refactor(twenty-orm): migrate 23 grandfathered entities to WorkspaceScopedRepository (#20987)

## Summary

Follow-up to #20953. Migrates 23 of the 30 entities that were left in
`WORKSPACE_SCOPED_EXEMPTIONS` last time, so the lint rule's
workspaceId-enforcement default now covers most of the core/metadata
schema.

### Migrated (23 entities, 88 files, 22 commits)

| Family | Entities |
|---|---|
| Trivial caches | `NavigationMenuItem`, `Skill`, `DataSource`,
`Webhook`, `CommandMenuItem`, `IndexMetadata` |
| Views | `View`, `ViewField`, `ViewFieldGroup`, `ViewFilter`,
`ViewFilterGroup`, `ViewGroup`, `ViewSort` |
| Layouts | `PageLayout`, `PageLayoutTab`, `PageLayoutWidget` |
| Roles & permissions | `Role`, `RoleTarget`, `PermissionFlag`,
`ObjectPermission`, `FieldPermission`, `RowLevelPermissionPredicate`,
`RowLevelPermissionPredicateGroup` |

For each entity: swap `@InjectRepository(X)` →
`@InjectWorkspaceScopedRepository(X)` (and the field type →
`WorkspaceScopedRepository<X>`); rewrite every call site to pass
`workspaceId` as the first arg (stripped from `where`/criteria — the
wrapper throws if you include it now); register
`provideWorkspaceScopedRepository(X)` in every owning NestJS module;
update affected spec providers to
`getWorkspaceScopedRepositoryToken(X)`.

### Rule update

- `ApplicationRegistrationVariableEntity` was misclassified — moved to
`STRUCTURAL_EXEMPTIONS` (no `workspaceId` column; it's keyed on
`applicationRegistrationId` at the instance level).
- 22 of the 23 migrated entities removed from
`WORKSPACE_SCOPED_EXEMPTIONS` entirely (zero remaining raw
`@InjectRepository` sites).
- `RoleTargetEntity` also removed; one call site in
`user-workspace.service.ts` keeps a raw injection with an
`eslint-disable` + reason because `softRemove(...)` is not on the
wrapper API yet (the migration would require threading `workspaceId`
through `deleteUserWorkspace`'s three callers).

### Still exempted (7 entities, follow-up PRs)

| Entity | Why deferred |
|---|---|
| `ApplicationEntity` | ~50 sites with several cross-workspace lookups
by id (auth, OAuth, file-storage, cleanup) |
| `CalendarChannelEntity` / `MessageChannelEntity` | Use
`.increment(...)` (not on wrapper) and
`repository.manager.transaction(...)` — wrapper needs to grow
`.increment` + the transaction sites need `withManager` or dual-inject |
| `FieldMetadataEntity` / `ObjectMetadataEntity` | The metadata services
`extends TypeOrmQueryService<X>` and `super(rawRepo)` — requires
dual-inject or reworking the inheritance |
| `KeyValuePairEntity` | Allows `workspaceId: IsNull()` for
instance-level config; wrapper rejects null |
| `UpgradeMigrationEntity` | Same — instance-level + cross-workspace
ledger |

## Test plan

- [x] `npx nx typecheck twenty-server` — clean
- [x] `npx nx lint twenty-server` — clean (0/0)
- [x] All 10 affected unit specs pass (115 tests) — api-key, agent-role,
permissions, workspace-roles-permissions-cache, view-filter-group,
workflow-version-step-operations, two-factor-authentication (service +
resolver), user-workspace, file
- [ ] Server integration tests in CI

packages/twenty-server/src/engine/metadata-modules/flat-view/flat-view.module.ts

@@ -12,6 +12,7 @@ import { ViewFilterEntity } from 'src/engine/metadata-modules/view-filter/entiti
 import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
 import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
 import { ViewSortEntity } from 'src/engine/metadata-modules/view-sort/entities/view-sort.entity';
+import { provideWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/provide-workspace-scoped-repository';
 
 @Module({
   imports: [
@@ -28,7 +29,16 @@ import { ViewSortEntity } from 'src/engine/metadata-modules/view-sort/entities/v
       ViewFilterGroupEntity,
     ]),
   ],
-  providers: [WorkspaceFlatViewMapCacheService],
+  providers: [
+    WorkspaceFlatViewMapCacheService,
+    provideWorkspaceScopedRepository(ViewEntity),
+    provideWorkspaceScopedRepository(ViewFieldEntity),
+    provideWorkspaceScopedRepository(ViewFieldGroupEntity),
+    provideWorkspaceScopedRepository(ViewFilterEntity),
+    provideWorkspaceScopedRepository(ViewFilterGroupEntity),
+    provideWorkspaceScopedRepository(ViewGroupEntity),
+    provideWorkspaceScopedRepository(ViewSortEntity),
+  ],
   exports: [WorkspaceFlatViewMapCacheService],
 })
 export class FlatViewModule {}

packages/twenty-server/src/engine/metadata-modules/flat-view/services/workspace-flat-view-map-cache.service.ts

