[permissions] Add object records permissions to role entity (#10255)

Closes https://github.com/twentyhq/core-team-issues/issues/388

- Add object records-related permissions to role entity
- Add it to queriable `currentUserWorkspace` (used in FE)

packages/twenty-server/src/engine/metadata-modules/role/dtos/role.dto.ts

@@ -13,9 +13,6 @@ export class RoleDTO {
   @Field({ nullable: false })
   label: string;
 
-  @Field({ nullable: false })
-  canUpdateAllSettings: boolean;
-
   @Field({ nullable: true })
   description: string;
 
@@ -27,4 +24,19 @@ export class RoleDTO {
 
   @Field(() => [WorkspaceMember], { nullable: true })
   workspaceMembers?: WorkspaceMember[];
+
+  @Field({ nullable: false })
+  canUpdateAllSettings: boolean;
+
+  @Field({ nullable: false })
+  canReadAllObjectRecords: boolean;
+
+  @Field({ nullable: false })
+  canUpdateAllObjectRecords: boolean;
+
+  @Field({ nullable: false })
+  canSoftDeleteAllObjectRecords: boolean;
+
+  @Field({ nullable: false })
+  canDestroyAllObjectRecords: boolean;
 }

packages/twenty-server/src/engine/metadata-modules/role/role.entity.ts

@@ -21,6 +21,18 @@ export class RoleEntity {
   @Column({ nullable: false, default: false })
   canUpdateAllSettings: boolean;
 
+  @Column({ nullable: false, default: false })
+  canReadAllObjectRecords: boolean;
+
+  @Column({ nullable: false, default: false })
+  canUpdateAllObjectRecords: boolean;
+
+  @Column({ nullable: false, default: false })
+  canSoftDeleteAllObjectRecords: boolean;
+
+  @Column({ nullable: false, default: false })
+  canDestroyAllObjectRecords: boolean;
+
   @Column({ nullable: true, type: 'text' })
   description: string;
 

packages/twenty-server/src/engine/metadata-modules/role/role.resolver.ts

@@ -38,13 +38,17 @@ export class RoleResolver {
     return roles.map((role) => ({
       id: role.id,
       label: role.label,
-      canUpdateAllSettings: role.canUpdateAllSettings,
       description: role.description,
       workspaceId: role.workspaceId,
       createdAt: role.createdAt,
       updatedAt: role.updatedAt,
       isEditable: role.isEditable,
       userWorkspaceRoles: role.userWorkspaceRoles,
+      canUpdateAllSettings: role.canUpdateAllSettings,
+      canReadAllObjectRecords: role.canReadAllObjectRecords,
+      canUpdateAllObjectRecords: role.canUpdateAllObjectRecords,
+      canSoftDeleteAllObjectRecords: role.canSoftDeleteAllObjectRecords,
+      canDestroyAllObjectRecords: role.canDestroyAllObjectRecords,
     }));
   }
 
@@ -81,7 +85,10 @@ export class RoleResolver {
     }
 
     const roles = await this.userRoleService
-      .getRolesByUserWorkspaces([userWorkspace.id])
+      .getRolesByUserWorkspaces({
+        userWorkspaceIds: [userWorkspace.id],
+        workspaceId: workspace.id,
+      })
       .then(
         (rolesByUserWorkspaces) =>
           rolesByUserWorkspaces?.get(userWorkspace.id) ?? [],

packages/twenty-server/src/engine/metadata-modules/role/role.service.ts

@@ -30,6 +30,10 @@ export class RoleService {
       label: ADMIN_ROLE_LABEL,
       description: 'Admin role',
       canUpdateAllSettings: true,
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: true,
+      canSoftDeleteAllObjectRecords: true,
+      canDestroyAllObjectRecords: true,
       isEditable: false,
       workspaceId,
     });
@@ -44,6 +48,10 @@ export class RoleService {
       label: MEMBER_ROLE_LABEL,
       description: 'Member role',
       canUpdateAllSettings: false,
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: true,
+      canSoftDeleteAllObjectRecords: true,
+      canDestroyAllObjectRecords: true,
       isEditable: false,
       workspaceId,
     });