feat: migrate ConnectedAccount infrastructure entities to metadata schema (#18784)

## Summary - Migrates 4 entities (`connectedAccount`, `messageChannel`, `calendarChannel`, `messageFolder`) from per-workspace schemas to the shared `core` metadata schema - Introduces a `IS_CONNECTED_ACCOUNT_MIGRATED` feature flag to control the migration: when enabled, reads come from core metadata and all writes are dual-written to both workspace and core - Extracts 12 enums from workspace entity files to `twenty-shared` for reuse across frontend and backend - Creates new TypeORM entities, metadata services, GraphQL resolvers/DTOs, and exception interceptors per entity - Each entity owns its own data access module (`ConnectedAccountDataAccessModule`, `MessageChannelDataAccessModule`, `CalendarChannelDataAccessModule`, `MessageFolderDataAccessModule`) — no umbrella infrastructure module - Adds a 1.20 upgrade command that backfills data from workspace schemas to core (preserving UUIDs) and enables the feature flag - Replaces direct repository access with data access service calls across ~50 files in messaging, calendar, and connected-account modules - Adds `lastSignedInAt` and `oidcTokenClaims` fields to the new `ConnectedAccountEntity` - Drops unused `lastSyncHistoryId` field from the migrated connected account entity ## Test plan - [x] Lint passes (`npx nx lint:diff-with-main twenty-server`) - [x] Typecheck passes (`npx nx typecheck twenty-server`) - [x] All unit tests pass (477 suites, 4267 tests, 0 failures) - [ ] Manual test: verify messaging sync works with feature flag disabled (existing behavior) - [ ] Manual test: run upgrade command on a workspace, verify data backfilled to core tables - [ ] Manual test: verify messaging/calendar sync works with feature flag enabled (dual-write path) - [ ] Manual test: verify GraphQL metadata resolvers return correct data when flag enabled
2026-03-20 00:34:58 +01:00
parent cd594ce8bd
commit cee4cf6452
149 changed files with 7338 additions and 1699 deletions
@@ -0,0 +1,26 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+
+import { AuthModule } from 'src/engine/core-modules/auth/auth.module';
+import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
+import { ConnectedAccountMetadataService } from 'src/engine/metadata-modules/connected-account/connected-account-metadata.service';
+import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
+import { ConnectedAccountGraphqlApiExceptionInterceptor } from 'src/engine/metadata-modules/connected-account/interceptors/connected-account-graphql-api-exception.interceptor';
+import { ConnectedAccountResolver } from 'src/engine/metadata-modules/connected-account/resolvers/connected-account.resolver';
+import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([ConnectedAccountEntity]),
+    AuthModule,
+    PermissionsModule,
+    FeatureFlagModule,
+  ],
+  providers: [
+    ConnectedAccountMetadataService,
+    ConnectedAccountResolver,
+    ConnectedAccountGraphqlApiExceptionInterceptor,
+  ],
+  exports: [ConnectedAccountMetadataService],
+})
+export class ConnectedAccountMetadataModule {}
@@ -0,0 +1,62 @@
+import { Injectable } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { Repository } from 'typeorm';
+
+import { ConnectedAccountDTO } from 'src/engine/metadata-modules/connected-account/dtos/connected-account.dto';
+import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
+
+@Injectable()
+export class ConnectedAccountMetadataService {
+  constructor(
+    @InjectRepository(ConnectedAccountEntity)
+    private readonly repository: Repository<ConnectedAccountEntity>,
+  ) {}
+
