[permissions] Enforce object-records permission checks in resolvers (#10304)

Closes https://github.com/twentyhq/core-team-issues/issues/393

- enforcing object-records permission checks in resolvers for now. we
will move the logic to a lower level asap
- add integration tests that will still be useful when we have moved the
logic
- introduce guest seeded role to test limited permissions on
object-records

packages/twenty-server/src/engine/metadata-modules/permissions/permissions.exception.ts

@@ -16,6 +16,8 @@ export enum PermissionsExceptionCode {
   WORKSPACE_MEMBER_NOT_FOUND = 'WORKSPACE_MEMBER_NOT_FOUND',
   ROLE_NOT_FOUND = 'ROLE_NOT_FOUND',
   CANNOT_UNASSIGN_LAST_ADMIN = 'CANNOT_UNASSIGN_LAST_ADMIN',
+  UNKNOWN_OPERATION_NAME = 'UNKNOWN_OPERATION_NAME',
+  UNKNOWN_REQUIRED_PERMISSION = 'UNKNOWN_REQUIRED_PERMISSION',
 }
 
 export enum PermissionsExceptionMessage {
@@ -28,4 +30,6 @@ export enum PermissionsExceptionMessage {
   WORKSPACE_MEMBER_NOT_FOUND = 'Workspace member not found',
   ROLE_NOT_FOUND = 'Role not found',
   CANNOT_UNASSIGN_LAST_ADMIN = 'Cannot unassign last admin',
+  UNKNOWN_OPERATION_NAME = 'Unknown operation name, cannot determine required permission',
+  UNKNOWN_REQUIRED_PERMISSION = 'Unknown required permission',
 }