snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/connected-account/__snapshots__/failing-save-imap-smtp-caldav-account.integration-spec.ts.snap

@@ -0,0 +1,67 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Connected account creation should fail when CALDAV password is missing on creation 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: password: Invalid input: expected string, received undefined",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Connected account creation should fail when IMAP host is empty 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: host: Host is required",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Connected account creation should fail when IMAP password is empty string on creation 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: password: Password is required",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Connected account creation should fail when IMAP password is missing on creation 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: password: Invalid input: expected string, received undefined",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Connected account creation should fail when IMAP port is zero 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: port: Port must be a positive number",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Connected account creation should fail when SMTP password is missing on creation 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "userFriendlyMessage": "Please check your connection settings. Make sure the server host, port, and password are correct.",
+  },
+  "message": "Protocol connection validation failed: password: Invalid input: expected string, received undefined",
+  "name": "UserInputError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/connected-account/application-connected-accounts.integration-spec.ts

@@ -0,0 +1,192 @@
+import { gql } from 'graphql-tag';
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { findConnectionProvidersByApplication } from 'test/integration/metadata/suites/connection-provider/utils/find-connection-providers-by-application.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { makeMetadataAPIRequestWithMemberRole } from 'test/integration/metadata/suites/utils/make-metadata-api-request-with-member-role.util';
+import { ConnectedAccountProvider } from 'twenty-shared/types';
+import { v4 as uuidv4 } from 'uuid';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+import { USER_WORKSPACE_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/core/utils/seed-user-workspaces.util';
+
+const APPLICATION_CONNECTED_ACCOUNTS_QUERY = gql`
+  query ApplicationConnectedAccounts($applicationId: UUID!) {
+    applicationConnectedAccounts(applicationId: $applicationId) {
+      id
+    }
+  }
+`;
+
+const APP_ID = uuidv4();
+const APP_ROLE_ID = uuidv4();
+const APP_PROVIDER_ID = uuidv4();
+
+const SHARED_BY_TIM_ID = uuidv4();
+const PRIVATE_OF_JANE_ID = uuidv4();
+const PRIVATE_OF_TIM_ID = uuidv4();
+const ARCHIVED_SHARED_BY_TIM_ID = uuidv4();
+
+describe('applicationConnectedAccounts resolver (e2e)', () => {
+  let applicationDbId: string;
+  let providerDbId: string;
+
+  const insertAppConnection = async ({
+    id,
+    visibility,
+    userWorkspaceId,
+    archivedAt = null,
+  }: {
+    id: string;
+    visibility: 'user' | 'workspace';
+    userWorkspaceId: string;
+    archivedAt?: Date | null;
+  }): Promise<void> => {
+    await globalThis.testDataSource.query(
+      `INSERT INTO core."connectedAccount"
+         (id, handle, provider, visibility, "workspaceId", "userWorkspaceId",
+          "applicationId", "connectionProviderId", "archivedAt")
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+      [
+        id,
+        'slack-bot@apple.dev',
+        ConnectedAccountProvider.APP,
+        visibility,
+        SEED_APPLE_WORKSPACE_ID,
+        userWorkspaceId,
+        applicationDbId,
+        providerDbId,
+        archivedAt,
+      ],
+    );
+  };
+
+  beforeAll(async () => {
+    await setupApplicationForSync({
+      applicationUniversalIdentifier: APP_ID,
+      name: 'test-application-connected-accounts',
+      description: 'App for testing the application connections query',
+      sourcePath: 'test-application-connected-accounts',
+    });
+
+    await syncApplication({
+      manifest: buildBaseManifest({
+        appId: APP_ID,
+        roleId: APP_ROLE_ID,
+        overrides: {
+          connectionProviders: [
+            {
+              universalIdentifier: APP_PROVIDER_ID,
+              name: 'slack',
+              displayName: 'Slack',
+              type: 'oauth',
+              oauth: {
+                authorizationEndpoint: 'https://slack.com/oauth/v2/authorize',
+                tokenEndpoint: 'https://slack.com/api/oauth.v2.access',
+                scopes: ['chat:write'],
+                clientIdVariable: 'SLACK_CLIENT_ID',
+                clientSecretVariable: 'SLACK_CLIENT_SECRET',
+              },
+            },
+          ],
+        },
+      }),
+      expectToFail: false,
+    });
+
+    jest.useRealTimers();
+
+    const [provider] = await findConnectionProvidersByApplication(APP_ID);
+
+    applicationDbId = provider.applicationId;
+    providerDbId = provider.id;
