Enhance role-check system with stricter checks (#15392)

## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.

packages/twenty-server/src/engine/core-modules/file/file-upload/file-upload.module.ts

@@ -4,9 +4,10 @@ import { Module } from '@nestjs/common';
 import { FileUploadResolver } from 'src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver';
 import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
 import { FileModule } from 'src/engine/core-modules/file/file.module';
+import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 
 @Module({
-  imports: [FileModule, HttpModule],
+  imports: [FileModule, HttpModule, PermissionsModule],
   providers: [FileUploadService, FileUploadResolver],
   exports: [FileUploadService, FileUploadResolver],
 })

packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.spec.ts

@@ -2,6 +2,7 @@ import { Test, type TestingModule } from '@nestjs/testing';
 
 import { FileUploadService } from 'src/engine/core-modules/file/file-upload/services/file-upload.service';
 import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
+import { PermissionsService } from 'src/engine/metadata-modules/permissions/permissions.service';
 
 import { FileUploadResolver } from './file-upload.resolver';
 
@@ -20,6 +21,10 @@ describe('FileUploadResolver', () => {
           provide: TwentyConfigService,
           useValue: {},
         },
+        {
+          provide: PermissionsService,
+          useValue: {},
+        },
       ],
     }).compile();
 

packages/twenty-server/src/engine/core-modules/file/file-upload/resolvers/file-upload.resolver.ts

@@ -11,7 +11,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
 import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
 import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
 import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
+import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
 import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
+import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
 import { streamToBuffer } from 'src/utils/stream-to-buffer';
 
 @UseGuards(WorkspaceAuthGuard)
@@ -22,6 +24,7 @@ export class FileUploadResolver {
   constructor(private readonly fileUploadService: FileUploadService) {}
 
   @Mutation(() => SignedFileDTO)
+  @UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
   async uploadFile(
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
     @Args({ name: 'file', type: () => GraphQLUpload })
@@ -48,6 +51,7 @@ export class FileUploadResolver {
   }
 
   @Mutation(() => SignedFileDTO)
+  @UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
   async uploadImage(
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
     @Args({ name: 'file', type: () => GraphQLUpload })

packages/twenty-server/src/engine/core-modules/file/file.module.ts

@@ -9,6 +9,7 @@ import { FileAttachmentListener } from 'src/engine/core-modules/file/listeners/f
 import { FileWorkspaceMemberListener } from 'src/engine/core-modules/file/listeners/file-workspace-member.listener';
 import { JwtModule } from 'src/engine/core-modules/jwt/jwt.module';
 import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
+import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 
 import { FileController } from './controllers/file.controller';
 import { FileEntity } from './entities/file.entity';
@@ -22,6 +23,7 @@ import { FileService } from './services/file.service';
     JwtModule,
     TypeOrmModule.forFeature([FileEntity, WorkspaceEntity]),
     HttpModule,
+    PermissionsModule,
   ],
   providers: [
     FileService,

packages/twenty-server/src/engine/core-modules/file/resolvers/file.resolver.ts

@@ -10,7 +10,9 @@ import { PreventNestToAutoLogGraphqlErrorsFilter } from 'src/engine/core-modules
 import { ResolverValidationPipe } from 'src/engine/core-modules/graphql/pipes/resolver-validation.pipe';
 import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
 import { AuthWorkspace } from 'src/engine/decorators/auth/auth-workspace.decorator';
+import { SettingsPermissionsGuard } from 'src/engine/guards/settings-permissions.guard';
 import { WorkspaceAuthGuard } from 'src/engine/guards/workspace-auth.guard';
+import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
 import { streamToBuffer } from 'src/utils/stream-to-buffer';
 
 @UseGuards(WorkspaceAuthGuard)
@@ -21,6 +23,7 @@ export class FileResolver {
   constructor(private readonly fileMetadataService: FileMetadataService) {}
 
   @Mutation(() => FileDTO)
+  @UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
   async createFile(
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
     @Args({ name: 'file', type: () => GraphQLUpload })
@@ -38,6 +41,7 @@ export class FileResolver {
   }
 
   @Mutation(() => FileDTO)
+  @UseGuards(SettingsPermissionsGuard(PermissionFlagType.UPLOAD_FILE))
   async deleteFile(
     @AuthWorkspace() { id: workspaceId }: WorkspaceEntity,
     @Args('fileId', { type: () => UUIDScalarType }) fileId: string,