[permissions] QA fixes (#13698)

In this PR

- Introduction of readableFields and updatableFields in
objectMetadataItem selector to ease filtering from a developer
experience perspective ( + to help developers think to do it). In
discussion @lucasbordeau @charlesBochet
- Remove non-updatable field from CSV import process (@etiennejouan)
- QA fix / Non-readable fields should not show on show page
- QA fix / It should not be offered to create a kanban view on a
non-readable field
- QA fix / It should not be offered to create view groups on a
non-readable field
- QA fix / Rating field should have a readonly mode

---------

Co-authored-by: Charles Bochet <charles@twenty.com>

packages/twenty-server/src/engine/twenty-orm/repository/__tests__/workspace.repository.spec.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeepPartial,
   FindManyOptions,
@@ -20,7 +20,7 @@ describe('WorkspaceRepository', () => {
   let mockEntityManager: jest.Mocked<WorkspaceEntityManager>;
   let mockInternalContext: WorkspaceInternalContext;
   let mockFeatureFlagMap: FeatureFlagMap;
-  let mockObjectRecordsPermissions: ObjectRecordsPermissions;
+  let mockObjectRecordsPermissions: ObjectsPermissionsDeprecated;
   let mockQueryRunner: QueryRunner;
 
   beforeEach(() => {

packages/twenty-server/src/engine/twenty-orm/repository/permissions.utils.ts

@@ -1,8 +1,8 @@
 import { isNonEmptyString } from '@sniptt/guards';
 import isEmpty from 'lodash.isempty';
 import {
-  ObjectRecordsPermissions,
-  RestrictedFields,
+  ObjectsPermissionsDeprecated,
+  RestrictedFieldsPermissions,
 } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import { QueryExpressionMap } from 'typeorm/query-builder/QueryExpressionMap';
@@ -35,25 +35,27 @@ export type OperationType =
   | 'restore'
   | 'soft-delete';
 
-export const validateOperationIsPermittedOrThrow = ({
-  entityName,
-  operationType,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  selectedColumns,
-  isFieldPermissionsEnabled,
-  allFieldsSelected,
-  updatedColumns,
-}: {
+type ValidateOperationIsPermittedOrThrowArgs = {
   entityName: string;
   operationType: OperationType;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
   objectMetadataMaps: ObjectMetadataMaps;
   selectedColumns: string[] | '*';
   isFieldPermissionsEnabled?: boolean;
   allFieldsSelected: boolean;
   updatedColumns: string[];
-}) => {
+};
+
+export const validateOperationIsPermittedOrThrow = ({
+  entityName,
+  operationType,
+  objectsPermissions,
+  objectMetadataMaps,
+  selectedColumns,
+  isFieldPermissionsEnabled,
+  allFieldsSelected,
+  updatedColumns,
+}: ValidateOperationIsPermittedOrThrowArgs) => {
   const objectMetadataIdForEntity =
     objectMetadataMaps.idByNameSingular[entityName];
 
@@ -83,8 +85,7 @@ export const validateOperationIsPermittedOrThrow = ({
     ? getColumnNameToFieldMetadataIdMap(objectMetadata)
     : {};
 
-  const permissionsForEntity =
-    objectRecordsPermissions[objectMetadataIdForEntity];
+  const permissionsForEntity = objectsPermissions[objectMetadataIdForEntity];
 
   switch (operationType) {
     case 'select':
@@ -174,19 +175,21 @@ export const validateOperationIsPermittedOrThrow = ({
   }
 };
 
-export const validateQueryIsPermittedOrThrow = ({
-  expressionMap,
-  objectRecordsPermissions,
-  objectMetadataMaps,
-  shouldBypassPermissionChecks,
-  isFieldPermissionsEnabled,
-}: {
+type ValidateQueryIsPermittedOrThrowArgs = {
   expressionMap: QueryExpressionMap;
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectsPermissions: ObjectsPermissionsDeprecated;
   objectMetadataMaps: ObjectMetadataMaps;
   shouldBypassPermissionChecks: boolean;
   isFieldPermissionsEnabled?: boolean;
-}) => {
+};
+
+export const validateQueryIsPermittedOrThrow = ({
+  expressionMap,
+  objectsPermissions,
+  objectMetadataMaps,
+  shouldBypassPermissionChecks,
+  isFieldPermissionsEnabled,
+}: ValidateQueryIsPermittedOrThrowArgs) => {
   if (shouldBypassPermissionChecks) {
     return;
   }
@@ -232,7 +235,7 @@ export const validateQueryIsPermittedOrThrow = ({
   validateOperationIsPermittedOrThrow({
     entityName: mainEntity,
     operationType: operationType as OperationType,
-    objectRecordsPermissions,
+    objectsPermissions,
     objectMetadataMaps,
     selectedColumns,
     isFieldPermissionsEnabled,
@@ -247,7 +250,7 @@ const validateReadFieldPermissionOrThrow = ({
   columnNameToFieldMetadataIdMap,
   allFieldsSelected,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
   selectedColumns: string[] | '*';
   columnNameToFieldMetadataIdMap: Record<string, string>;
   allFieldsSelected?: boolean;
@@ -290,7 +293,7 @@ const validateUpdateFieldPermissionOrThrow = ({
   updatedColumns,
   columnNameToFieldMetadataIdMap,
 }: {
-  restrictedFields: RestrictedFields;
+  restrictedFields: RestrictedFieldsPermissions;
   updatedColumns: string[];
   columnNameToFieldMetadataIdMap: Record<string, string>;
 }) => {

