[permissions] QA fixes (#13698)

In this PR

- Introduction of readableFields and updatableFields in
objectMetadataItem selector to ease filtering from a developer
experience perspective ( + to help developers think to do it). In
discussion @lucasbordeau @charlesBochet
- Remove non-updatable field from CSV import process (@etiennejouan)
- QA fix / Non-readable fields should not show on show page
- QA fix / It should not be offered to create a kanban view on a
non-readable field
- QA fix / It should not be offered to create view groups on a
non-readable field
- QA fix / Rating field should have a readonly mode

---------

Co-authored-by: Charles Bochet <charles@twenty.com>

packages/twenty-server/src/engine/api/rest/core/interfaces/rest-api-base.handler.ts

@@ -3,7 +3,10 @@ import { BadRequestException, Inject } from '@nestjs/common';
 import { Request } from 'express';
 import chunk from 'lodash.chunk';
 import isEmpty from 'lodash.isempty';
-import { FieldMetadataType, RestrictedFields } from 'twenty-shared/types';
+import {
+  FieldMetadataType,
+  RestrictedFieldsPermissions,
+} from 'twenty-shared/types';
 import { capitalize, isDefined } from 'twenty-shared/utils';
 import { In, ObjectLiteral } from 'typeorm';
 
@@ -185,7 +188,7 @@ export abstract class RestApiBaseHandler {
       roleId,
     );
 
-    let restrictedFields: RestrictedFields = {};
+    let restrictedFields: RestrictedFieldsPermissions = {};
 
     if (
       await this.featureFlagService.isFeatureEnabled(
@@ -298,7 +301,7 @@ export abstract class RestApiBaseHandler {
       objectMetadataMapItem: ObjectMetadataItemWithFieldMaps;
     };
     depth: Depth | undefined;
-    restrictedFields: RestrictedFields;
+    restrictedFields: RestrictedFieldsPermissions;
   }) {
     const relations = this.getRelations({
       objectMetadata,
@@ -415,7 +418,7 @@ export abstract class RestApiBaseHandler {
     };
     objectMetadataItemWithFieldsMaps: ObjectMetadataItemWithFieldMaps;
     extraFilters?: Partial<ObjectRecordFilter>;
-    restrictedFields: RestrictedFields;
+    restrictedFields: RestrictedFieldsPermissions;
   }) {
     const objectMetadataNameSingular =
       objectMetadata.objectMetadataMapItem.nameSingular;

packages/twenty-server/src/engine/api/utils/get-all-selectable-fields.utils.ts

@@ -1,16 +1,18 @@
-import { RestrictedFields } from 'twenty-shared/types';
+import { RestrictedFieldsPermissions } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 
 import { ObjectMetadataItemWithFieldMaps } from 'src/engine/metadata-modules/types/object-metadata-item-with-field-maps';
 import { getFieldMetadataIdToColumnNamesMap } from 'src/engine/twenty-orm/utils/get-field-metadata-id-to-column-names-map.util';
 
+type GetAllSelectableFieldsArgs = {
+  restrictedFields: RestrictedFieldsPermissions;
+  objectMetadata: { objectMetadataMapItem: ObjectMetadataItemWithFieldMaps };
+};
+
 export const getAllSelectableFields = ({
   restrictedFields,
   objectMetadata,
-}: {
-  restrictedFields: RestrictedFields;
-  objectMetadata: { objectMetadataMapItem: ObjectMetadataItemWithFieldMaps };
-}) => {
+}: GetAllSelectableFieldsArgs) => {
   const restrictedFieldsIds = Object.entries(restrictedFields)
     .filter(([_, value]) => value.canRead === false)
     .map(([key]) => key);

packages/twenty-server/src/engine/metadata-modules/object-permission/dtos/object-permission.dto.ts

