Enhance role-check system with stricter checks (#15392)

## Overview

This PR strengthens our permission system by introducing more granular
role-based access control across the platform.

## Changes

### New Permissions Added
- **Applications** - Control who can install and manage applications
- **Layouts** - Control who can customize page layouts and UI structure
- **AI** - Control access to AI features and agents
- **Upload File** - Separate permission for file uploads
- **Download File** - Separate permission for file downloads (frontend
visibility)

### Security Enhancements
- Implemented whitelist-based validation for workspace field updates
- Added explicit permission guards to core entity resolvers
- Enhanced ESLint rule to enforce permission checks on all mutations
- Created `CustomPermissionGuard` and `NoPermissionGuard` for better
code documentation

### Affected Components
- Core entity resolvers: webhooks, files, domains, applications,
layouts, postgres credentials
- Workspace update mutations now use whitelist validation
- Settings UI updated with new permission controls

### Developer Experience
- ESLint now catches missing permission guards during development
- Explicit guard markers make permission requirements clear in code
review
- Comprehensive test coverage for new permission logic

## Testing
- ✅ All TypeScript type checks pass
- ✅ ESLint validation passes
- ✅ New permission guards properly enforced
- ✅ Frontend UI displays new permissions correctly

## Migration Notes
Existing workspaces will need to assign the new permissions to roles as
needed. By default, all new permissions are set to `false` for non-admin
roles.

packages/twenty-server/src/engine/metadata-modules/permissions/constants/permission-flag-type.constants.ts

@@ -5,14 +5,22 @@ export enum PermissionFlagType {
   WORKSPACE_MEMBERS = 'WORKSPACE_MEMBERS',
   ROLES = 'ROLES',
   DATA_MODEL = 'DATA_MODEL',
-  ADMIN_PANEL = 'ADMIN_PANEL',
   SECURITY = 'SECURITY',
   WORKFLOWS = 'WORKFLOWS',
   IMPERSONATE = 'IMPERSONATE',
   SSO_BYPASS = 'SSO_BYPASS',
+  APPLICATIONS = 'APPLICATIONS',
+  LAYOUTS = 'LAYOUTS',
+  BILLING = 'BILLING',
+  AI_SETTINGS = 'AI_SETTINGS',
 
   // Tool permissions
+  AI = 'AI',
+  VIEWS = 'VIEWS',
+  UPLOAD_FILE = 'UPLOAD_FILE',
+  DOWNLOAD_FILE = 'DOWNLOAD_FILE',
   SEND_EMAIL_TOOL = 'SEND_EMAIL_TOOL',
   IMPORT_CSV = 'IMPORT_CSV',
   EXPORT_CSV = 'EXPORT_CSV',
+  CONNECTED_ACCOUNTS = 'CONNECTED_ACCOUNTS',
 }

packages/twenty-server/src/engine/metadata-modules/permissions/constants/tool-permission-flags.ts

@@ -1,5 +1,10 @@
 export const TOOL_PERMISSION_FLAGS = [
+  'AI',
+  'VIEWS',
+  'UPLOAD_FILE',
+  'DOWNLOAD_FILE',
   'SEND_EMAIL_TOOL',
   'IMPORT_CSV',
   'EXPORT_CSV',
+  'CONNECTED_ACCOUNTS',
 ];

packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts

@@ -98,12 +98,20 @@ export class PermissionsService {
         [PermissionFlagType.WORKSPACE_MEMBERS]: false,
         [PermissionFlagType.ROLES]: false,
         [PermissionFlagType.DATA_MODEL]: false,
-        [PermissionFlagType.ADMIN_PANEL]: false,
         [PermissionFlagType.SECURITY]: false,
         [PermissionFlagType.WORKFLOWS]: false,
+        [PermissionFlagType.APPLICATIONS]: false,
+        [PermissionFlagType.LAYOUTS]: false,
+        [PermissionFlagType.VIEWS]: false,
+        [PermissionFlagType.BILLING]: false,
+        [PermissionFlagType.AI_SETTINGS]: false,
+        [PermissionFlagType.AI]: false,
+        [PermissionFlagType.UPLOAD_FILE]: false,
+        [PermissionFlagType.DOWNLOAD_FILE]: false,
         [PermissionFlagType.SEND_EMAIL_TOOL]: false,
         [PermissionFlagType.IMPORT_CSV]: false,
         [PermissionFlagType.EXPORT_CSV]: false,
+        [PermissionFlagType.CONNECTED_ACCOUNTS]: false,
         [PermissionFlagType.IMPERSONATE]: false,
         [PermissionFlagType.SSO_BYPASS]: false,
       },

packages/twenty-server/src/engine/metadata-modules/permissions/utils/__tests__/permission-graphql-api-exception-handler.util.spec.ts

@@ -0,0 +1,101 @@
+import {
+  ForbiddenError,
+  NotFoundError,
+  UserInputError,
+} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';
+import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
+
+describe('permissionGraphqlApiExceptionHandler', () => {
+  it('should throw ForbiddenError for PERMISSION_DENIED', () => {
+    const exception = new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      ForbiddenError,
+    );
+  });
+
+  it('should throw ForbiddenError for role-related forbidden cases', () => {
+    const exception = new PermissionsException(
+      'Cannot update self',
+      PermissionsExceptionCode.CANNOT_UPDATE_SELF_ROLE,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      ForbiddenError,
+    );
+  });
+
+  it('should throw UserInputError for INVALID_ARG', () => {
+    const exception = new PermissionsException(
+      'Invalid argument',
+      PermissionsExceptionCode.INVALID_ARG,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      UserInputError,
+    );
+  });
+
+  it('should throw UserInputError for permission validation errors', () => {
+    const exception = new PermissionsException(
+      'Empty field permission',
+      PermissionsExceptionCode.EMPTY_FIELD_PERMISSION_NOT_ALLOWED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      UserInputError,
+    );
+  });
+
+  it('should throw NotFoundError for ROLE_NOT_FOUND', () => {
+    const exception = new PermissionsException(
+      'Role not found',
+      PermissionsExceptionCode.ROLE_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      NotFoundError,
+    );
+  });
+
+  it('should throw NotFoundError for metadata not found cases', () => {
+    const exception = new PermissionsException(
+      'Object metadata not found',
+      PermissionsExceptionCode.OBJECT_METADATA_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      NotFoundError,
+    );
+  });
+
+  it('should rethrow exception for METHOD_NOT_ALLOWED', () => {
+    const exception = new PermissionsException(
+      'Method not allowed',
+      PermissionsExceptionCode.METHOD_NOT_ALLOWED,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      exception,
+    );
+  });
+
+  it('should rethrow exception for internal error codes', () => {
+    const exception = new PermissionsException(
+      'Default role not found',
+      PermissionsExceptionCode.DEFAULT_ROLE_NOT_FOUND,
+    );
+
+    expect(() => permissionGraphqlApiExceptionHandler(exception)).toThrow(
+      exception,
+    );
+  });
+});