feat(sdk): declare row-level permission predicates in the role manifest (#21919)

## Why Apps can declare object and field permissions on a role via `defineRole`, but **not row-level security**. The RLS engine and the metadata-sync machinery already support predicates fully — they're first-class universal flat entities, the `FlatRole` already carries `rowLevelPermissionPredicateUniversalIdentifiers`, and the workspace-migration layer has builders/validators/handlers for them. The only gap was the **manifest layer**: `RoleManifest` had no field for predicates, so the sync converter always left them empty. As a result, the only way to ship RLS with an app was a post-install script that pushed predicates through the `upsertRowLevelPermissionPredicates` mutation. That mutation assigns predicates to the workspace's **generic custom application**, not the app that owns the role — so a single role's definition ends up split across two applications and drifts on every upgrade (you have to remember to re-run the script). The Partner app does exactly this today via `configure-partner-rls.ts`. ## What Adds `rowLevelPermissionPredicates` and `rowLevelPermissionPredicateGroups` to `RoleManifest` / `RoleConfig`, mirroring how `objectPermissions` / `fieldPermissions` already flow end-to-end: - **twenty-shared** — predicate + predicate-group manifest types on `RoleManifest` (referencing objects/fields by `universalIdentifier`, operand/logical-operator from the existing GraphQL enums). - **twenty-sdk** — `defineRole` accepts and validates them; the build derives deterministic predicate `universalIdentifier`s (groups keep an explicit one so predicates can reference them). - **twenty-server** — two converters turn manifest predicates/groups into universal flat entities during application-manifest sync, so they are created/updated/deleted together with the role and **owned by the app that ships it**. ### Bug fix found along the way The migration build order ran the `rowLevelPermissionPredicate(Group)` builders **before** the `role` builder, so a predicate declared alongside a brand-new role failed validation with `ROLE_NOT_FOUND`. They now run **after** the role builder, exactly like object/field permissions. ## Partner app (second commit) Converts `partner.role.ts` to declare its five predicates inline and **deletes `configure-partner-rls.ts`** + the `rls:configure` scripts — the workaround this PR is meant to retire. The predicates are byte-for-byte the same semantics as the script produced. > Live-deployment note: the existing script-created predicates are owned by the *custom* application, so the Partner app sync won't touch them. Clear them once (e.g. an empty upsert on the Partner role) around deploy to avoid duplicates. Kept as a **separate commit** so it can be split out if reviewers prefer. ## Testing - **Integration (full app):** new `successful-manifest-sync-row-level-permission-predicate.integration-spec.ts` — installs an app whose role declares a predicate and asserts the predicate row is created (and **owned by the app**, not the custom app), updated in place on re-sync, removed when dropped from the manifest, and removed on uninstall. Ran locally against a seeded test DB ✅. - Re-ran the existing cross-app permission + view-field manifest suites to confirm the build-order change doesn't regress object/field-permission sync (13/13 ✅). - **Unit (utils only):** `defineRole` validation and `fromRoleConfigToRoleManifest` deterministic-id derivation. - Docs: new "Row-level security" section in `apps/config/roles.mdx`. ## Scope notes / possible follow-ups - Surfacing RLS in the app-install permission summary UI was intentionally left out (predicates *restrict* rather than grant, and typically live on a non-default role) — easy follow-up if wanted. - The `upsertRowLevelPermissionPredicates` mutation still homes out-of-band predicates on the custom app for app-owned roles; making that consistent (or rejecting it, like field permissions already do) is a sensible follow-up. https://claude.ai/code/session_01MipAis9z9okd4oCm9HCKEf --- _Generated by [Claude Code](https://claude.ai/code/session_01MipAis9z9okd4oCm9HCKEf)_  <a href="https://cubic.dev/pr/twentyhq/twenty/pull/21919?utm_source=github" target="_blank" rel="noopener noreferrer" data-no-image-dialog="true"><picture><source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="Review in cubic" src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
2026-06-21 22:09:19 +02:00
parent 573fd00ea7
commit a682c8fa62
16 changed files with 887 additions and 8 deletions
