Félix Malfait 9901fa93d9 fix(server): write 2.13 UI capability flags directly, bypassing validation (#21543)
## Context

The `v1.22 → v2.13.x` cross-version upgrade test (twenty-infra) still
fails *after* #21537. This is the **same root cause from a deeper
layer**, and the fix here ends the class.

## What's actually happening

The 2.13 `SyncStandardUiCapabilityFlags` workspace command heals drifted
`isUIEditable`/`isUICreatable` on standard metadata by running a **bulk
update through `validateBuildAndRunWorkspaceMigration`** — the
validation pipeline meant for *user-initiated* metadata edits. That
pipeline has multiple "you may not mutate property X on entity Y"
guards, and `isSystemBuild: true` only bypasses **some** of them:

| guard | gated on `isSystemBuild`? |
|---|---|
| system-**field** allow-list (`flat-field-metadata-validator.ts:83`) |
 bypassed |
| system-**object** guard (`flat-object-metadata-validator.ts:63`) | 
bypassed |
| **relation-field** allow-list (`flat-field-metadata-validator.ts:143`)
|  not gated |

So the healing command fails on exactly the workspaces that have real
drift (the genuinely cross-version-upgraded ones). #21537 patched the
relation allow-list by adding `isUIEditable` to it — one guard — and the
build then failed on the next. From this run's logs: `Upgrade summary:
42 workspace(s) succeeded, 2 workspace(s) failed` (the 2 drifted
workspaces; the build returns `status=fail`, the per-workspace error
detail isn't surfaced in logs).

**Root cause:** a trusted system flag-backfill should not run through
the user-mutation validation layer at all.

## Fix (direct metadata write)

`isUIEditable`/`isUICreatable` are UI-affordance columns on
`core.fieldMetadata`/`core.objectMetadata` — changing them needs **no
workspace-schema migration**. The command now writes them **directly**
to those tables (mirroring the 2.13 slow backfill's raw `UPDATE
core."objectMetadata"`) and invalidates the flat-metadata cache,
bypassing the validation pipeline entirely. Drift detection is
unchanged. This removes the whole class of guard rejections instead of
patching guards one at a time.

## Verification

- `nx typecheck twenty-server` , `oxlint --type-aware`  (the file is
intentionally oxfmt-ignored via `**/upgrade-version-command/**`).
- ⚠️ I could **not** run a live cross-version repro from the dev
container (no Docker/Postgres available here). The fix categorically
can't hit the previous failure (the validation pipeline is gone), but
the definitive runtime gate is the twenty-infra `cross-version-upgrade`
job against a new image. Quick local repro to confirm: on a reset dev
DB, flip `isUIEditable` on a standard relation field (e.g. an
`activityTargets` `target*` field) so it drifts, run `yarn command:prod
upgrade:2-13:sync-standard-ui-capability-flags -w <workspaceId>`, and
confirm it completes (pre-fix it threw on the relation field).

---
_Generated by [Claude
Code](https://claude.ai/code/session_013Az1etaGyxWRRVhgjhPWeB)_

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/21543?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-06-14 08:15:50 +02:00
2026-06-11 11:02:28 +02:00

Twenty logo

The #1 Open-Source CRM

Website · Documentation · Roadmap · Discord · Figma

Twenty banner


Why Twenty

Twenty gives technical teams the building blocks for a custom CRM that meets complex business needs and quickly adapts as the business evolves. Twenty is the CRM you build, ship, and version like the rest of your stack.

Learn more about why we built Twenty


Installation

Cloud

The fastest way to get started. Sign up at twenty.com and spin up a workspace in under a minute, with no infrastructure to manage and always up to date.

Build an app

Scaffold a new app with the Twenty CLI:

npx create-twenty-app my-app

Define objects, fields, and views as code:

import { defineObject, FieldType } from 'twenty-sdk/define';

export default defineObject({
  nameSingular: 'deal',
  namePlural: 'deals',
  labelSingular: 'Deal',
  labelPlural: 'Deals',
  fields: [
    { name: 'name', label: 'Name', type: FieldType.TEXT },
    { name: 'amount', label: 'Amount', type: FieldType.CURRENCY },
    { name: 'closeDate', label: 'Close Date', type: FieldType.DATE_TIME },
  ],
});

Then ship it to your workspace:

npx twenty app:publish --private

See the app development guide for objects, views, agents, and logic functions.

Self-hosting

Run Twenty on your own infrastructure with Docker Compose, or contribute locally via the local setup guide.



Everything you need

Twenty gives you the building blocks of a modern CRM (objects, views, workflows, and agents) and lets you extend them as code. Here's a tour of what's in the box.

Want to go deeper? Read the User Guide for product walkthroughs, or the Documentation for developer reference.

Create your apps

Learn more about apps in doc

Stay on top with version control

Learn more about version control in doc

All the tools you need to build anything

Learn more about primitives in doc

Customize your layouts

Learn more about layouts in doc

AI agents and chats

Learn more about AI in doc

Plus all the tools of a good CRM

Learn more about CRM features in doc


Stack

Thanks

Greptile      Sentry      Crowdin

Thanks to these amazing services that we use and recommend for code review (Greptile), catching bugs (Sentry) and translating (Crowdin).

Join the Community

Star the repo · Discord · Feature requests · Releases · X · LinkedIn · Crowdin · Contribute

S
Description
The open alternative to Salesforce, designed for AI.
Readme AGPL-3.0 1.4 GiB
Languages
TypeScript 79.6%
MDX 17.3%
JavaScript 2.7%
Python 0.2%
SCSS 0.1%