refactor(twenty-orm): migrate 23 grandfathered entities to WorkspaceScopedRepository (#20987)

## Summary

Follow-up to #20953. Migrates 23 of the 30 entities that were left in
`WORKSPACE_SCOPED_EXEMPTIONS` last time, so the lint rule's
workspaceId-enforcement default now covers most of the core/metadata
schema.

### Migrated (23 entities, 88 files, 22 commits)

| Family | Entities |
|---|---|
| Trivial caches | `NavigationMenuItem`, `Skill`, `DataSource`,
`Webhook`, `CommandMenuItem`, `IndexMetadata` |
| Views | `View`, `ViewField`, `ViewFieldGroup`, `ViewFilter`,
`ViewFilterGroup`, `ViewGroup`, `ViewSort` |
| Layouts | `PageLayout`, `PageLayoutTab`, `PageLayoutWidget` |
| Roles & permissions | `Role`, `RoleTarget`, `PermissionFlag`,
`ObjectPermission`, `FieldPermission`, `RowLevelPermissionPredicate`,
`RowLevelPermissionPredicateGroup` |

For each entity: swap `@InjectRepository(X)` →
`@InjectWorkspaceScopedRepository(X)` (and the field type →
`WorkspaceScopedRepository<X>`); rewrite every call site to pass
`workspaceId` as the first arg (stripped from `where`/criteria — the
wrapper throws if you include it now); register
`provideWorkspaceScopedRepository(X)` in every owning NestJS module;
update affected spec providers to
`getWorkspaceScopedRepositoryToken(X)`.

### Rule update

- `ApplicationRegistrationVariableEntity` was misclassified — moved to
`STRUCTURAL_EXEMPTIONS` (no `workspaceId` column; it's keyed on
`applicationRegistrationId` at the instance level).
- 22 of the 23 migrated entities removed from
`WORKSPACE_SCOPED_EXEMPTIONS` entirely (zero remaining raw
`@InjectRepository` sites).
- `RoleTargetEntity` also removed; one call site in
`user-workspace.service.ts` keeps a raw injection with an
`eslint-disable` + reason because `softRemove(...)` is not on the
wrapper API yet (the migration would require threading `workspaceId`
through `deleteUserWorkspace`'s three callers).

### Still exempted (7 entities, follow-up PRs)

| Entity | Why deferred |
|---|---|
| `ApplicationEntity` | ~50 sites with several cross-workspace lookups
by id (auth, OAuth, file-storage, cleanup) |
| `CalendarChannelEntity` / `MessageChannelEntity` | Use
`.increment(...)` (not on wrapper) and
`repository.manager.transaction(...)` — wrapper needs to grow
`.increment` + the transaction sites need `withManager` or dual-inject |
| `FieldMetadataEntity` / `ObjectMetadataEntity` | The metadata services
`extends TypeOrmQueryService<X>` and `super(rawRepo)` — requires
dual-inject or reworking the inheritance |
| `KeyValuePairEntity` | Allows `workspaceId: IsNull()` for
instance-level config; wrapper rejects null |
| `UpgradeMigrationEntity` | Same — instance-level + cross-workspace
ledger |

## Test plan

- [x] `npx nx typecheck twenty-server` — clean
- [x] `npx nx lint twenty-server` — clean (0/0)
- [x] All 10 affected unit specs pass (115 tests) — api-key, agent-role,
permissions, workspace-roles-permissions-cache, view-filter-group,
workflow-version-step-operations, two-factor-authentication (service +
resolver), user-workspace, file
- [ ] Server integration tests in CI

packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-execution/ai-agent-execution.module.ts

@@ -14,6 +14,7 @@ import { AiModelsModule } from 'src/engine/metadata-modules/ai/ai-models/ai-mode
 import { PermissionsModule } from 'src/engine/metadata-modules/permissions/permissions.module';
 import { RoleTargetEntity } from 'src/engine/metadata-modules/role-target/role-target.entity';
 import { UserRoleModule } from 'src/engine/metadata-modules/user-role/user-role.module';
+import { provideWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/provide-workspace-scoped-repository';
 import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache.module';
 
 import { AgentMessagePartEntity } from './entities/agent-message-part.entity';
@@ -49,6 +50,7 @@ import { AgentAsyncExecutorService } from './services/agent-async-executor.servi
     AgentAsyncExecutorService,
     AgentActorContextService,
     AgentMessagePartResolver,
+    provideWorkspaceScopedRepository(RoleTargetEntity),
   ],
   exports: [
     AgentAsyncExecutorService,

packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-execution/services/agent-async-executor.service.ts