packages/twenty-server/src/engine/twenty-orm/repository/workspace-delete-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeleteQueryBuilder,
   DeleteResult,
@@ -29,14 +29,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceDeleteQueryBuilder<
   T extends ObjectLiteral,
 > extends DeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
   private featureFlagMap?: FeatureFlagMap;
   constructor(
     queryBuilder: DeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceDeleteQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-insert-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   EntityTarget,
@@ -35,7 +35,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceInsertQueryBuilder<
   T extends ObjectLiteral,
 > extends InsertQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -47,7 +47,7 @@ export class WorkspaceInsertQueryBuilder<
 
   constructor(
     queryBuilder: InsertQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -104,7 +104,7 @@ export class WorkspaceInsertQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-select-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { EntityTarget, ObjectLiteral, SelectQueryBuilder } from 'typeorm';
 import { QueryDeepPartialEntity } from 'typeorm/query-builder/QueryPartialEntity';
 
@@ -27,14 +27,14 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSelectQueryBuilder<
   T extends ObjectLiteral,
 > extends SelectQueryBuilder<T> {
-  objectRecordsPermissions: ObjectRecordsPermissions;
+  objectRecordsPermissions: ObjectsPermissionsDeprecated;
   shouldBypassPermissionChecks: boolean;
   internalContext: WorkspaceInternalContext;
   authContext?: AuthContext;
   featureFlagMap?: FeatureFlagMap;
   constructor(
     queryBuilder: SelectQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -322,7 +322,7 @@ export class WorkspaceSelectQueryBuilder<
 
     validateQueryIsPermittedOrThrow({
       expressionMap: this.expressionMap,
-      objectRecordsPermissions: this.objectRecordsPermissions,
+      objectsPermissions: this.objectRecordsPermissions,
       objectMetadataMaps: this.internalContext.objectMetadataMaps,
       shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
       isFieldPermissionsEnabled,

packages/twenty-server/src/engine/twenty-orm/repository/workspace-soft-delete-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   EntityTarget,
   InsertQueryBuilder,
@@ -28,7 +28,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceSoftDeleteQueryBuilder<
   T extends ObjectLiteral,
 > extends SoftDeleteQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -36,7 +36,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
 
   constructor(
     queryBuilder: SoftDeleteQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -66,7 +66,7 @@ export class WorkspaceSoftDeleteQueryBuilder<
     try {
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace-update-query-builder.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   EntityTarget,
@@ -34,7 +34,7 @@ import { getObjectMetadataFromEntityTarget } from 'src/engine/twenty-orm/utils/g
 export class WorkspaceUpdateQueryBuilder<
   T extends ObjectLiteral,
 > extends UpdateQueryBuilder<T> {
-  private objectRecordsPermissions: ObjectRecordsPermissions;
+  private objectRecordsPermissions: ObjectsPermissionsDeprecated;
   private shouldBypassPermissionChecks: boolean;
   private internalContext: WorkspaceInternalContext;
   private authContext?: AuthContext;
@@ -50,7 +50,7 @@ export class WorkspaceUpdateQueryBuilder<
 
   constructor(
     queryBuilder: UpdateQueryBuilder<T>,
-    objectRecordsPermissions: ObjectRecordsPermissions,
+    objectRecordsPermissions: ObjectsPermissionsDeprecated,
     internalContext: WorkspaceInternalContext,
     shouldBypassPermissionChecks: boolean,
     authContext?: AuthContext,
@@ -88,7 +88,7 @@ export class WorkspaceUpdateQueryBuilder<
 
       validateQueryIsPermittedOrThrow({
         expressionMap: this.expressionMap,
-        objectRecordsPermissions: this.objectRecordsPermissions,
+        objectsPermissions: this.objectRecordsPermissions,
         objectMetadataMaps: this.internalContext.objectMetadataMaps,
         shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
         isFieldPermissionsEnabled:
@@ -194,7 +194,7 @@ export class WorkspaceUpdateQueryBuilder<
 
         validateQueryIsPermittedOrThrow({
           expressionMap: fakeExpressionMapToValidatePermissions,
-          objectRecordsPermissions: this.objectRecordsPermissions,
+          objectsPermissions: this.objectRecordsPermissions,
           objectMetadataMaps: this.internalContext.objectMetadataMaps,
           shouldBypassPermissionChecks: this.shouldBypassPermissionChecks,
           isFieldPermissionsEnabled:

packages/twenty-server/src/engine/twenty-orm/repository/workspace.repository.ts

@@ -1,4 +1,4 @@
-import { ObjectRecordsPermissions } from 'twenty-shared/types';
+import { ObjectsPermissionsDeprecated } from 'twenty-shared/types';
 import {
   DeepPartial,
   DeleteResult,
@@ -40,7 +40,7 @@ export class WorkspaceRepository<
   private readonly internalContext: WorkspaceInternalContext;
   private shouldBypassPermissionChecks: boolean;
   private featureFlagMap: FeatureFlagMap;
-  public readonly objectRecordsPermissions?: ObjectRecordsPermissions;
+  public readonly objectRecordsPermissions?: ObjectsPermissionsDeprecated;
   private authContext?: AuthContext;
   declare manager: WorkspaceEntityManager;
 
@@ -50,7 +50,7 @@ export class WorkspaceRepository<
     manager: WorkspaceEntityManager,
     featureFlagMap: FeatureFlagMap,
     queryRunner?: QueryRunner,
-    objectRecordsPermissions?: ObjectRecordsPermissions,
+    objectRecordsPermissions?: ObjectsPermissionsDeprecated,
     shouldBypassPermissionChecks = false,
     authContext?: AuthContext,
   ) {