+  async findAll(workspaceId: string): Promise<ConnectedAccountDTO[]> {
+    return this.repository.find({ where: { workspaceId } });
+  }
+
+  async findById(
+    id: string,
+    workspaceId: string,
+  ): Promise<ConnectedAccountDTO | null> {
+    return this.repository.findOne({ where: { id, workspaceId } });
+  }
+
+  async create(
+    data: Partial<ConnectedAccountEntity> & {
+      workspaceId: string;
+      handle: string;
+      provider: string;
+      userWorkspaceId: string;
+    },
+  ): Promise<ConnectedAccountDTO> {
+    const entity = this.repository.create(data);
+
+    return this.repository.save(entity);
+  }
+
+  async update(
+    id: string,
+    workspaceId: string,
+    data: Partial<ConnectedAccountEntity>,
+  ): Promise<ConnectedAccountDTO> {
+    await this.repository.update(
+      { id, workspaceId },
+      data as Record<string, unknown>,
+    );
+
+    return this.repository.findOneOrFail({ where: { id, workspaceId } });
+  }
+
+  async delete(id: string, workspaceId: string): Promise<ConnectedAccountDTO> {
+    const entity = await this.repository.findOneOrFail({
+      where: { id, workspaceId },
+    });
+
+    await this.repository.delete({ id, workspaceId });
+
+    return entity;
+  }
+}
@@ -0,0 +1,37 @@
+import { type MessageDescriptor } from '@lingui/core';
+import { msg } from '@lingui/core/macro';
+import { assertUnreachable } from 'twenty-shared/utils';
+
+import { CustomException } from 'src/utils/custom-exception';
+
+export enum ConnectedAccountExceptionCode {
+  CONNECTED_ACCOUNT_NOT_FOUND = 'CONNECTED_ACCOUNT_NOT_FOUND',
+  INVALID_CONNECTED_ACCOUNT_INPUT = 'INVALID_CONNECTED_ACCOUNT_INPUT',
+}
+
+const getConnectedAccountExceptionUserFriendlyMessage = (
+  code: ConnectedAccountExceptionCode,
+) => {
+  switch (code) {
+    case ConnectedAccountExceptionCode.CONNECTED_ACCOUNT_NOT_FOUND:
+      return msg`Connected account not found.`;
+    case ConnectedAccountExceptionCode.INVALID_CONNECTED_ACCOUNT_INPUT:
+      return msg`Invalid connected account input.`;
+    default:
+      assertUnreachable(code);
+  }
+};
+
+export class ConnectedAccountException extends CustomException<ConnectedAccountExceptionCode> {
+  constructor(
+    message: string,
+    code: ConnectedAccountExceptionCode,
+    { userFriendlyMessage }: { userFriendlyMessage?: MessageDescriptor } = {},
+  ) {
+    super(message, code, {
+      userFriendlyMessage:
+        userFriendlyMessage ??
+        getConnectedAccountExceptionUserFriendlyMessage(code),
+    });
+  }
+}
@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { TypeOrmModule } from '@nestjs/typeorm';
+
+import { FeatureFlagModule } from 'src/engine/core-modules/feature-flag/feature-flag.module';
+import { UserWorkspaceEntity } from 'src/engine/core-modules/user-workspace/user-workspace.entity';
+import { ConnectedAccountDataAccessService } from 'src/engine/metadata-modules/connected-account/data-access/services/connected-account-data-access.service';
+import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
+
+@Module({
+  imports: [
+    TypeOrmModule.forFeature([ConnectedAccountEntity, UserWorkspaceEntity]),
+    FeatureFlagModule,
+  ],
+  providers: [ConnectedAccountDataAccessService],
+  exports: [ConnectedAccountDataAccessService],
+})
+export class ConnectedAccountDataAccessModule {}
@@ -0,0 +1,346 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { isNonEmptyString } from '@sniptt/guards';
+
+import { FeatureFlagKey } from 'twenty-shared/types';
+import { isDefined } from 'twenty-shared/utils';
+import {
+  type FindOneOptions,
+  type FindOptionsWhere,
+  In,
+  Repository,
+} from 'typeorm';
+