@@ -45,6 +45,8 @@ import {
 } from 'src/engine/metadata-modules/ai/ai.exception';
 import { RoleTargetEntity } from 'src/engine/metadata-modules/role-target/role-target.entity';
 import { type RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';
+import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
+import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
 
 const EMPTY_USAGE: LanguageModelUsage = {
   inputTokens: 0,
@@ -75,8 +77,8 @@ export class AgentAsyncExecutorService {
     private readonly nativeToolBinder: NativeToolBinderService,
     private readonly aiBillingService: AiBillingService,
     private readonly billingUsageService: BillingUsageService,
-    @InjectRepository(RoleTargetEntity)
-    private readonly roleTargetRepository: Repository<RoleTargetEntity>,
+    @InjectWorkspaceScopedRepository(RoleTargetEntity)
+    private readonly roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>,
     @InjectRepository(WorkspaceEntity)
     private readonly workspaceRepository: Repository<WorkspaceEntity>,
   ) {}
@@ -104,10 +106,9 @@ export class AgentAsyncExecutorService {
     workspaceId: string,
     rolePermissionConfig?: RolePermissionConfig,
   ): Promise<RolePermissionConfig | undefined> {
-    const roleTarget = await this.roleTargetRepository.findOne({
+    const roleTarget = await this.roleTargetRepository.findOne(workspaceId, {
       where: {
         agentId,
-        workspaceId,
       },
       select: ['roleId'],
     });

packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-role/agent-role.service.spec.ts

@@ -1,7 +1,4 @@
 import { Test, type TestingModule } from '@nestjs/testing';
-import { getRepositoryToken } from '@nestjs/typeorm';
-
-import { type Repository } from 'typeorm';
 
 import {
   AiException,
@@ -20,8 +17,8 @@ import { AiAgentRoleService } from './ai-agent-role.service';
 describe('AiAgentRoleService', () => {
   let service: AiAgentRoleService;
   let agentRepository: WorkspaceScopedRepository<AgentEntity>;
-  let roleRepository: Repository<RoleEntity>;
-  let roleTargetRepository: Repository<RoleTargetEntity>;
+  let roleRepository: WorkspaceScopedRepository<RoleEntity>;
+  let roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>;
   let roleTargetService: RoleTargetService;
 
   const testWorkspaceId = 'test-workspace-id';
@@ -42,19 +39,20 @@ describe('AiAgentRoleService', () => {
           },
         },
         {
-          provide: getRepositoryToken(RoleEntity),
+          provide: getWorkspaceScopedRepositoryToken(RoleEntity),
           useValue: {
             findOne: jest.fn(),
             save: jest.fn(),
           },
         },
         {
-          provide: getRepositoryToken(RoleTargetEntity),
+          provide: getWorkspaceScopedRepositoryToken(RoleTargetEntity),
           useValue: {
             findOne: jest.fn(),
             save: jest.fn(),
             delete: jest.fn(),
             find: jest.fn(),
+            count: jest.fn(),
           },
         },
         {
@@ -71,12 +69,12 @@ describe('AiAgentRoleService', () => {
     agentRepository = module.get<WorkspaceScopedRepository<AgentEntity>>(
       getWorkspaceScopedRepositoryToken(AgentEntity),
     );
-    roleRepository = module.get<Repository<RoleEntity>>(
-      getRepositoryToken(RoleEntity),
-    );
-    roleTargetRepository = module.get<Repository<RoleTargetEntity>>(
-      getRepositoryToken(RoleTargetEntity),
+    roleRepository = module.get<WorkspaceScopedRepository<RoleEntity>>(
+      getWorkspaceScopedRepositoryToken(RoleEntity),
     );
+    roleTargetRepository = module.get<
+      WorkspaceScopedRepository<RoleTargetEntity>
+    >(getWorkspaceScopedRepositoryToken(RoleTargetEntity));
     roleTargetService = module.get<RoleTargetService>(RoleTargetService);
 
     // Setup test data
@@ -153,16 +151,18 @@ describe('AiAgentRoleService', () => {
       expect(agentRepository.findOne).toHaveBeenCalledWith(testWorkspaceId, {
         where: { id: testAgent.id },
       });
-      expect(roleRepository.findOne).toHaveBeenCalledWith({
-        where: { id: testRole.id, workspaceId: testWorkspaceId },
+      expect(roleRepository.findOne).toHaveBeenCalledWith(testWorkspaceId, {
+        where: { id: testRole.id },
       });
-      expect(roleTargetRepository.findOne).toHaveBeenCalledWith({
-        where: {
-          agentId: testAgent.id,
-          roleId: testRole.id,
-          workspaceId: testWorkspaceId,
+      expect(roleTargetRepository.findOne).toHaveBeenCalledWith(
+        testWorkspaceId,
+        {
+          where: {
+            agentId: testAgent.id,
+            roleId: testRole.id,
+          },
         },
-      });
+      );
       expect(roleTargetService.create).toHaveBeenCalledWith({
         createRoleTargetInput: {
           roleId: testRole.id,
@@ -335,12 +335,14 @@ describe('AiAgentRoleService', () => {
       });
 
