Delete userWorkspace when removed from workspace (#13131)

Fixes https://github.com/twentyhq/twenty/issues/13024
2025-07-09 18:34:50 +02:00
parent eba997be98
commit 7e419337b5
71 changed files with 377 additions and 436 deletions
--- a/packages/twenty-server/src/engine/api/graphql/workspace-query-runner/utils/workspace-query-runner-graphql-api-exception-handler.util.ts
+++ b/packages/twenty-server/src/engine/api/graphql/workspace-query-runner/utils/workspace-query-runner-graphql-api-exception-handler.util.ts
@ -9,12 +9,14 @@ import { handleDuplicateKeyError } from 'src/engine/api/graphql/workspace-query-
 import { PostgresException } from 'src/engine/api/graphql/workspace-query-runner/utils/postgres-exception';
 import { workspaceExceptionHandler } from 'src/engine/api/graphql/workspace-query-runner/utils/workspace-exception-handler.util';
 import { WorkspaceQueryRunnerException } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-runner.exception';
+import { AuthException } from 'src/engine/core-modules/auth/auth.exception';
 import { RecordTransformerException } from 'src/engine/core-modules/record-transformer/record-transformer.exception';
 import { recordTransformerGraphqlApiExceptionHandler } from 'src/engine/core-modules/record-transformer/utils/record-transformer-graphql-api-exception-handler.util';
 import { PermissionsException } from 'src/engine/metadata-modules/permissions/permissions.exception';
 import { permissionGraphqlApiExceptionHandler } from 'src/engine/metadata-modules/permissions/utils/permission-graphql-api-exception-handler.util';
 import { TwentyORMException } from 'src/engine/twenty-orm/exceptions/twenty-orm.exception';
 import { twentyORMGraphqlApiExceptionHandler } from 'src/engine/twenty-orm/utils/twenty-orm-graphql-api-exception-handler.util';
+import { authGraphqlApiExceptionHandler } from 'src/engine/core-modules/auth/utils/auth-graphql-api-exception-handler.util';

 interface QueryFailedErrorWithCode extends QueryFailedError {
  code: string;
@ -48,6 +50,8 @@ export const workspaceQueryRunnerGraphqlApiExceptionHandler = (
      return graphqlQueryRunnerExceptionHandler(error);
    case error instanceof TwentyORMException:
      return twentyORMGraphqlApiExceptionHandler(error);
+    case error instanceof AuthException:
+      return authGraphqlApiExceptionHandler(error);
    default:
      throw error;
  }
--- a/packages/twenty-server/src/engine/core-modules/auth/filters/auth-graphql-api-exception.filter.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/filters/auth-graphql-api-exception.filter.ts
@ -1,63 +1,11 @@
 import { Catch, ExceptionFilter } from '@nestjs/common';

-import { t } from '@lingui/core/macro';
-
-import {
-  AuthException,
-  AuthExceptionCode,
-} from 'src/engine/core-modules/auth/auth.exception';
-import {
-  AuthenticationError,
-  ForbiddenError,
-  NotFoundError,
-  UserInputError,
-} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+import { AuthException } from 'src/engine/core-modules/auth/auth.exception';
+import { authGraphqlApiExceptionHandler } from 'src/engine/core-modules/auth/utils/auth-graphql-api-exception-handler.util';

