Enhance role-check system with stricter checks (#15392)

## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.

packages/twenty-front/src/modules/views/view-picker/components/ViewPickerOptionDropdown.tsx

@@ -1,5 +1,6 @@
 import { useCreateFavorite } from '@/favorites/hooks/useCreateFavorite';
 import { useFavorites } from '@/favorites/hooks/useFavorites';
+import { useHasPermissionFlag } from '@/settings/roles/hooks/useHasPermissionFlag';
 import { DropdownContent } from '@/ui/layout/dropdown/components/DropdownContent';
 import { DropdownMenuItemsContainer } from '@/ui/layout/dropdown/components/DropdownMenuItemsContainer';
 import { useCloseDropdown } from '@/ui/layout/dropdown/hooks/useCloseDropdown';
@@ -10,7 +11,6 @@ import { useDeleteViewFromCurrentState } from '@/views/view-picker/hooks/useDele
 import { useViewPickerMode } from '@/views/view-picker/hooks/useViewPickerMode';
 import { viewPickerReferenceViewIdComponentState } from '@/views/view-picker/states/viewPickerReferenceViewIdComponentState';
 import { useLingui } from '@lingui/react/macro';
-import { useState } from 'react';
 import {
   IconHeart,
   IconLock,
@@ -19,10 +19,20 @@ import {
   useIcons,
 } from 'twenty-ui/display';
 import { MenuItem } from 'twenty-ui/navigation';
+import { ViewVisibility } from '~/generated-metadata/graphql';
+import { PermissionFlagType } from '~/generated/graphql';
 
 type ViewPickerOptionDropdownProps = {
   isIndexView: boolean;
-  view: Pick<View, 'id' | 'name' | 'icon' | '__typename'>;
+  view: Pick<
+    View,
+    | 'id'
+    | 'name'
+    | 'icon'
+    | '__typename'
+    | 'visibility'
+    | 'createdByUserWorkspaceId'
+  >;
   onEdit: (event: React.MouseEvent<HTMLElement>, viewId: string) => void;
   handleViewSelect: (viewId: string) => void;
 };
@@ -38,16 +48,21 @@ export const ViewPickerOptionDropdown = ({
   const { t } = useLingui();
   const { closeDropdown } = useCloseDropdown();
   const { getIcon } = useIcons();
-  const [isHovered, setIsHovered] = useState(false);
   const { deleteViewFromCurrentState } = useDeleteViewFromCurrentState();
   const setViewPickerReferenceViewId = useSetRecoilComponentState(
     viewPickerReferenceViewIdComponentState,
   );
   const { setViewPickerMode } = useViewPickerMode();
+  const hasViewsPermission = useHasPermissionFlag(PermissionFlagType.VIEWS);
 
   const { sortedFavorites: favorites } = useFavorites();
   const { createFavorite } = useCreateFavorite();
 
+  // Users with VIEWS permission can edit all views
+  // Users without VIEWS permission can only edit unlisted views (which are always their own, filtered by backend)
+  const canEditView =
+    hasViewsPermission || view.visibility === ViewVisibility.UNLISTED;
+
   const isFavorite = favorites.some(
     (favorite) =>
       favorite.recordId === view.id && favorite.forWorkspaceMemberId,
@@ -69,18 +84,24 @@ export const ViewPickerOptionDropdown = ({
     closeDropdown(dropdownId);
   };
 
+  const getVisibilityIcon = () => {
+    if (isIndexView) {
+      return IconLock;
+    }
+
+    return null;
+  };
+
+  const shouldShowIconAlways = isIndexView;
+
   return (
     <>
       <MenuItemWithOptionDropdown
         text={view.name}
         LeftIcon={getIcon(view.icon)}
         onClick={() => handleViewSelect(view.id)}
-        isIconDisplayedOnHoverOnly={!isIndexView}
-        RightIcon={!isHovered && isIndexView ? IconLock : null}
-        onMouseEnter={() => setIsHovered(true)}
-        onMouseLeave={() => {
-          setIsHovered(false);
-        }}
+        isIconDisplayedOnHoverOnly={!shouldShowIconAlways}
+        RightIcon={getVisibilityIcon()}
         dropdownPlacement="bottom-start"
         dropdownId={`view-picker-options-${view.id}`}
         dropdownContent={
@@ -100,20 +121,24 @@ export const ViewPickerOptionDropdown = ({
                     onClick={handleAddToFavorites}
                   />
 
-                  <MenuItem
-                    LeftIcon={IconPencil}
-                    text={t`Edit`}
-                    onClick={(event) => {
-                      onEdit(event, view.id);
-                      closeDropdown(dropdownId);
-                    }}
-                  />
-                  <MenuItem
-                    LeftIcon={IconTrash}
-                    text={t`Delete`}
-                    onClick={handleDelete}
-                    accent="danger"
-                  />
+                  {canEditView && (
+                    <>
+                      <MenuItem
+                        LeftIcon={IconPencil}
+                        text={t`Edit`}
+                        onClick={(event) => {
+                          onEdit(event, view.id);
+                          closeDropdown(dropdownId);
+                        }}
+                      />
+                      <MenuItem
+                        LeftIcon={IconTrash}
+                        text={t`Delete`}
+                        onClick={handleDelete}
+                        accent="danger"
+                      />
+                    </>
+                  )}
                 </>
               )}
             </DropdownMenuItemsContainer>