@@ -1,7 +1,7 @@
 import { Field, ObjectType } from '@nestjs/graphql';
 
 import GraphQLJSON from 'graphql-type-json';
-import { RestrictedFields } from 'twenty-shared/types';
+import { RestrictedFieldsPermissions } from 'twenty-shared/types';
 
 import { UUIDScalarType } from 'src/engine/api/graphql/workspace-schema-builder/graphql-types/scalars';
 
@@ -25,5 +25,5 @@ export class ObjectPermissionDTO {
   @Field(() => GraphQLJSON, {
     nullable: true,
   })
-  restrictedFields?: RestrictedFields;
+  restrictedFields?: RestrictedFieldsPermissions;
 }

packages/twenty-server/src/engine/metadata-modules/object-permission/field-permission/__tests__/field-permissions.service.spec.ts

@@ -1,7 +1,7 @@
 import { Test, TestingModule } from '@nestjs/testing';
 import { getRepositoryToken } from '@nestjs/typeorm';
 
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import { In, Repository } from 'typeorm';
 
 import {
@@ -53,7 +53,7 @@ describe('FieldPermissionService', () => {
     isEditable: true,
   } as RoleEntity;
 
-  const mockRolesPermissions: ObjectRecordsPermissionsByRoleId = {
+  const mockRolesPermissions: ObjectsPermissionsByRoleIdDeprecated = {
     [testRoleId]: {
       [testObjectMetadataId]: {
         canRead: true,

packages/twenty-server/src/engine/metadata-modules/object-permission/field-permission/field-permission.service.ts

@@ -1,7 +1,7 @@
 import { Injectable } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { In, Repository } from 'typeorm';
 
@@ -176,7 +176,7 @@ export class FieldPermissionService {
   }: {
     fieldPermission: UpsertFieldPermissionsInput['fieldPermissions'][0];
     objectMetadataMapsById: ObjectMetadataMaps['byId'];
-    rolesPermissions: ObjectRecordsPermissionsByRoleId;
+    rolesPermissions: ObjectsPermissionsByRoleIdDeprecated;
     role: RoleEntity;
   }) {
     if (

packages/twenty-server/src/engine/metadata-modules/permissions/types/user-workspace-permissions.ts

@@ -1,10 +1,10 @@
 import { PermissionsOnAllObjectRecords } from 'twenty-shared/constants';
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 
 import { PermissionFlagType } from 'src/engine/metadata-modules/permissions/constants/permission-flag-type.constants';
 
 export type UserWorkspacePermissions = {
   permissionFlags: Record<PermissionFlagType, boolean>;
   objectRecordsPermissions: Record<PermissionsOnAllObjectRecords, boolean>;
-  objectPermissions: ObjectRecordsPermissions;
+  objectPermissions: ObjectsPermissionsDeprecated;
 };

packages/twenty-server/src/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache-storage.service.ts

@@ -1,6 +1,6 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import { v4 } from 'uuid';
 
 import { InjectCacheStorage } from 'src/engine/core-modules/cache-storage/decorators/cache-storage.decorator';
@@ -34,12 +34,12 @@ export class WorkspacePermissionsCacheStorageService {
 
   async setRolesPermissions(
     workspaceId: string,
-    permissions: ObjectRecordsPermissionsByRoleId,
+    permissions: ObjectsPermissionsByRoleIdDeprecated,
   ): Promise<{
     newRolesPermissionsVersion: string;
   }> {
     const [, newRolesPermissionsVersion] = await Promise.all([
-      this.cacheStorageService.set<ObjectRecordsPermissionsByRoleId>(
+      this.cacheStorageService.set<ObjectsPermissionsByRoleIdDeprecated>(
         `${WorkspaceCacheKeys.MetadataPermissionsRolesPermissions}:${workspaceId}`,
         permissions,
         TTL_INFINITE,
@@ -52,8 +52,8 @@ export class WorkspacePermissionsCacheStorageService {
 
