Restrict workflow object permissions (#14290)

- workflows should not edit system objects or workflow related objects
- system fields should be usable within variables for reading

packages/twenty-shared/src/workflow/index.ts

@@ -53,4 +53,5 @@ export type {
   WorkflowRunStepInfos,
 } from './types/WorkflowRunStateStepInfos';
 export { StepStatus } from './types/WorkflowRunStateStepInfos';
+export { canObjectBeManagedByWorkflow } from './utils/canObjectBeManagedByWorkflow';
 export { getWorkflowRunContext } from './utils/getWorkflowRunContext';

packages/twenty-shared/src/workflow/utils/canObjectBeManagedByWorkflow.ts

@@ -0,0 +1,18 @@
+export const canObjectBeManagedByWorkflow = ({
+  nameSingular,
+  isSystem,
+}: {
+  nameSingular: string;
+  isSystem: boolean;
+}) => {
+  const excludedNonSystemObjectMetadataItemNames = [
+    'workflow',
+    'workflowVersion',
+    'workflowRun',
+    'dashboard',
+  ];
+
+  return !excludedNonSystemObjectMetadataItemNames.includes(
+    nameSingular,
+  ) && !isSystem;
+};