+
+    await insertAppConnection({
+      id: SHARED_BY_TIM_ID,
+      visibility: 'workspace',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.TIM,
+    });
+    await insertAppConnection({
+      id: PRIVATE_OF_JANE_ID,
+      visibility: 'user',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.JANE,
+    });
+    await insertAppConnection({
+      id: PRIVATE_OF_TIM_ID,
+      visibility: 'user',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.TIM,
+    });
+    await insertAppConnection({
+      id: ARCHIVED_SHARED_BY_TIM_ID,
+      visibility: 'workspace',
+      userWorkspaceId: USER_WORKSPACE_DATA_SEED_IDS.TIM,
+      archivedAt: new Date(),
+    });
+  }, 180000);
+
+  afterAll(async () => {
+    await globalThis.testDataSource.query(
+      `DELETE FROM core."connectedAccount"
+        WHERE "workspaceId" = $1 AND "applicationId" = $2`,
+      [SEED_APPLE_WORKSPACE_ID, applicationDbId],
+    );
+
+    await cleanupApplicationAndAppRegistration({
+      applicationUniversalIdentifier: APP_ID,
+    });
+  }, 120000);
+
+  it('returns workspace-shared connections and the caller own private ones', async () => {
+    const response = await makeMetadataAPIRequest({
+      query: APPLICATION_CONNECTED_ACCOUNTS_QUERY,
+      variables: { applicationId: applicationDbId },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.errors).toBeUndefined();
+
+    const accounts: { id: string }[] =
+      response.body.data.applicationConnectedAccounts;
+
+    expect(accounts).toHaveLength(2);
+    expect(accounts).toEqual(
+      expect.arrayContaining([
+        { id: SHARED_BY_TIM_ID },
+        { id: PRIVATE_OF_JANE_ID },
+      ]),
+    );
+  });
+
+  it('denies a member without the applications settings permission', async () => {
+    const response = await makeMetadataAPIRequestWithMemberRole({
+      query: APPLICATION_CONNECTED_ACCOUNTS_QUERY,
+      variables: { applicationId: applicationDbId },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.data?.applicationConnectedAccounts ?? null).toBeNull();
+    expect(response.body.errors).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          extensions: expect.objectContaining({
+            code: 'FORBIDDEN',
+            subCode: 'PERMISSION_DENIED',
+          }),
+        }),
+      ]),
+    );
+  });
+
+  it('returns nothing for an application without connections', async () => {
+    const response = await makeMetadataAPIRequest({
+      query: APPLICATION_CONNECTED_ACCOUNTS_QUERY,
+      variables: { applicationId: uuidv4() },
+    });
+
+    expect(response.status).toBe(200);
+    expect(response.body.errors).toBeUndefined();
+    expect(response.body.data.applicationConnectedAccounts).toEqual([]);
+  });
+});

packages/twenty-server/test/integration/metadata/suites/connected-account/connected-account-resolver.integration-spec.ts

@@ -0,0 +1,305 @@
+import { gql } from 'graphql-tag';
+import { makeMetadataAPIRequestWithMemberRole } from 'test/integration/metadata/suites/utils/make-metadata-api-request-with-member-role.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+
+import { CONNECTED_ACCOUNT_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/connected-account-data-seeds.constant';
+
+describe('connectedAccountResolver (e2e)', () => {
+  describe('myConnectedAccounts', () => {
+    it('should not return another user private connected account', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+              handle
+              provider
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+
+      const accounts = response.body.data.myConnectedAccounts;
+      const accountIds = accounts.map((account: { id: string }) => account.id);
+
+      expect(accountIds).toContain(CONNECTED_ACCOUNT_DATA_SEED_IDS.JANE);
+      expect(accountIds).not.toContain(CONNECTED_ACCOUNT_DATA_SEED_IDS.JONY);
+    });
+
+    it('should return a workspace-shared account owned by someone else', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+              handle
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+
+      const accountIds = response.body.data.myConnectedAccounts.map(
+        (account: { id: string }) => account.id,
+      );
+
+      expect(accountIds).toContain(
+        CONNECTED_ACCOUNT_DATA_SEED_IDS.SUPPORT_GROUP,
+      );
+    });
+
+    it('should not offer an archived workspace-shared account to other members', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+
+      const accountIds = response.body.data.myConnectedAccounts.map(
+        (account: { id: string }) => account.id,
+      );
+
+      expect(accountIds).not.toContain(
+        CONNECTED_ACCOUNT_DATA_SEED_IDS.TIM_SHARED_ARCHIVED,
+      );
+    });
+
+    it('should list the caller own accounts before workspace-shared ones', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+
+      const accountIds = response.body.data.myConnectedAccounts.map(
+        (account: { id: string }) => account.id,
+      );
+
+      expect(
+        accountIds.indexOf(CONNECTED_ACCOUNT_DATA_SEED_IDS.JONY),
+      ).toBeLessThan(
+        accountIds.indexOf(CONNECTED_ACCOUNT_DATA_SEED_IDS.SUPPORT_GROUP),
+      );
+    });
+
+    it('should resolve the account of every message channel the caller can see', async () => {