       // Assert
-      expect(roleTargetRepository.findOne).toHaveBeenCalledWith({
-        where: {
-          agentId: testAgent.id,
-          workspaceId: testWorkspaceId,
+      expect(roleTargetRepository.findOne).toHaveBeenCalledWith(
+        testWorkspaceId,
+        {
+          where: {
+            agentId: testAgent.id,
+          },
         },
-      });
+      );
       expect(roleTargetService.delete).toHaveBeenCalledWith({
         id: existingRoleTarget.id,
         workspaceId: testWorkspaceId,

packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-role/ai-agent-role.module.ts

@@ -16,6 +16,8 @@ import { AiAgentRoleService } from './ai-agent-role.service';
   providers: [
     AiAgentRoleService,
     provideWorkspaceScopedRepository(AgentEntity),
+    provideWorkspaceScopedRepository(RoleEntity),
+    provideWorkspaceScopedRepository(RoleTargetEntity),
   ],
   exports: [AiAgentRoleService],
 })

packages/twenty-server/src/engine/metadata-modules/ai/ai-agent-role/ai-agent-role.service.ts

@@ -1,8 +1,7 @@
 import { Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
 
 import { isDefined } from 'twenty-shared/utils';
-import { In, IsNull, Not, Repository } from 'typeorm';
+import { In, IsNull, Not } from 'typeorm';
 
 import {
   AiException,
@@ -19,10 +18,10 @@ export class AiAgentRoleService {
   constructor(
     @InjectWorkspaceScopedRepository(AgentEntity)
     private readonly agentRepository: WorkspaceScopedRepository<AgentEntity>,
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
-    @InjectRepository(RoleTargetEntity)
-    private readonly roleTargetRepository: Repository<RoleTargetEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleTargetEntity)
+    private readonly roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>,
     private readonly roleTargetService: RoleTargetService,
   ) {}
 
@@ -62,12 +61,14 @@ export class AiAgentRoleService {
     workspaceId: string;
     agentId: string;
   }): Promise<void> {
-    const existingRoleTarget = await this.roleTargetRepository.findOne({
-      where: {
-        agentId,
-        workspaceId,
+    const existingRoleTarget = await this.roleTargetRepository.findOne(
+      workspaceId,
+      {
+        where: {
+          agentId,
+        },
       },
-    });
+    );
 
     if (!isDefined(existingRoleTarget)) {
       throw new AiException(
@@ -86,10 +87,9 @@ export class AiAgentRoleService {
     roleId: string,
     workspaceId: string,
   ): Promise<AgentEntity[]> {
-    const roleTargets = await this.roleTargetRepository.find({
+    const roleTargets = await this.roleTargetRepository.find(workspaceId, {
       where: {
         roleId,
-        workspaceId,
         agentId: Not(IsNull()),
       },
     });
@@ -129,8 +129,8 @@ export class AiAgentRoleService {
       );
     }
 
-    const role = await this.roleRepository.findOne({
-      where: { id: roleId, workspaceId },
+    const role = await this.roleRepository.findOne(workspaceId, {
+      where: { id: roleId },
     });
 
     if (!role) {
@@ -147,13 +147,15 @@ export class AiAgentRoleService {
       );
     }
 
-    const existingRoleTarget = await this.roleTargetRepository.findOne({
-      where: {
-        agentId,
-        roleId,
-        workspaceId,
+    const existingRoleTarget = await this.roleTargetRepository.findOne(
+      workspaceId,
+      {
+        where: {
+          agentId,
+          roleId,
+        },
       },
-    });
+    );
 
     return {
       roleToAssignIsSameAsCurrentRole: Boolean(existingRoleTarget),
@@ -169,8 +171,8 @@ export class AiAgentRoleService {
     roleTargetId: string;
     workspaceId: string;
   }): Promise<void> {
-    const role = await this.roleRepository.findOne({
-      where: { id: roleId, workspaceId },
+    const role = await this.roleRepository.findOne(workspaceId, {
+      where: { id: roleId },
     });
 
     if (
@@ -182,16 +184,18 @@ export class AiAgentRoleService {
       return;
     }
 
-    const remainingAssignments = await this.roleTargetRepository.count({
-      where: {
-        roleId,
-        workspaceId,
-        id: Not(roleTargetId),
+    const remainingAssignments = await this.roleTargetRepository.count(
+      workspaceId,
+      {
+        where: {
+          roleId,
+          id: Not(roleTargetId),
+        },
       },
-    });
+    );
 
     if (remainingAssignments === 0) {
-      await this.roleRepository.delete({ id: roleId, workspaceId });
+      await this.roleRepository.delete(workspaceId, { id: roleId });
     }
   }
 }