+import { FeatureFlagService } from 'src/engine/core-modules/feature-flag/services/feature-flag.service';
+import { UserWorkspaceEntity } from 'src/engine/core-modules/user-workspace/user-workspace.entity';
+import { ConnectedAccountEntity } from 'src/engine/metadata-modules/connected-account/entities/connected-account.entity';
+import { type WorkspaceEntityManager } from 'src/engine/twenty-orm/entity-manager/workspace-entity-manager';
+import { GlobalWorkspaceOrmManager } from 'src/engine/twenty-orm/global-workspace-datasource/global-workspace-orm.manager';
+import { type ConnectedAccountWorkspaceEntity } from 'src/modules/connected-account/standard-objects/connected-account.workspace-entity';
+import { type WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
+
+@Injectable()
+export class ConnectedAccountDataAccessService {
+  private readonly logger = new Logger(ConnectedAccountDataAccessService.name);
+
+  constructor(
+    @InjectRepository(ConnectedAccountEntity)
+    private readonly coreRepository: Repository<ConnectedAccountEntity>,
+    @InjectRepository(UserWorkspaceEntity)
+    private readonly userWorkspaceRepository: Repository<UserWorkspaceEntity>,
+    private readonly featureFlagService: FeatureFlagService,
+    private readonly globalWorkspaceOrmManager: GlobalWorkspaceOrmManager,
+  ) {}
+
+  private async isMigrated(workspaceId: string): Promise<boolean> {
+    return this.featureFlagService.isFeatureEnabled(
+      FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED,
+      workspaceId,
+    );
+  }
+
+  private async resolveUserWorkspaceId(
+    workspaceId: string,
+    workspaceMemberId: string,
+  ): Promise<string | null> {
+    const workspaceMemberRepository =
+      await this.globalWorkspaceOrmManager.getRepository<WorkspaceMemberWorkspaceEntity>(
+        workspaceId,
+        'workspaceMember',
+      );
+
+    const workspaceMember = await workspaceMemberRepository.findOne({
+      where: { id: workspaceMemberId },
+    });
+
+    if (!workspaceMember) {
+      return null;
+    }
+
+    const userWorkspace = await this.userWorkspaceRepository.findOne({
+      where: { userId: workspaceMember.userId, workspaceId },
+    });
+
+    return userWorkspace?.id ?? null;
+  }
+
+  private async toCore(
+    workspaceId: string,
+    data: Partial<ConnectedAccountWorkspaceEntity>,
+  ): Promise<Partial<ConnectedAccountEntity>> {
+    const {
+      handleAliases,
+      lastSyncHistoryId: _lastSyncHistoryId,
+      accountOwnerId,
+      ...rest
+    } = data as Record<string, unknown>;
+
+    const coreData: Record<string, unknown> = { ...rest };
+
+    if (handleAliases !== undefined) {
+      coreData.handleAliases = isNonEmptyString(handleAliases)
+        ? handleAliases.split(',').map((alias: string) => alias.trim())
+        : null;
+    }
+
+    if (accountOwnerId !== undefined) {
+      const userWorkspaceId = await this.resolveUserWorkspaceId(
+        workspaceId,
+        accountOwnerId as string,
+      );
+
+      if (!userWorkspaceId) {
+        this.logger.warn(
+          `Could not resolve userWorkspaceId for workspaceMember ${accountOwnerId}`,
+        );
+      }
+
+      coreData.userWorkspaceId = userWorkspaceId;
+    }
+
+    return coreData as Partial<ConnectedAccountEntity>;
+  }
+
+  private async toCoreWhere(
+    workspaceId: string,
+    where: Record<string, unknown>,
+  ): Promise<FindOptionsWhere<ConnectedAccountEntity>> {
+    const { accountOwnerId, ...rest } = where;
+    const coreWhere: Record<string, unknown> = { ...rest, workspaceId };
+
+    if (accountOwnerId !== undefined) {
+      const userWorkspaceId = await this.resolveUserWorkspaceId(
+        workspaceId,