   getRolesPermissions(
     workspaceId: string,
-  ): Promise<ObjectRecordsPermissionsByRoleId | undefined> {
-    return this.cacheStorageService.get<ObjectRecordsPermissionsByRoleId>(
+  ): Promise<ObjectsPermissionsByRoleIdDeprecated | undefined> {
+    return this.cacheStorageService.get<ObjectsPermissionsByRoleIdDeprecated>(
       `${WorkspaceCacheKeys.MetadataPermissionsRolesPermissions}:${workspaceId}`,
     );
   }

packages/twenty-server/src/engine/metadata-modules/workspace-permissions-cache/workspace-permissions-cache.service.ts

@@ -2,9 +2,9 @@ import { Injectable, Logger } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 
 import {
-  ObjectRecordsPermissions,
-  ObjectRecordsPermissionsByRoleId,
-  RestrictedFields,
+  ObjectsPermissionsByRoleIdDeprecated,
+  ObjectsPermissionsDeprecated,
+  RestrictedFieldsPermissions,
 } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { In, IsNull, Not, Repository } from 'typeorm';
@@ -51,7 +51,9 @@ export class WorkspacePermissionsCacheService {
     workspaceId: string;
     roleIds?: string[];
   }): Promise<void> {
-    let currentRolesPermissions: ObjectRecordsPermissionsByRoleId | undefined;
+    let currentRolesPermissions:
+      | ObjectsPermissionsByRoleIdDeprecated
+      | undefined;
 
     if (roleIds) {
       currentRolesPermissions =
@@ -103,8 +105,11 @@ export class WorkspacePermissionsCacheService {
     workspaceId,
   }: {
     workspaceId: string;
-  }): Promise<CacheResult<string, ObjectRecordsPermissionsByRoleId>> {
-    return getFromCacheWithRecompute<string, ObjectRecordsPermissionsByRoleId>({
+  }): Promise<CacheResult<string, ObjectsPermissionsByRoleIdDeprecated>> {
+    return getFromCacheWithRecompute<
+      string,
+      ObjectsPermissionsByRoleIdDeprecated
+    >({
       workspaceId,
       getCacheData: () =>
         this.workspacePermissionsCacheStorageService.getRolesPermissions(
@@ -166,7 +171,7 @@ export class WorkspacePermissionsCacheService {
   }: {
     workspaceId: string;
     roleIds?: string[];
-  }): Promise<ObjectRecordsPermissionsByRoleId> {
+  }): Promise<ObjectsPermissionsByRoleIdDeprecated> {
     let roles: RoleEntity[] = [];
 
     const workspaceFeatureFlagsMap =
@@ -192,10 +197,10 @@ export class WorkspacePermissionsCacheService {
     const workspaceObjectMetadataCollection =
       await this.getWorkspaceObjectMetadataCollection(workspaceId);
 
-    const permissionsByRoleId: ObjectRecordsPermissionsByRoleId = {};
+    const permissionsByRoleId: ObjectsPermissionsByRoleIdDeprecated = {};
 
     for (const role of roles) {
-      const objectRecordsPermissions: ObjectRecordsPermissions = {};
+      const objectRecordsPermissions: ObjectsPermissionsDeprecated = {};
 
       for (const objectMetadata of workspaceObjectMetadataCollection) {
         const { id: objectMetadataId, isSystem, standardId } = objectMetadata;
@@ -204,7 +209,7 @@ export class WorkspacePermissionsCacheService {
         let canUpdate = role.canUpdateAllObjectRecords;
         let canSoftDelete = role.canSoftDeleteAllObjectRecords;
         let canDestroy = role.canDestroyAllObjectRecords;
-        const restrictedFields: RestrictedFields = {};
+        const restrictedFields: RestrictedFieldsPermissions = {};
 