@Catch(AuthException)
 export class AuthGraphqlApiExceptionFilter implements ExceptionFilter {
  catch(exception: AuthException) {
-    switch (exception.code) {
-      case AuthExceptionCode.CLIENT_NOT_FOUND:
-        throw new NotFoundError(exception);
-      case AuthExceptionCode.INVALID_INPUT:
-        throw new UserInputError(exception);
-      case AuthExceptionCode.FORBIDDEN_EXCEPTION:
-      case AuthExceptionCode.INSUFFICIENT_SCOPES:
-      case AuthExceptionCode.OAUTH_ACCESS_DENIED:
-      case AuthExceptionCode.SSO_AUTH_FAILED:
-      case AuthExceptionCode.USE_SSO_AUTH:
-      case AuthExceptionCode.SIGNUP_DISABLED:
-      case AuthExceptionCode.MISSING_ENVIRONMENT_VARIABLE:
-      case AuthExceptionCode.INVALID_JWT_TOKEN_TYPE:
-        throw new ForbiddenError(exception);
-      case AuthExceptionCode.GOOGLE_API_AUTH_DISABLED:
-      case AuthExceptionCode.MICROSOFT_API_AUTH_DISABLED:
-        throw new ForbiddenError(exception.message, {
-          userFriendlyMessage: t`Authentication is not enabled with this provider.`,
-          subCode: exception.code,
-        });
-      case AuthExceptionCode.EMAIL_NOT_VERIFIED:
-      case AuthExceptionCode.INVALID_DATA:
-        throw new ForbiddenError(exception.message, {
-          subCode: AuthExceptionCode.EMAIL_NOT_VERIFIED,
-          userFriendlyMessage: t`Email is not verified.`,
-        });
-      case AuthExceptionCode.UNAUTHENTICATED:
-        throw new AuthenticationError(exception.message, {
-          userFriendlyMessage: t`You must be authenticated to perform this action.`,
-          subCode: exception.code,
-        });
-      case AuthExceptionCode.USER_NOT_FOUND:
-      case AuthExceptionCode.WORKSPACE_NOT_FOUND:
-        throw new AuthenticationError(exception);
-      case AuthExceptionCode.INTERNAL_SERVER_ERROR:
-      case AuthExceptionCode.USER_WORKSPACE_NOT_FOUND:
-        throw exception;
-      default: {
-        const _exhaustiveCheck: never = exception.code;
-
-        throw exception;
-      }
-    }
+    return authGraphqlApiExceptionHandler(exception);
  }
 }
--- a/packages/twenty-server/src/engine/core-modules/auth/strategies/jwt.auth.strategy.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/strategies/jwt.auth.strategy.ts
@ -2,6 +2,7 @@ import { Injectable } from '@nestjs/common';
 import { PassportStrategy } from '@nestjs/passport';
 import { InjectRepository } from '@nestjs/typeorm';

+import { t } from '@lingui/core/macro';
 import { Strategy } from 'passport-jwt';
 import { Repository } from 'typeorm';

@ -149,6 +150,9 @@ export class JwtAuthStrategy extends PassportStrategy(Strategy, 'jwt') {
      new AuthException(
        'UserWorkspace not found',
        AuthExceptionCode.USER_WORKSPACE_NOT_FOUND,
+        {
+          userFriendlyMessage: t`User does not have access to this workspace`,
+        },
      ),
    );

--- a/packages/twenty-server/src/engine/core-modules/auth/utils/auth-graphql-api-exception-handler.util.ts
+++ b/packages/twenty-server/src/engine/core-modules/auth/utils/auth-graphql-api-exception-handler.util.ts
@ -0,0 +1,58 @@
+import { t } from '@lingui/core/macro';
+
+import {
+  AuthException,
+  AuthExceptionCode,
+} from 'src/engine/core-modules/auth/auth.exception';
+import {
+  AuthenticationError,
+  ForbiddenError,
+  NotFoundError,
+  UserInputError,
+} from 'src/engine/core-modules/graphql/utils/graphql-errors.util';
+
+export const authGraphqlApiExceptionHandler = (exception: AuthException) => {
+  switch (exception.code) {
+    case AuthExceptionCode.CLIENT_NOT_FOUND:
+      throw new NotFoundError(exception);
+    case AuthExceptionCode.INVALID_INPUT:
+      throw new UserInputError(exception);
+    case AuthExceptionCode.FORBIDDEN_EXCEPTION:
+    case AuthExceptionCode.INSUFFICIENT_SCOPES:
+    case AuthExceptionCode.OAUTH_ACCESS_DENIED:
+    case AuthExceptionCode.SSO_AUTH_FAILED:
+    case AuthExceptionCode.USE_SSO_AUTH:
+    case AuthExceptionCode.SIGNUP_DISABLED:
+    case AuthExceptionCode.MISSING_ENVIRONMENT_VARIABLE:
+    case AuthExceptionCode.INVALID_JWT_TOKEN_TYPE:
+      throw new ForbiddenError(exception);
+    case AuthExceptionCode.GOOGLE_API_AUTH_DISABLED:
+    case AuthExceptionCode.MICROSOFT_API_AUTH_DISABLED:
+      throw new ForbiddenError(exception.message, {
+        userFriendlyMessage: t`Authentication is not enabled with this provider.`,
+        subCode: exception.code,
+      });
+    case AuthExceptionCode.EMAIL_NOT_VERIFIED:
+    case AuthExceptionCode.INVALID_DATA:
+      throw new ForbiddenError(exception.message, {
+        subCode: AuthExceptionCode.EMAIL_NOT_VERIFIED,
+        userFriendlyMessage: t`Email is not verified.`,
+      });
+    case AuthExceptionCode.UNAUTHENTICATED:
+      throw new AuthenticationError(exception.message, {
+        userFriendlyMessage: t`You must be authenticated to perform this action.`,
+        subCode: exception.code,
+      });
+    case AuthExceptionCode.USER_NOT_FOUND:
+    case AuthExceptionCode.WORKSPACE_NOT_FOUND:
+    case AuthExceptionCode.USER_WORKSPACE_NOT_FOUND:
+      throw new AuthenticationError(exception);
+    case AuthExceptionCode.INTERNAL_SERVER_ERROR:
+      throw exception;
+    default: {
+      const _exhaustiveCheck: never = exception.code;
+
+      throw exception;
+    }
+  }
+};
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-create-many.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-create-many.pre-query.hook.ts
@ -3,35 +3,27 @@ import { CreateManyResolverArgs } from 'src/engine/api/graphql/workspace-resolve