+        accountOwnerId as string,
+      );
+
+      if (userWorkspaceId) {
+        coreWhere.userWorkspaceId = userWorkspaceId;
+      } else {
+        this.logger.warn(
+          `toCoreWhere: could not resolve userWorkspaceId for workspaceMember ${accountOwnerId}, returning empty result`,
+        );
+        coreWhere.id = '00000000-0000-0000-0000-000000000000';
+      }
+    }
+
+    return coreWhere as FindOptionsWhere<ConnectedAccountEntity>;
+  }
+
+  private async fromCoreEntities(
+    workspaceId: string,
+    entities: ConnectedAccountEntity[],
+  ): Promise<ConnectedAccountWorkspaceEntity[]> {
+    if (entities.length === 0) {
+      return [];
+    }
+
+    const userWorkspaceIds = entities
+      .map((entity) => entity.userWorkspaceId)
+      .filter(isDefined);
+
+    const userWorkspaces =
+      userWorkspaceIds.length > 0
+        ? await this.userWorkspaceRepository.find({
+            where: { id: In(userWorkspaceIds) },
+            select: ['id', 'userId'],
+          })
+        : [];
+
+    const userIdByUserWorkspaceId = new Map(
+      userWorkspaces.map((userWorkspace) => [
+        userWorkspace.id,
+        userWorkspace.userId,
+      ]),
+    );
+
+    const uniqueUserIds = [
+      ...new Set(userWorkspaces.map((userWorkspace) => userWorkspace.userId)),
+    ];
+
+    const workspaceMemberRepository =
+      await this.globalWorkspaceOrmManager.getRepository<WorkspaceMemberWorkspaceEntity>(
+        workspaceId,
+        'workspaceMember',
+      );
+
+    const workspaceMembers =
+      uniqueUserIds.length > 0
+        ? await workspaceMemberRepository.find({
+            where: { userId: In(uniqueUserIds) },
+          })
+        : [];
+
+    const workspaceMemberIdByUserId = new Map(
+      workspaceMembers.map((workspaceMember) => [
+        workspaceMember.userId,
+        workspaceMember.id,
+      ]),
+    );
+
+    return entities.map((entity) => {
+      const userId = entity.userWorkspaceId
+        ? userIdByUserWorkspaceId.get(entity.userWorkspaceId)
+        : undefined;
+
+      const accountOwnerId = userId
+        ? workspaceMemberIdByUserId.get(userId)
+        : undefined;
+
+      const handleAliases = Array.isArray(entity.handleAliases)
+        ? entity.handleAliases.join(',')
+        : (entity.handleAliases ?? '');
+
+      return {
+        ...entity,
+        handleAliases,
+        accountOwnerId: accountOwnerId ?? null,
+      } as unknown as ConnectedAccountWorkspaceEntity;
+    });
+  }
+
+  async getWorkspaceRepository(workspaceId: string) {
+    return this.globalWorkspaceOrmManager.getRepository<ConnectedAccountWorkspaceEntity>(
+      workspaceId,
+      'connectedAccount',
+    );
+  }
+
+  async findOne(
+    workspaceId: string,
+    options: FindOneOptions<ConnectedAccountWorkspaceEntity>,
+  ): Promise<ConnectedAccountWorkspaceEntity | null> {
+    if (await this.isMigrated(workspaceId)) {
+      const where = options.where as Record<string, unknown>;
+      const coreWhere = Array.isArray(where)
+        ? await Promise.all(
+            where.map((whereItem: Record<string, unknown>) =>
+              this.toCoreWhere(workspaceId, whereItem),
+            ),
+          )
+        : await this.toCoreWhere(workspaceId, where);
+
+      const coreResult = await this.coreRepository.findOne({
+        ...options,
+        where: coreWhere,
+      } as FindOneOptions<ConnectedAccountEntity>);
+
+      if (!coreResult) {
+        return null;
+      }
+
+      const [transformed] = await this.fromCoreEntities(workspaceId, [
+        coreResult,
+      ]);
+
+      return transformed ?? null;
+    }
+