         if (
           standardId &&

packages/twenty-server/src/engine/twenty-orm/datasource/workspace.datasource.ts

@@ -1,6 +1,6 @@
 import { Entity } from '@microsoft/microsoft-graph-types';
 import { isDefined } from 'class-validator';
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import {
   DataSource,
   DataSourceOptions,
@@ -34,7 +34,7 @@ export class WorkspaceDataSource extends DataSource {
   featureFlagMapVersion: string;
   featureFlagMap: FeatureFlagMap;
   rolesPermissionsVersion: string;
-  permissionsPerRoleId: ObjectRecordsPermissionsByRoleId;
+  permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated;
   dataSourceWithOverridenCreateQueryBuilder: WorkspaceDataSource;
 
   constructor(
@@ -43,7 +43,7 @@ export class WorkspaceDataSource extends DataSource {
     featureFlagMapVersion: string,
     featureFlagMap: FeatureFlagMap,
     rolesPermissionsVersion: string,
-    permissionsPerRoleId: ObjectRecordsPermissionsByRoleId,
+    permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated,
   ) {
     super(options);
     this.internalContext = internalContext;
@@ -235,7 +235,9 @@ export class WorkspaceDataSource extends DataSource {
     this.rolesPermissionsVersion = rolesPermissionsVersion;
   }
 
-  setRolesPermissions(permissionsPerRoleId: ObjectRecordsPermissionsByRoleId) {
+  setRolesPermissions(
+    permissionsPerRoleId: ObjectsPermissionsByRoleIdDeprecated,
+  ) {
     this.permissionsPerRoleId = permissionsPerRoleId;
   }
 

packages/twenty-server/src/engine/twenty-orm/entity-manager/workspace-entity-manager.spec.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { EntityManager } from 'typeorm';
 import { EntityPersistExecutor } from 'typeorm/persistence/EntityPersistExecutor';
 import { PlainObjectToDatabaseEntityTransformer } from 'typeorm/query-builder/transformer/PlainObjectToDatabaseEntityTransformer';
@@ -75,7 +75,7 @@ describe('WorkspaceEntityManager', () => {
   let mockDataSource: WorkspaceDataSource;
   let mockPermissionOptions: {
     shouldBypassPermissionChecks: boolean;
-    objectRecordsPermissions?: ObjectRecordsPermissions;
+    objectRecordsPermissions?: ObjectsPermissionsDeprecated;
   };
 
   beforeEach(() => {
@@ -331,8 +331,7 @@ describe('WorkspaceEntityManager', () => {
         isFieldPermissionsEnabled: true,
         operationType: 'update',
         objectMetadataMaps: mockInternalContext.objectMetadataMaps,
-        objectRecordsPermissions:
-          mockPermissionOptions.objectRecordsPermissions,
+        objectsPermissions: mockPermissionOptions.objectRecordsPermissions,
         selectedColumns: [],
         allFieldsSelected: false,
         updatedColumns: [],
@@ -366,8 +365,7 @@ describe('WorkspaceEntityManager', () => {
         operationType: 'delete',
         isFieldPermissionsEnabled: true,
         objectMetadataMaps: mockInternalContext.objectMetadataMaps,
-        objectRecordsPermissions:
-          mockPermissionOptions.objectRecordsPermissions,
+        objectsPermissions: mockPermissionOptions.objectRecordsPermissions,
         selectedColumns: [],
         allFieldsSelected: false,
         updatedColumns: [],

packages/twenty-server/src/engine/twenty-orm/entity-manager/workspace-entity-manager.ts