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.createMany`)
 export class WorkspaceMemberCreateManyPreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: CreateManyResolverArgs,
-  ): Promise<CreateManyResolverArgs> {
+  async execute(authContext: AuthContext): Promise<CreateManyResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-create-one.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-create-one.pre-query.hook.ts
@ -3,35 +3,27 @@ import { CreateOneResolverArgs } from 'src/engine/api/graphql/workspace-resolver

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.createOne`)
 export class WorkspaceMemberCreateOnePreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: CreateOneResolverArgs,
-  ): Promise<CreateOneResolverArgs> {
+  async execute(authContext: AuthContext): Promise<CreateOneResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-delete-many.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-delete-many.pre-query.hook.ts
@ -3,35 +3,27 @@ import { DeleteManyResolverArgs } from 'src/engine/api/graphql/workspace-resolve

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.deleteMany`)
 export class WorkspaceMemberDeleteManyPreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: DeleteManyResolverArgs,
-  ): Promise<DeleteManyResolverArgs> {
+  async execute(authContext: AuthContext): Promise<DeleteManyResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-delete-one.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-delete-one.pre-query.hook.ts
@ -1,12 +1,23 @@
+import { InjectRepository } from '@nestjs/typeorm';
+
+import { isDefined } from 'twenty-shared/utils';
+import { Repository } from 'typeorm';
+
 import { WorkspacePreQueryHookInstance } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/interfaces/workspace-query-hook.interface';
 import { DeleteOneResolverArgs } from 'src/engine/api/graphql/workspace-resolver-builder/interfaces/workspace-resolvers-builder.interface';

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
+import { UserWorkspace } from 'src/engine/core-modules/user-workspace/user-workspace.entity';
+import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';
 import { TwentyORMManager } from 'src/engine/twenty-orm/twenty-orm.manager';
 import { AttachmentWorkspaceEntity } from 'src/modules/attachment/standard-objects/attachment.workspace-entity';
 import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
-import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';

@WorkspaceQueryHook(`workspaceMember.deleteOne`)
 export class WorkspaceMemberDeleteOnePreQueryHook
@ -14,6 +25,8 @@ export class WorkspaceMemberDeleteOnePreQueryHook
 {
  constructor(
    private readonly twentyORMManager: TwentyORMManager,
+    @InjectRepository(UserWorkspace, 'core')
+    private readonly userWorkspaceRepository: Repository<UserWorkspace>,
    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
  ) {}

@ -49,6 +62,41 @@ export class WorkspaceMemberDeleteOnePreQueryHook
      authorId,
    });

+    const workspaceMemberRepository =
+      await this.twentyORMManager.getRepository<WorkspaceMemberWorkspaceEntity>(
+        'workspaceMember',
+      );
+
+    const workspaceMember = await workspaceMemberRepository.findOne({
+      where: {
+        id: targettedWorkspaceMemberId,
+      },
+    });
+
+    if (!isDefined(workspaceMember)) {
+      // TODO: once this is migrated to userWorkspace service we should throw UserWorkspaceException
+      throw new PermissionsException(
+        'Workspace member not found',
+        PermissionsExceptionCode.WORKSPACE_MEMBER_NOT_FOUND,
+      );
+    }
+
+    const userWorkspace = await this.userWorkspaceRepository.findOne({
+      where: {
+        workspaceId: workspace.id,
+        userId: workspaceMember.userId,
+      },
+    });
+
+    if (!isDefined(userWorkspace)) {
+      throw new PermissionsException(
+        'User workspace not found',
+        PermissionsExceptionCode.USER_WORKSPACE_NOT_FOUND,
+      );
+    }
+
+    await this.userWorkspaceRepository.delete(userWorkspace.id);
+
    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-destroy-many.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-destroy-many.pre-query.hook.ts
@ -3,35 +3,27 @@ import { DeleteManyResolverArgs } from 'src/engine/api/graphql/workspace-resolve