+    const workspaceRepository = await this.getWorkspaceRepository(workspaceId);
+
+    return workspaceRepository.findOne(options);
+  }
+
+  async find(
+    workspaceId: string,
+    where?: FindOptionsWhere<ConnectedAccountWorkspaceEntity>,
+  ): Promise<ConnectedAccountWorkspaceEntity[]> {
+    if (await this.isMigrated(workspaceId)) {
+      const coreWhere = where
+        ? await this.toCoreWhere(workspaceId, where as Record<string, unknown>)
+        : { workspaceId };
+
+      const coreResults = await this.coreRepository.find({
+        where: coreWhere,
+      });
+
+      return this.fromCoreEntities(workspaceId, coreResults);
+    }
+
+    const workspaceRepository = await this.getWorkspaceRepository(workspaceId);
+
+    return workspaceRepository.find({ where });
+  }
+
+  async save(
+    workspaceId: string,
+    data: Partial<ConnectedAccountWorkspaceEntity>,
+    manager?: WorkspaceEntityManager,
+  ): Promise<void> {
+    const workspaceRepository = await this.getWorkspaceRepository(workspaceId);
+
+    await workspaceRepository.save(data, {}, manager);
+
+    if (await this.isMigrated(workspaceId)) {
+      try {
+        const coreData = await this.toCore(workspaceId, data);
+
+        await this.coreRepository.save({
+          ...coreData,
+          workspaceId,
+        } as ConnectedAccountEntity);
+      } catch (error) {
+        this.logger.error(
+          `Failed to dual-write connectedAccount to core: ${error}`,
+        );
+        throw error;
+      }
+    }
+  }
+
+  async update(
+    workspaceId: string,
+    where: FindOptionsWhere<ConnectedAccountWorkspaceEntity>,
+    data: Partial<ConnectedAccountWorkspaceEntity>,
+  ): Promise<void> {
+    const workspaceRepository = await this.getWorkspaceRepository(workspaceId);
+
+    await workspaceRepository.update(where, data);
+
+    if (await this.isMigrated(workspaceId)) {
+      try {
+        const coreData = await this.toCore(workspaceId, data);
+        const coreWhere = await this.toCoreWhere(
+          workspaceId,
+          where as Record<string, unknown>,
+        );
+
+        await this.coreRepository.update(
+          coreWhere,
+          coreData as Record<string, unknown>,
+        );
+      } catch (error) {
+        this.logger.error(
+          `Failed to dual-write connectedAccount update to core: ${error}`,
+        );
+        throw error;
+      }
+    }
+  }
+
+  async delete(
+    workspaceId: string,
+    where: FindOptionsWhere<ConnectedAccountWorkspaceEntity>,
+  ): Promise<void> {
+    const workspaceRepository = await this.getWorkspaceRepository(workspaceId);
+
+    await workspaceRepository.delete(where);
+
+    if (await this.isMigrated(workspaceId)) {
+      try {
+        const coreWhere = await this.toCoreWhere(
+          workspaceId,
+          where as Record<string, unknown>,
+        );
+
+        await this.coreRepository.delete(coreWhere);
+      } catch (error) {
+        this.logger.error(
+          `Failed to dual-write connectedAccount delete to core: ${error}`,
+        );
+        throw error;
+      }
+    }
+  }
+}
@@ -0,0 +1,90 @@
+import { Field, HideField, ObjectType } from '@nestjs/graphql';
+
+import {
+  IsArray,
+  IsDateString,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
+import GraphQLJSON from 'graphql-type-json';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+
+@ObjectType('ConnectedAccountDTO')
+export class ConnectedAccountDTO {
+  @IsUUID()
+  @IsNotEmpty()
+  @Field(() => UUIDScalarType)
+  id: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Field()
+  handle: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Field()
+  provider: string;
+