@@ -1,5 +1,5 @@
 import isEmpty from 'lodash.isempty';
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   DeleteResult,
@@ -58,7 +58,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 
 type PermissionOptions = {
   shouldBypassPermissionChecks?: boolean;
-  objectRecordsPermissions?: ObjectRecordsPermissions;
+  objectRecordsPermissions?: ObjectsPermissionsDeprecated;
 };
 
 export class WorkspaceEntityManager extends EntityManager {
@@ -130,7 +130,7 @@ export class WorkspaceEntityManager extends EntityManager {
     queryRunner?: QueryRunner,
     options: {
       shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
     } = {
       shouldBypassPermissionChecks: false,
       objectRecordsPermissions: {},
@@ -198,7 +198,7 @@ export class WorkspaceEntityManager extends EntityManager {
     conflictPathsOrOptions: string[] | UpsertOptions<Entity>,
     permissionOptions?: {
       shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
     },
     selectedColumns: string[] | '*' = '*',
   ): Promise<InsertResult> {
@@ -387,7 +387,7 @@ export class WorkspaceEntityManager extends EntityManager {
     operationType: OperationType;
     permissionOptions?: {
       shouldBypassPermissionChecks?: boolean;
-      objectRecordsPermissions?: ObjectRecordsPermissions;
+      objectRecordsPermissions?: ObjectsPermissionsDeprecated;
     };
     selectedColumns: string[];
     updatedColumns?: string[];
@@ -404,8 +404,7 @@ export class WorkspaceEntityManager extends EntityManager {
     validateOperationIsPermittedOrThrow({
       entityName,
       operationType,
-      objectRecordsPermissions:
-        permissionOptions?.objectRecordsPermissions ?? {},
+      objectsPermissions: permissionOptions?.objectRecordsPermissions ?? {},
       objectMetadataMaps: this.internalContext.objectMetadataMaps,
       selectedColumns,
       allFieldsSelected: false,

packages/twenty-server/src/engine/twenty-orm/factories/workspace-datasource.factory.ts

@@ -1,7 +1,7 @@
 import { Injectable, Logger } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 
-import { ObjectRecordsPermissionsByRoleId } from 'twenty-shared/types';
+import { ObjectsPermissionsByRoleIdDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { EntitySchema, Repository } from 'typeorm';
 
@@ -256,8 +256,11 @@ export class WorkspaceDatasourceFactory {
     workspaceId,
   }: {
     workspaceId: string;
-  }): Promise<CacheResult<string, ObjectRecordsPermissionsByRoleId>> {
-    return getFromCacheWithRecompute<string, ObjectRecordsPermissionsByRoleId>({
+  }): Promise<CacheResult<string, ObjectsPermissionsByRoleIdDeprecated>> {
+    return getFromCacheWithRecompute<
+      string,
+      ObjectsPermissionsByRoleIdDeprecated
+    >({
       workspaceId,
       getCacheData: () =>
         this.workspacePermissionsCacheStorageService.getRolesPermissions(
@@ -310,7 +313,7 @@ export class WorkspaceDatasourceFactory {
   }: {
     workspaceDataSource: WorkspaceDataSource;
     cachedRolesPermissionsVersion: string;
-    cachedRolesPermissions: ObjectRecordsPermissionsByRoleId;
+    cachedRolesPermissions: ObjectsPermissionsByRoleIdDeprecated;
   }): Promise<void> {
     this.updateWorkspaceDataSourceIfNeeded({
       workspaceDataSource,

packages/twenty-server/src/engine/twenty-orm/repository/__tests__/workspace.repository.spec.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeepPartial,
   FindManyOptions,
@@ -20,7 +20,7 @@ describe('WorkspaceRepository', () => {
   let mockEntityManager: jest.Mocked<WorkspaceEntityManager>;
   let mockInternalContext: WorkspaceInternalContext;
   let mockFeatureFlagMap: FeatureFlagMap;
-  let mockObjectRecordsPermissions: ObjectRecordsPermissions;
+  let mockObjectRecordsPermissions: ObjectsPermissionsDeprecated;
   let mockQueryRunner: QueryRunner;
 
   beforeEach(() => {

packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts

@@ -1,8 +1,8 @@
 import { isNonEmptyString } from '@sniptt/guards';
 import isEmpty from 'lodash.isempty';
 import {
-  ObjectRecordsPermissions,
-  RestrictedFields,
+  ObjectsPermissionsDeprecated,
+  RestrictedFieldsPermissions,
 } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { QueryExpressionMap } from 'typeorm/query-builder/QueryExpressionMap';
@@ -35,25 +35,27 @@ export type OperationType =
   | 'restore'
   | 'soft-delete';
 