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.destroyMany`)
 export class WorkspaceMemberDestroyManyPreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: DeleteManyResolverArgs,
-  ): Promise<DeleteManyResolverArgs> {
+  async execute(authContext: AuthContext): Promise<DeleteManyResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-destroy-one.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-destroy-one.pre-query.hook.ts
@ -3,36 +3,27 @@ import { DeleteOneResolverArgs } from 'src/engine/api/graphql/workspace-resolver

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.destroyOne`)
 export class WorkspaceMemberDestroyOnePreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: DeleteOneResolverArgs,
-  ): Promise<DeleteOneResolverArgs> {
+  async execute(authContext: AuthContext): Promise<DeleteOneResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        targettedWorkspaceMemberId: payload.id,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-restore-many.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-restore-many.pre-query.hook.ts
@ -3,35 +3,27 @@ import { RestoreManyResolverArgs } from 'src/engine/api/graphql/workspace-resolv

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.restoreMany`)
 export class WorkspaceMemberRestoreManyPreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: RestoreManyResolverArgs,
-  ): Promise<RestoreManyResolverArgs> {
+  async execute(authContext: AuthContext): Promise<RestoreManyResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-restore-one.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-restore-one.pre-query.hook.ts
@ -3,36 +3,27 @@ import { RestoreOneResolverArgs } from 'src/engine/api/graphql/workspace-resolve

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.restoreOne`)
 export class WorkspaceMemberRestoreOnePreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: RestoreOneResolverArgs,
-  ): Promise<RestoreOneResolverArgs> {
+  async execute(authContext: AuthContext): Promise<RestoreOneResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        targettedWorkspaceMemberId: payload.id,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }
--- a/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-update-many.pre-query.hook.ts
+++ b/packages/twenty-server/src/modules/workspace-member/query-hooks/workspace-member-update-many.pre-query.hook.ts
@ -3,35 +3,27 @@ import { UpdateManyResolverArgs } from 'src/engine/api/graphql/workspace-resolve

 import { WorkspaceQueryHook } from 'src/engine/api/graphql/workspace-query-runner/workspace-query-hook/decorators/workspace-query-hook.decorator';
 import { AuthContext } from 'src/engine/core-modules/auth/types/auth-context.type';
-import { WorkspaceMemberPreQueryHookService } from 'src/modules/workspace-member/query-hooks/workspace-member-pre-query-hook.service';
 import { workspaceValidator } from 'src/engine/core-modules/workspace/workspace.validate';
+import {
+  PermissionsException,
+  PermissionsExceptionCode,
+  PermissionsExceptionMessage,
+} from 'src/engine/metadata-modules/permissions/permissions.exception';

@WorkspaceQueryHook(`workspaceMember.updateMany`)
 export class WorkspaceMemberUpdateManyPreQueryHook
  implements WorkspacePreQueryHookInstance
 {
-  constructor(
-    private readonly workspaceMemberPreQueryHookService: WorkspaceMemberPreQueryHookService,
-  ) {}
+  constructor() {}

-  async execute(
-    authContext: AuthContext,
-    objectName: string,
-    payload: UpdateManyResolverArgs,
-  ): Promise<UpdateManyResolverArgs> {
+  async execute(authContext: AuthContext): Promise<UpdateManyResolverArgs> {
    const workspace = authContext.workspace;

    workspaceValidator.assertIsDefinedOrThrow(workspace);

-    await this.workspaceMemberPreQueryHookService.validateWorkspaceMemberUpdatePermissionOrThrow(
-      {
-        userWorkspaceId: authContext.userWorkspaceId,
-        workspaceId: workspace.id,
-        apiKey: authContext.apiKey,
-        workspaceMemberId: authContext.workspaceMemberId,
-      },
+    throw new PermissionsException(
+      PermissionsExceptionMessage.PERMISSION_DENIED,
+      PermissionsExceptionCode.PERMISSION_DENIED,
    );
-
-    return payload;
  }
 }