+  @IsString()
+  @IsOptional()
+  @Field(() => String, { nullable: true })
+  accessToken: string | null;
+
+  @IsString()
+  @IsOptional()
+  @Field(() => String, { nullable: true })
+  refreshToken: string | null;
+
+  @IsDateString()
+  @IsOptional()
+  @Field(() => Date, { nullable: true })
+  lastCredentialsRefreshedAt: Date | null;
+
+  @IsDateString()
+  @IsOptional()
+  @Field(() => Date, { nullable: true })
+  authFailedAt: Date | null;
+
+  @IsArray()
+  @IsOptional()
+  @Field(() => [String], { nullable: true })
+  handleAliases: string[] | null;
+
+  @IsArray()
+  @IsOptional()
+  @Field(() => [String], { nullable: true })
+  scopes: string[] | null;
+
+  @IsOptional()
+  @Field(() => GraphQLJSON, { nullable: true })
+  connectionParameters: Record<string, unknown> | null;
+
+  @IsDateString()
+  @IsOptional()
+  @Field(() => Date, { nullable: true })
+  lastSignedInAt: Date | null;
+
+  @IsOptional()
+  @Field(() => GraphQLJSON, { nullable: true })
+  oidcTokenClaims: Record<string, unknown> | null;
+
+  @IsUUID()
+  @IsNotEmpty()
+  @Field(() => UUIDScalarType)
+  userWorkspaceId: string;
+
+  @HideField()
+  workspaceId: string;
+
+  @IsDateString()
+  @Field()
+  createdAt: Date;
+
+  @IsDateString()
+  @Field()
+  updatedAt: Date;
+}
@@ -0,0 +1,49 @@
+import { Field, InputType } from '@nestjs/graphql';
+
+import {
+  IsArray,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+} from 'class-validator';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+
+@InputType()
+export class CreateConnectedAccountInput {
+  @IsUUID()
+  @IsOptional()
+  @Field(() => UUIDScalarType, { nullable: true })
+  id?: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Field()
+  handle: string;
+
+  @IsString()
+  @IsNotEmpty()
+  @Field()
+  provider: string;
+
+  @IsString()
+  @IsOptional()
+  @Field({ nullable: true })
+  accessToken?: string;
+
+  @IsString()
+  @IsOptional()
+  @Field({ nullable: true })
+  refreshToken?: string;
+
+  @IsArray()
+  @IsOptional()
+  @Field(() => [String], { nullable: true })
+  scopes?: string[];
+
+  @IsUUID()
+  @IsNotEmpty()
+  @Field(() => UUIDScalarType)
+  userWorkspaceId: string;
+}
@@ -0,0 +1,49 @@
+import { Field, InputType } from '@nestjs/graphql';
+
+import { Type } from 'class-transformer';
+import {
+  IsArray,
+  IsNotEmpty,
+  IsOptional,
+  IsString,
+  IsUUID,
+  ValidateNested,
+} from 'class-validator';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+
+@InputType()
+export class UpdateConnectedAccountInputUpdates {
+  @IsOptional()
+  @IsString()
+  @Field({ nullable: true })
+  accessToken?: string;
+
+  @IsOptional()
+  @IsString()
+  @Field({ nullable: true })
+  refreshToken?: string;
+
+  @IsOptional()
+  @IsArray()
+  @Field(() => [String], { nullable: true })
+  handleAliases?: string[];
+
+  @IsOptional()
+  @IsArray()
+  @Field(() => [String], { nullable: true })
+  scopes?: string[];
+}
+
+@InputType()
+export class UpdateConnectedAccountInput {
+  @IsUUID()
+  @IsNotEmpty()
+  @Field(() => UUIDScalarType)
+  id: string;
+
+  @Type(() => UpdateConnectedAccountInputUpdates)
+  @ValidateNested()
+  @Field(() => UpdateConnectedAccountInputUpdates)
+  update: UpdateConnectedAccountInputUpdates;
+}
@@ -0,0 +1,74 @@
+import {
+  Column,
+  CreateDateColumn,
+  Entity,
+  OneToMany,
+  PrimaryGeneratedColumn,
+  type Relation,
+  UpdateDateColumn,
+} from 'typeorm';
+
+import { type CalendarChannelEntity } from 'src/engine/metadata-modules/calendar-channel/entities/calendar-channel.entity';
+import { type MessageChannelEntity } from 'src/engine/metadata-modules/message-channel/entities/message-channel.entity';