-export const validateOperationIsPermittedOrThrow = ({
-  entityName,
-  operationType,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  selectedColumns,
-  isFieldPermissionsEnabled,
-  allFieldsSelected,
-  updatedColumns,
-}: {
+type ValidateOperationIsPermittedOrThrowArgs = {
   entityName: string;
   operationType: OperationType;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
   objectMetadataMaps: ObjectMetadataMaps;
   selectedColumns: string[] | '*';
   isFieldPermissionsEnabled?: boolean;
   allFieldsSelected: boolean;
   updatedColumns: string[];
-}) => {
+};
+
+export const validateOperationIsPermittedOrThrow = ({
+  entityName,
+  operationType,
+  objectsPermissions,
+  objectMetadataMaps,
+  selectedColumns,
+  isFieldPermissionsEnabled,
+  allFieldsSelected,
+  updatedColumns,
+}: ValidateOperationIsPermittedOrThrowArgs) => {
   const objectMetadataIdForEntity =
     objectMetadataMaps.idByNameSingular[entityName];
 
@@ -83,8 +85,7 @@ export const validateOperationIsPermittedOrThrow = ({
     ? getColumnNameToFieldMetadataIdMap(objectMetadata)
     : {};
 
-  const permissionsForEntity =
-    objectRecordsPermissions[objectMetadataIdForEntity];
+  const permissionsForEntity = objectsPermissions[objectMetadataIdForEntity];
 
   switch (operationType) {
     case 'select':
@@ -174,19 +175,21 @@ export const validateOperationIsPermittedOrThrow = ({
   }
 };
 
-export const validateQueryIsPermittedOrThrow = ({
-  expressionMap,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  shouldBypassPermissionChecks,
-  isFieldPermissionsEnabled,
-}: {
+type ValidateQueryIsPermittedOrThrowArgs = {
   expressionMap: QueryExpressionMap;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
   objectMetadataMaps: ObjectMetadataMaps;
   shouldBypassPermissionChecks: boolean;
   isFieldPermissionsEnabled?: boolean;
-}) => {
+};
+
+export const validateQueryIsPermittedOrThrow = ({
+  expressionMap,
+  objectsPermissions,
+  objectMetadataMaps,
+  shouldBypassPermissionChecks,
+  isFieldPermissionsEnabled,
+}: ValidateQueryIsPermittedOrThrowArgs) => {
   if (shouldBypassPermissionChecks) {
     return;
   }
@@ -232,7 +235,7 @@ export const validateQueryIsPermittedOrThrow = ({
   validateOperationIsPermittedOrThrow({
     entityName: mainEntity,
     operationType: operationType as OperationType,
-    objectRecordsPermissions,
+    objectsPermissions,
     objectMetadataMaps,
     selectedColumns,
     isFieldPermissionsEnabled,
@@ -247,7 +250,7 @@ const validateReadFieldPermissionOrThrow = ({
   columnNameToFieldMetadataIdMap,
   allFieldsSelected,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
   selectedColumns: string[] | '*';
   columnNameToFieldMetadataIdMap: Record<string, string>;
   allFieldsSelected?: boolean;
@@ -290,7 +293,7 @@ const validateUpdateFieldPermissionOrThrow = ({
   updatedColumns,
   columnNameToFieldMetadataIdMap,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
   updatedColumns: string[];
   columnNameToFieldMetadataIdMap: Record<string, string>;
 }) => {