@@ -18,6 +18,8 @@ import { ViewFilterEntity } from 'src/engine/metadata-modules/view-filter/entiti
 import { ViewGroupEntity } from 'src/engine/metadata-modules/view-group/entities/view-group.entity';
 import { ViewSortEntity } from 'src/engine/metadata-modules/view-sort/entities/view-sort.entity';
 import { ViewEntity } from 'src/engine/metadata-modules/view/entities/view.entity';
+import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
+import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
 import { WorkspaceCache } from 'src/engine/workspace-cache/decorators/workspace-cache.decorator';
 import { createIdToUniversalIdentifierMap } from 'src/engine/workspace-cache/utils/create-id-to-universal-identifier-map.util';
 import { regroupEntitiesByRelatedEntityId } from 'src/engine/workspace-cache/utils/regroup-entities-by-related-entity-id';
@@ -27,26 +29,26 @@ import { addFlatEntityToFlatEntityMapsThroughMutationOrThrow } from 'src/engine/
 @WorkspaceCache('flatViewMaps')
 export class WorkspaceFlatViewMapCacheService extends WorkspaceCacheProvider<FlatViewMaps> {
   constructor(
-    @InjectRepository(ViewEntity)
-    private readonly viewRepository: Repository<ViewEntity>,
+    @InjectWorkspaceScopedRepository(ViewEntity)
+    private readonly viewRepository: WorkspaceScopedRepository<ViewEntity>,
     @InjectRepository(ApplicationEntity)
     private readonly applicationRepository: Repository<ApplicationEntity>,
     @InjectRepository(ObjectMetadataEntity)
     private readonly objectMetadataRepository: Repository<ObjectMetadataEntity>,
     @InjectRepository(FieldMetadataEntity)
     private readonly fieldMetadataRepository: Repository<FieldMetadataEntity>,
-    @InjectRepository(ViewFieldEntity)
-    private readonly viewFieldRepository: Repository<ViewFieldEntity>,
-    @InjectRepository(ViewFilterEntity)
-    private readonly viewFilterRepository: Repository<ViewFilterEntity>,
-    @InjectRepository(ViewGroupEntity)
-    private readonly viewGroupRepository: Repository<ViewGroupEntity>,
-    @InjectRepository(ViewFilterGroupEntity)
-    private readonly viewFilterGroupRepository: Repository<ViewFilterGroupEntity>,
-    @InjectRepository(ViewSortEntity)
-    private readonly viewSortRepository: Repository<ViewSortEntity>,
-    @InjectRepository(ViewFieldGroupEntity)
-    private readonly viewFieldGroupRepository: Repository<ViewFieldGroupEntity>,
+    @InjectWorkspaceScopedRepository(ViewFieldEntity)
+    private readonly viewFieldRepository: WorkspaceScopedRepository<ViewFieldEntity>,
+    @InjectWorkspaceScopedRepository(ViewFilterEntity)
+    private readonly viewFilterRepository: WorkspaceScopedRepository<ViewFilterEntity>,
+    @InjectWorkspaceScopedRepository(ViewGroupEntity)
+    private readonly viewGroupRepository: WorkspaceScopedRepository<ViewGroupEntity>,
+    @InjectWorkspaceScopedRepository(ViewFilterGroupEntity)
+    private readonly viewFilterGroupRepository: WorkspaceScopedRepository<ViewFilterGroupEntity>,
+    @InjectWorkspaceScopedRepository(ViewSortEntity)
+    private readonly viewSortRepository: WorkspaceScopedRepository<ViewSortEntity>,
+    @InjectWorkspaceScopedRepository(ViewFieldGroupEntity)
+    private readonly viewFieldGroupRepository: WorkspaceScopedRepository<ViewFieldGroupEntity>,
   ) {
     super();
   }
@@ -64,8 +66,7 @@ export class WorkspaceFlatViewMapCacheService extends WorkspaceCacheProvider<Fla
       viewSorts,
       viewFieldGroups,
     ] = await Promise.all([
-      this.viewRepository.find({
-        where: { workspaceId },
+      this.viewRepository.find(workspaceId, {
         withDeleted: true,
       }),
       this.applicationRepository.find({
@@ -83,33 +84,27 @@ export class WorkspaceFlatViewMapCacheService extends WorkspaceCacheProvider<Fla
         select: ['id', 'universalIdentifier'],
         withDeleted: true,
       }),
-      this.viewFieldRepository.find({
-        where: { workspaceId },
+      this.viewFieldRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),
-      this.viewFilterRepository.find({
-        where: { workspaceId },
+      this.viewFilterRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),
-      this.viewGroupRepository.find({
-        where: { workspaceId },
+      this.viewGroupRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),
-      this.viewFilterGroupRepository.find({
-        where: { workspaceId },
+      this.viewFilterGroupRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),
-      this.viewSortRepository.find({
-        where: { workspaceId },
+      this.viewSortRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),
-      this.viewFieldGroupRepository.find({
-        where: { workspaceId },
+      this.viewFieldGroupRepository.find(workspaceId, {
         select: ['id', 'universalIdentifier', 'viewId'],
         withDeleted: true,
       }),