+import { WorkspaceRelatedEntity } from 'src/engine/workspace-manager/types/workspace-related-entity';
+
+@Entity({ name: 'connectedAccount', schema: 'core' })
+export class ConnectedAccountEntity extends WorkspaceRelatedEntity {
+  @PrimaryGeneratedColumn('uuid')
+  id: string;
+
+  @Column({ type: 'varchar', nullable: false })
+  handle: string;
+
+  @Column({ type: 'varchar', nullable: false })
+  provider: string;
+
+  @Column({ type: 'varchar', nullable: true })
+  accessToken: string | null;
+
+  @Column({ type: 'varchar', nullable: true })
+  refreshToken: string | null;
+
+  @Column({ type: 'timestamptz', nullable: true })
+  lastCredentialsRefreshedAt: Date | null;
+
+  @Column({ type: 'timestamptz', nullable: true })
+  authFailedAt: Date | null;
+
+  @Column({ type: 'varchar', array: true, nullable: true })
+  handleAliases: string[] | null;
+
+  @Column({ type: 'varchar', array: true, nullable: true })
+  scopes: string[] | null;
+
+  @Column({ type: 'jsonb', nullable: true })
+  connectionParameters: Record<string, unknown> | null;
+
+  @Column({ type: 'timestamptz', nullable: true })
+  lastSignedInAt: Date | null;
+
+  @Column({ type: 'jsonb', nullable: true })
+  oidcTokenClaims: Record<string, unknown> | null;
+
+  @Column({ type: 'uuid', nullable: false })
+  userWorkspaceId: string;
+
+  @OneToMany(
+    'MessageChannelEntity',
+    (messageChannel: MessageChannelEntity) => messageChannel.connectedAccount,
+  )
+  messageChannels: Relation<MessageChannelEntity[]>;
+
+  @OneToMany(
+    'CalendarChannelEntity',
+    (calendarChannel: CalendarChannelEntity) =>
+      calendarChannel.connectedAccount,
+  )
+  calendarChannels: Relation<CalendarChannelEntity[]>;
+
+  @CreateDateColumn({ type: 'timestamptz' })
+  createdAt: Date;
+
+  @UpdateDateColumn({ type: 'timestamptz' })
+  updatedAt: Date;
+}
@@ -0,0 +1,24 @@
+import {
+  type CallHandler,
+  type ExecutionContext,
+  Injectable,
+  type NestInterceptor,
+} from '@nestjs/common';
+
+import { type Observable, catchError } from 'rxjs';
+
+import { connectedAccountGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/connected-account/utils/connected-account-graphql-api-exception-handler.util';
+
+@Injectable()
+export class ConnectedAccountGraphqlApiExceptionInterceptor
+  implements NestInterceptor
+{
+  intercept(
+    _context: ExecutionContext,
+    next: CallHandler,
+  ): Observable<unknown> {
+    return next
+      .handle()
+      .pipe(catchError(connectedAccountGraphqlApiExceptionHandler));
+  }
+}
@@ -0,0 +1,86 @@
+import { UseGuards, UseInterceptors } from '@nestjs/common';
+import { Args, Mutation, Query } from '@nestjs/graphql';
+
+import { PermissionFlagType } from 'twenty-shared/constants';
+import { FeatureFlagKey } from 'twenty-shared/types';
+
+import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
+import { MetadataResolver } from 'src/engine/api/graphql/graphql-config/decorators/metadata-resolver.decorator';
+import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
+import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
+import {
+  FeatureFlagGuard,
+  RequireFeatureFlag,
+} from 'src/engine/guards/feature-flag.guard';
+import { SettingsPermissionGuard } from 'src/engine/guards/settings-permission.guard';
+import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
+import { ConnectedAccountMetadataService } from 'src/engine/metadata-modules/connected-account/connected-account-metadata.service';
+import { ConnectedAccountDTO } from 'src/engine/metadata-modules/connected-account/dtos/connected-account.dto';
+import { CreateConnectedAccountInput } from 'src/engine/metadata-modules/connected-account/dtos/create-connected-account.input';