packages/twenty-server/src/engine/twenty-orm/repository/workspace-delete-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeleteQueryBuilder,
   DeleteResult,
@@ -29,14 +29,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceDeleteQueryBuilder<
   T extends ObjectLiteral,
 > extends DeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
   private featureFlagMap?: FeatureFlagMap;
   constructor(
     queryBuilder: DeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceDeleteQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-insert-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   EntityTarget,
@@ -35,7 +35,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceInsertQueryBuilder<
   T extends ObjectLiteral,
 > extends InsertQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -47,7 +47,7 @@ export class WorkspaceInsertQueryBuilder<
 
   constructor(
     queryBuilder: InsertQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -104,7 +104,7 @@ export class WorkspaceInsertQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-select-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { EntityTarget, ObjectLiteral, SelectQueryBuilder } from 'typeorm';
 import { QueryDeepPartialEntity } from 'typeorm/query-builder/QueryPartialEntity';
 
@@ -27,14 +27,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSelectQueryBuilder<
   T extends ObjectLiteral,
 > extends SelectQueryBuilder<T> {
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectRecordsPermissions: ObjectsPermissionsDeprecated;
   shouldBypassPermissionChecks: boolean;
   internalContext: WorkspaceInternalContext;
   authContext?: AuthContext;
   featureFlagMap?: FeatureFlagMap;
   constructor(
     queryBuilder: SelectQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -322,7 +322,7 @@ export class WorkspaceSelectQueryBuilder<
 
     validateQueryIsPermittedOrThrow({
       expressionMap: this.expressionMap,
-      objectRecordsPermissions: this.objectRecordsPermissions,
+      objectsPermissions: this.objectRecordsPermissions,
       objectMetadataMaps: this.internalContext.objectMetadataMaps,
       shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
       isFieldPermissionsEnabled,

packages/twenty-server/src/engine/twenty-orm/repository/workspace-soft-delete-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   EntityTarget,
   InsertQueryBuilder,
@@ -28,7 +28,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSoftDeleteQueryBuilder<
   T extends ObjectLiteral,
 > extends SoftDeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -36,7 +36,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
 
   constructor(
     queryBuilder: SoftDeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-update-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   EntityTarget,
@@ -34,7 +34,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceUpdateQueryBuilder<
   T extends ObjectLiteral,
 > extends UpdateQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -50,7 +50,7 @@ export class WorkspaceUpdateQueryBuilder<
 
   constructor(
     queryBuilder: UpdateQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -88,7 +88,7 @@ export class WorkspaceUpdateQueryBuilder<
 
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:
@@ -194,7 +194,7 @@ export class WorkspaceUpdateQueryBuilder<
 
         validateQueryIsPermittedOrThrow({
           expressionMap: fakeExpressionMapToValidatePermissions,
-          objectRecordsPermissions: this.objectRecordsPermissions,
+          objectsPermissions: this.objectRecordsPermissions,
           objectMetadataMaps: this.internalContext.objectMetadataMaps,
           shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
           isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace.repository.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeepPartial,
   DeleteResult,
@@ -40,7 +40,7 @@ export class WorkspaceRepository<
   private readonly internalContext: WorkspaceInternalContext;
   private shouldBypassPermissionChecks: boolean;
   private featureFlagMap: FeatureFlagMap;
-  public readonly objectRecordsPermissions?: ObjectRecordsPermissions;
+  public readonly objectRecordsPermissions?: ObjectsPermissionsDeprecated;
   private authContext?: AuthContext;
   declare manager: WorkspaceEntityManager;
 
@@ -50,7 +50,7 @@ export class WorkspaceRepository<
     manager: WorkspaceEntityManager,
     featureFlagMap: FeatureFlagMap,
     queryRunner?: QueryRunner,
-    objectRecordsPermissions?: ObjectRecordsPermissions,
+    objectRecordsPermissions?: ObjectsPermissionsDeprecated,
     shouldBypassPermissionChecks = false,
     authContext?: AuthContext,
   ) {