Unify auth context → role permission config resolution into a single pure utility (#18927)

## Summary

- Consolidates duplicated auth-context-to-role-ID resolution logic
(previously in
`PermissionsService.resolveRolePermissionConfigFromAuthContext` and
`CommonBaseQueryRunnerService.getRoleIdOrThrow`) into a single pure
utility function `resolveRolePermissionConfig` in the ORM layer
- The utility is synchronous and operates on cached data
(`userWorkspaceRoleMap`, `apiKeyRoleMap`) already loaded into the
workspace context — no async calls, no service dependencies
- Adds `apiKeyRoleMap` to `ORMWorkspaceContext` (it was already in the
workspace cache, just not loaded into the ORM context)
- Removes `PermissionsService` dependency from
`NavigationMenuItemRecordIdentifierService`
- Removes `UserRoleService` and `ApiKeyRoleService` injections from
`CommonBaseQueryRunnerService`

## Test plan

- [ ] Existing typecheck passes (`npx nx typecheck twenty-server`)
- [ ] Verify record identifier resolution still works for navigation
menu items (user, system, API key, and application auth contexts)
- [ ] Verify GraphQL CRUD queries still enforce correct role-based
permissions
- [ ] Verify API key authenticated requests resolve permissions
correctly


Made with [Cursor](https://cursor.com)

packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts

@@ -13,10 +13,6 @@ import {
   ApplicationExceptionCode,
 } from 'src/engine/core-modules/application/application.exception';
 import { isApiKeyAuthContext } from 'src/engine/core-modules/auth/guards/is-api-key-auth-context.guard';
-import { isApplicationAuthContext } from 'src/engine/core-modules/auth/guards/is-application-auth-context.guard';
-import { isSystemAuthContext } from 'src/engine/core-modules/auth/guards/is-system-auth-context.guard';
-import { isUserAuthContext } from 'src/engine/core-modules/auth/guards/is-user-auth-context.guard';
-import { type WorkspaceAuthContext } from 'src/engine/core-modules/auth/types/workspace-auth-context.type';
 import { TOOL_PERMISSION_FLAGS } from 'src/engine/metadata-modules/permissions/constants/tool-permission-flags';
 import {
   PermissionsException,
@@ -134,48 +130,6 @@ export class PermissionsService {
       objectsPermissions: {},
     }) as const satisfies UserWorkspacePermissions;
 
-  // TODO: this could likely be handled in the ORM layer
-  public async resolveRolePermissionConfigFromAuthContext(
-    authContext: WorkspaceAuthContext,
-  ): Promise<RolePermissionConfig | null> {
-    const workspaceId = authContext.workspace.id;
-
-    if (isSystemAuthContext(authContext)) {
-      return { shouldBypassPermissionChecks: true };
-    }
-
-    if (isApiKeyAuthContext(authContext)) {
-      const roleId = await this.apiKeyRoleService.getRoleIdForApiKeyId(
-        authContext.apiKey.id,
-        workspaceId,
-      );
-
-      return { intersectionOf: [roleId] };
-    }
-
-    if (
-      isApplicationAuthContext(authContext) &&
-      isDefined(authContext.application.defaultRoleId)
-    ) {
-      return { intersectionOf: [authContext.application.defaultRoleId] };
-    }
-
-    if (isUserAuthContext(authContext)) {
-      const roleId = await this.userRoleService.getRoleIdForUserWorkspace({
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId,
-      });
-
-      if (!isDefined(roleId)) {
-        return null;
-      }
-
-      return { intersectionOf: [roleId] };
-    }
-
-    return null;
-  }
-
   public async userHasWorkspaceSettingPermission({
     userWorkspaceId,
     workspaceId,