+import { UpdateConnectedAccountInput } from 'src/engine/metadata-modules/connected-account/dtos/update-connected-account.input';
+import { ConnectedAccountGraphqlApiExceptionInterceptor } from 'src/engine/metadata-modules/connected-account/interceptors/connected-account-graphql-api-exception.interceptor';
+
+@UseGuards(WorkspaceAuthGuard, FeatureFlagGuard)
+@UseInterceptors(ConnectedAccountGraphqlApiExceptionInterceptor)
+@MetadataResolver(() => ConnectedAccountDTO)
+export class ConnectedAccountResolver {
+  constructor(
+    private readonly connectedAccountMetadataService: ConnectedAccountMetadataService,
+  ) {}
+
+  @Query(() => [ConnectedAccountDTO])
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
+  @RequireFeatureFlag(FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED)
+  async connectedAccounts(
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<ConnectedAccountDTO[]> {
+    return this.connectedAccountMetadataService.findAll(workspace.id);
+  }
+
+  @Query(() => ConnectedAccountDTO, { nullable: true })
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
+  @RequireFeatureFlag(FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED)
+  async connectedAccount(
+    @Args('id', { type: () => UUIDScalarType }) id: string,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<ConnectedAccountDTO | null> {
+    return this.connectedAccountMetadataService.findById(id, workspace.id);
+  }
+
+  @Mutation(() => ConnectedAccountDTO)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
+  @RequireFeatureFlag(FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED)
+  async createConnectedAccount(
+    @Args('input') input: CreateConnectedAccountInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<ConnectedAccountDTO> {
+    return this.connectedAccountMetadataService.create({
+      ...input,
+      workspaceId: workspace.id,
+    });
+  }
+
+  @Mutation(() => ConnectedAccountDTO)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
+  @RequireFeatureFlag(FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED)
+  async updateConnectedAccount(
+    @Args('input') input: UpdateConnectedAccountInput,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<ConnectedAccountDTO> {
+    return this.connectedAccountMetadataService.update(
+      input.id,
+      workspace.id,
+      input.update,
+    );
+  }
+
+  @Mutation(() => ConnectedAccountDTO)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.CONNECTED_ACCOUNTS))
+  @RequireFeatureFlag(FeatureFlagKey.IS_CONNECTED_ACCOUNT_MIGRATED)
+  async deleteConnectedAccount(
+    @Args('id', { type: () => UUIDScalarType }) id: string,
+    @AuthWorkspace() workspace: WorkspaceEntity,
+  ): Promise<ConnectedAccountDTO> {
+    return this.connectedAccountMetadataService.delete(id, workspace.id);
+  }
+}
@@ -0,0 +1,26 @@
+import { assertUnreachable } from 'twenty-shared/utils';
+
+import {
+  NotFoundError,
+  UserInputError,
+} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+import {
+  ConnectedAccountException,
+  ConnectedAccountExceptionCode,
+} from 'src/engine/metadata-modules/connected-account/connected-account.exception';
+
+export const connectedAccountGraphqlApiExceptionHandler = (error: Error) => {
+  if (error instanceof ConnectedAccountException) {
+    switch (error.code) {
+      case ConnectedAccountExceptionCode.CONNECTED_ACCOUNT_NOT_FOUND:
+        throw new NotFoundError(error);
+      case ConnectedAccountExceptionCode.INVALID_CONNECTED_ACCOUNT_INPUT:
+        throw new UserInputError(error);
+      default: {
+        return assertUnreachable(error.code);
+      }
+    }
+  }
+
+  throw error;
+};