Prevent remote object updates (#4804)

Backend: Adding a new util function that throw an error if the
objectMetadata is remote

Frontend: hiding the save button when remote

Also renaming `useObjectMetadataItemForSettings` since this hook is used
in other places than settings and is not in the settings repo. Name can
definitely be challenged!

---------

Co-authored-by: Thomas Trompette <thomast@twenty.com>

packages/twenty-server/src/engine/api/graphql/workspace-query-runner/workspace-query-runner.service.ts

@@ -46,6 +46,7 @@ import { EnvironmentService } from 'src/engine/integrations/environment/environm
 import { NotFoundError } from 'src/engine/utils/graphql-errors.util';
 import { QueryRunnerArgsFactory } from 'src/engine/api/graphql/workspace-query-runner/factories/query-runner-args.factory';
 import { QueryResultGettersFactory } from 'src/engine/api/graphql/workspace-query-runner/factories/query-result-getters.factory';
+import { assertMutationNotOnRemoteObject } from 'src/engine/metadata-modules/object-metadata/utils/assert-mutation-not-on-remote-object.util';
 
 import { WorkspaceQueryRunnerOptions } from './interfaces/query-runner-option.interface';
 import {
@@ -217,6 +218,9 @@ export class WorkspaceQueryRunnerService {
     options: WorkspaceQueryRunnerOptions,
   ): Promise<Record[] | undefined> {
     const { workspaceId, userId, objectMetadataItem } = options;
+
+    assertMutationNotOnRemoteObject(objectMetadataItem);
+
     const computedArgs = await this.queryRunnerArgsFactory.create(
       args,
       options,
@@ -273,6 +277,8 @@ export class WorkspaceQueryRunnerService {
   ): Promise<Record | undefined> {
     const { workspaceId, userId, objectMetadataItem } = options;
 
+    assertMutationNotOnRemoteObject(objectMetadataItem);
+
     const existingRecord = await this.findOne(
       { filter: { id: { eq: args.id } } } as FindOneResolverArgs,
       options,
@@ -318,6 +324,9 @@ export class WorkspaceQueryRunnerService {
     options: WorkspaceQueryRunnerOptions,
   ): Promise<Record[] | undefined> {
     const { workspaceId, objectMetadataItem } = options;
+
+    assertMutationNotOnRemoteObject(objectMetadataItem);
+
     const maximumRecordAffected = this.environmentService.get(
       'MUTATION_MAXIMUM_RECORD_AFFECTED',
     );
@@ -359,6 +368,9 @@ export class WorkspaceQueryRunnerService {
     options: WorkspaceQueryRunnerOptions,
   ): Promise<Record[] | undefined> {
     const { workspaceId, userId, objectMetadataItem } = options;
+
+    assertMutationNotOnRemoteObject(objectMetadataItem);
+
     const maximumRecordAffected = this.environmentService.get(
       'MUTATION_MAXIMUM_RECORD_AFFECTED',
     );
@@ -403,6 +415,9 @@ export class WorkspaceQueryRunnerService {
     options: WorkspaceQueryRunnerOptions,
   ): Promise<Record | undefined> {
     const { workspaceId, userId, objectMetadataItem } = options;
+
+    assertMutationNotOnRemoteObject(objectMetadataItem);
+
     const query = await this.workspaceQueryBuilderFactory.deleteOne(
       args,
       options,

packages/twenty-server/src/engine/metadata-modules/field-metadata/field-metadata.service.ts

@@ -38,6 +38,7 @@ import {
 } from 'src/engine/metadata-modules/relation-metadata/relation-metadata.entity';
 import { DeleteOneFieldInput } from 'src/engine/metadata-modules/field-metadata/dtos/delete-field.input';
 import { computeCustomName } from 'src/engine/utils/compute-custom-name.util';
+import { assertMutationNotOnRemoteObject } from 'src/engine/metadata-modules/object-metadata/utils/assert-mutation-not-on-remote-object.util';
 
 import {
   FieldMetadataEntity,
@@ -94,6 +95,10 @@ export class FieldMetadataService extends TypeOrmQueryService<FieldMetadataEntit
         throw new NotFoundException('Object does not exist');
       }
 
+      if (!fieldMetadataInput.isRemoteCreation) {
+        assertMutationNotOnRemoteObject(objectMetadata);
+      }
+
       // Double check in case the service is directly called
       if (isEnumFieldMetadataType(fieldMetadataInput.type)) {
         if (
@@ -273,6 +278,8 @@ export class FieldMetadataService extends TypeOrmQueryService<FieldMetadataEntit
         throw new NotFoundException('Object does not exist');
       }
 
+      assertMutationNotOnRemoteObject(objectMetadata);
+
       if (
         objectMetadata.labelIdentifierFieldMetadataId ===
           existingFieldMetadata.id &&

packages/twenty-server/src/engine/metadata-modules/object-metadata/utils/assert-mutation-not-on-remote-object.util.ts

@@ -0,0 +1,9 @@
+import { ObjectMetadataInterface } from 'src/engine/metadata-modules/field-metadata/interfaces/object-metadata.interface';
+
+export const assertMutationNotOnRemoteObject = (
+  objectMetadataItem: ObjectMetadataInterface,
+) => {
+  if (objectMetadataItem.isRemote) {
+    throw new Error('Remote objects are read-only');
+  }
+};