-context.util';
+import { resolveRolePermissionConfig } from 'src/engine/twenty-orm/utils/resolve-role-permission-config.util';
 import { type WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
 import { SyncMessageFoldersService } from 'src/modules/messaging/message-folder-manager/services/sync-message-folders.service';
 
@@ -68,15 +70,20 @@ export class ImapSmtpCalDavAPIService {
     const { handle, workspaceId, workspaceMemberId, connectedAccountId } =
       input;
 
-    const authContext = buildSystemAuthContext(workspaceId);
-
     return this.globalWorkspaceOrmManager.executeInWorkspaceContext(
       async () => {
-        // Resolve userWorkspaceId from workspaceMemberId
+        const workspaceContext = getWorkspaceContext();
+        const rolePermissionConfig = resolveRolePermissionConfig({
+          authContext: workspaceContext.authContext,
+          userWorkspaceRoleMap: workspaceContext.userWorkspaceRoleMap,
+          apiKeyRoleMap: workspaceContext.apiKeyRoleMap,
+        });
+
         const workspaceMemberRepo =
           await this.globalWorkspaceOrmManager.getRepository<WorkspaceMemberWorkspaceEntity>(
             workspaceId,
             'workspaceMember',
+            rolePermissionConfig ?? undefined,
           );
 
         const member = await workspaceMemberRepo.findOne({
@@ -190,7 +197,6 @@ export class ImapSmtpCalDavAPIService {
 
         return newOrExistingAccountId;
       },
-      authContext,
     );
   }
 }