@@ -333,6 +333,8 @@ export const EXPECTED_MANIFEST: Manifest = {
      canBeAssignedToApiKeys: false,
      fieldPermissions: [],
      objectPermissions: [],
+      rowLevelPermissionPredicateGroups: [],
+      rowLevelPermissionPredicates: [],
      permissionFlagUniversalIdentifiers: [],
    },
  ],
@@ -1399,6 +1399,8 @@ export const EXPECTED_MANIFEST: Manifest = {
      universalIdentifier: 'c0c1c2c3-c4c5-4000-8000-000000000001',
      fieldPermissions: [],
      objectPermissions: [],
+      rowLevelPermissionPredicateGroups: [],
+      rowLevelPermissionPredicates: [],
      permissionFlagUniversalIdentifiers: [],
    },
    {
@@ -1431,6 +1433,8 @@ export const EXPECTED_MANIFEST: Manifest = {
          objectUniversalIdentifier: '54b589ca-eeed-4950-a176-358418b85c05',
        },
      ],
+      rowLevelPermissionPredicateGroups: [],
+      rowLevelPermissionPredicates: [],
      permissionFlagUniversalIdentifiers: [SystemPermissionFlag.APPLICATIONS],
      universalIdentifier: 'b648f87b-1d26-4961-b974-0908fd991061',
    },
@@ -14,6 +14,8 @@ exports[`stub-twenty-sdk-define plugin > matches the recorded export partition 1
    "OnDeleteAction",
    "PageLayoutTabLayoutMode",
    "RelationType",
+    "RowLevelPermissionPredicateGroupLogicalOperator",
+    "RowLevelPermissionPredicateOperand",
    "STANDARD_OBJECT",
    "STANDARD_OBJECT_UNIVERSAL_IDENTIFIERS",
    "STANDARD_PAGE_LAYOUT",
@@ -0,0 +1,70 @@
+import { fromRoleConfigToRoleManifest } from '@/cli/utilities/build/manifest/utils/from-role-config-to-role-manifest';
+import { type RoleConfig } from '@/sdk/define/roles/role-config';
+import {
+  RowLevelPermissionPredicateGroupLogicalOperator,
+  RowLevelPermissionPredicateOperand,
+} from '@/sdk/define';
+
+const ROLE_UNIVERSAL_IDENTIFIER = 'c3c1dc2e-1a08-4de5-abb7-2139b3d99343';
+const OBJECT_UNIVERSAL_IDENTIFIER = '39101b39-1c16-4148-9e82-45dc271bb90d';
+const FIELD_UNIVERSAL_IDENTIFIER = '0e49f2e4-1e45-433d-bf49-79acc0b06d0e';
+const PREDICATE_UNIVERSAL_IDENTIFIER = '22222222-0000-4000-8000-000000000000';
+const GROUP_UNIVERSAL_IDENTIFIER = '11111111-0000-4000-8000-000000000000';
+
+const baseConfig: RoleConfig = {
+  universalIdentifier: ROLE_UNIVERSAL_IDENTIFIER,
+  label: 'Partner',
+};
+
+describe('fromRoleConfigToRoleManifest', () => {
+  it('passes predicates through with their explicit universalIdentifier', () => {
+    const config: RoleConfig = {
+      ...baseConfig,
+      rowLevelPermissionPredicates: [
+        {
+          universalIdentifier: PREDICATE_UNIVERSAL_IDENTIFIER,
+          objectUniversalIdentifier: OBJECT_UNIVERSAL_IDENTIFIER,
+          fieldUniversalIdentifier: FIELD_UNIVERSAL_IDENTIFIER,
+          operand: RowLevelPermissionPredicateOperand.IS,
+        },
+      ],
+    };
+
+    const manifest = fromRoleConfigToRoleManifest(config);
+    const predicate = manifest.rowLevelPermissionPredicates?.[0];
+
+    expect(predicate?.universalIdentifier).toBe(PREDICATE_UNIVERSAL_IDENTIFIER);
+    expect(predicate?.objectUniversalIdentifier).toBe(
+      OBJECT_UNIVERSAL_IDENTIFIER,
+    );
+    expect(predicate?.fieldUniversalIdentifier).toBe(FIELD_UNIVERSAL_IDENTIFIER);
+    expect(predicate?.operand).toBe(RowLevelPermissionPredicateOperand.IS);
+  });
+
+  it('passes predicate groups through with their explicit universalIdentifier', () => {
+    const config: RoleConfig = {
+      ...baseConfig,
+      rowLevelPermissionPredicateGroups: [
+        {
+          universalIdentifier: GROUP_UNIVERSAL_IDENTIFIER,
+          objectUniversalIdentifier: OBJECT_UNIVERSAL_IDENTIFIER,
+          logicalOperator: RowLevelPermissionPredicateGroupLogicalOperator.OR,
+        },
+      ],
+    };
+
+    const manifest = fromRoleConfigToRoleManifest(config);
+
+    expect(manifest.rowLevelPermissionPredicateGroups).toHaveLength(1);
+    expect(
+      manifest.rowLevelPermissionPredicateGroups?.[0]?.universalIdentifier,
+    ).toBe(GROUP_UNIVERSAL_IDENTIFIER);
+  });
+
+  it('defaults predicate collections to empty arrays', () => {
+    const manifest = fromRoleConfigToRoleManifest(baseConfig);
+
+    expect(manifest.rowLevelPermissionPredicates).toEqual([]);
+    expect(manifest.rowLevelPermissionPredicateGroups).toEqual([]);
+  });
+});
@@ -28,6 +28,10 @@ export const fromRoleConfigToRoleManifest = (
        ),
      }),
    ),
+    rowLevelPermissionPredicateGroups:
+      roleConfig.rowLevelPermissionPredicateGroups ?? [],
+    rowLevelPermissionPredicates:
+      roleConfig.rowLevelPermissionPredicates ?? [],
    permissionFlagUniversalIdentifiers:
      roleConfig.permissionFlagUniversalIdentifiers ?? [],
  };