[permissions] Enforce object-records permission checks in resolvers (#10304)

Closes https://github.com/twentyhq/core-team-issues/issues/393

- enforcing object-records permission checks in resolvers for now. we
will move the logic to a lower level asap
- add integration tests that will still be useful when we have moved the
logic
- introduce guest seeded role to test limited permissions on
object-records

packages/twenty-server/src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util.ts

@@ -0,0 +1,24 @@
+import {
+  ForbiddenError,
+  InternalServerError,
+  NotFoundError,
+} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';
+
+export const permissionGraphqlApiExceptionHandler = (
+  error: PermissionsException,
+) => {
+  switch (error.code) {
+    case PermissionsExceptionCode.PERMISSION_DENIED:
+    case PermissionsExceptionCode.CANNOT_UNASSIGN_LAST_ADMIN:
+      throw new ForbiddenError(error.message);
+    case PermissionsExceptionCode.ROLE_NOT_FOUND:
+    case PermissionsExceptionCode.USER_WORKSPACE_NOT_FOUND:
+      throw new NotFoundError(error.message);
+    default:
+      throw new InternalServerError(error.message);
+  }
+};

packages/twenty-server/src/engine/metadata-modules/permissions/utils/permissions-graphql-api-exception.filter.ts

@@ -1,27 +1,11 @@
 import { Catch, ExceptionFilter } from '@nestjs/common';
 
-import {
-  ForbiddenError,
-  InternalServerError,
-  NotFoundError,
-} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
-import {
-  PermissionsException,
-  PermissionsExceptionCode,
-} from 'src/engine/metadata-modules/permissions/permissions.exception';
+import { PermissionsException } from 'src/engine/metadata-modules/permissions/permissions.exception';
+import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
 
 @Catch(PermissionsException)
 export class PermissionsGraphqlApiExceptionFilter implements ExceptionFilter {
   catch(exception: PermissionsException) {
-    switch (exception.code) {
-      case PermissionsExceptionCode.PERMISSION_DENIED:
-      case PermissionsExceptionCode.CANNOT_UNASSIGN_LAST_ADMIN:
-        throw new ForbiddenError(exception.message);
-      case PermissionsExceptionCode.ROLE_NOT_FOUND:
-      case PermissionsExceptionCode.USER_WORKSPACE_NOT_FOUND:
-        throw new NotFoundError(exception.message);
-      default:
-        throw new InternalServerError(exception.message);
-    }
+    return permissionGraphqlApiExceptionHandler(exception);
   }
 }