+      const channelsResponse = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyMessageChannels {
+            myMessageChannels {
+              id
+              connectedAccountId
+            }
+          }
+        `,
+      });
+
+      const accountsResponse = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+            }
+          }
+        `,
+      });
+
+      expect(channelsResponse.body.errors).toBeUndefined();
+      expect(accountsResponse.body.errors).toBeUndefined();
+
+      const accountIds = accountsResponse.body.data.myConnectedAccounts.map(
+        (account: { id: string }) => account.id,
+      );
+      const channelAccountIds =
+        channelsResponse.body.data.myMessageChannels.map(
+          (messageChannel: { connectedAccountId: string }) =>
+            messageChannel.connectedAccountId,
+        );
+
+      expect(channelAccountIds.length).toBeGreaterThan(0);
+      expect(accountIds).toEqual(expect.arrayContaining(channelAccountIds));
+    });
+
+    it('should not return sensitive fields', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+              handle
+              provider
+              authFailedAt
+              scopes
+              handleAliases
+              lastSignedInAt
+              userWorkspaceId
+              createdAt
+              updatedAt
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+
+      const account = response.body.data.myConnectedAccounts.find(
+        (connectedAccount: { id: string }) =>
+          connectedAccount.id === CONNECTED_ACCOUNT_DATA_SEED_IDS.JANE,
+      );
+
+      expect(account).toBeDefined();
+      expect(account.handle).toBe('jane.austen@apple.dev');
+      expect(account).not.toHaveProperty('accessToken');
+      expect(account).not.toHaveProperty('refreshToken');
+      expect(account).not.toHaveProperty('connectionParameters');
+      expect(account).not.toHaveProperty('oidcTokenClaims');
+    });
+
+    it('should reject requesting hidden fields via GraphQL', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          query MyConnectedAccounts {
+            myConnectedAccounts {
+              id
+              accessToken
+            }
+          }
+        `,
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeDefined();
+      expect(response.body.errors.length).toBeGreaterThan(0);
+    });
+  });
+
+  describe('deleteConnectedAccount', () => {
+    it('should allow deleting own account', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          mutation DeleteConnectedAccount($id: UUID!) {
+            deleteConnectedAccount(id: $id) {
+              id
+            }
+          }
+        `,
+        variables: { id: CONNECTED_ACCOUNT_DATA_SEED_IDS.JANE_DELETABLE },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.deleteConnectedAccount.id).toBe(
+        CONNECTED_ACCOUNT_DATA_SEED_IDS.JANE_DELETABLE,
+      );
+    });
+
+    it('should deny deleting another user account', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          mutation DeleteConnectedAccount($id: UUID!) {
+            deleteConnectedAccount(id: $id) {
+              id
+            }
+          }
+        `,
+        variables: { id: CONNECTED_ACCOUNT_DATA_SEED_IDS.JONY },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors?.[0]?.extensions?.code).toBe('FORBIDDEN');
+    });
+
+    it('should deny a member deleting a workspace-shared account owned by someone else', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          mutation DeleteConnectedAccount($id: UUID!) {
+            deleteConnectedAccount(id: $id) {
+              id
+            }
+          }
+        `,
+        variables: { id: CONNECTED_ACCOUNT_DATA_SEED_IDS.SUPPORT_GROUP },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors?.[0]?.extensions?.code).toBe('FORBIDDEN');
+    });
+
+    it('should keep a denied member able to use the workspace-shared account', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          query MyMessageChannels($connectedAccountId: UUID) {
+            myMessageChannels(connectedAccountId: $connectedAccountId) {
+              id
+            }
+          }
+        `,
+        variables: {
+          connectedAccountId: CONNECTED_ACCOUNT_DATA_SEED_IDS.SUPPORT_GROUP,
+        },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.myMessageChannels.length).toBeGreaterThan(0);
+    });
+
+    it('should allow a member deleting a workspace-shared account they own', async () => {
+      const response = await makeMetadataAPIRequestWithMemberRole({
+        query: gql`
+          mutation DeleteConnectedAccount($id: UUID!) {
+            deleteConnectedAccount(id: $id) {
+              id
+            }
+          }
+        `,
+        variables: { id: CONNECTED_ACCOUNT_DATA_SEED_IDS.JONY_SHARED },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.deleteConnectedAccount.id).toBe(
+        CONNECTED_ACCOUNT_DATA_SEED_IDS.JONY_SHARED,
+      );
+    });
+
+    it('should allow an admin deleting a workspace-shared account', async () => {
+      const response = await makeMetadataAPIRequest({
+        query: gql`
+          mutation DeleteConnectedAccount($id: UUID!) {
+            deleteConnectedAccount(id: $id) {
+              id
+            }
+          }
+        `,
+        variables: { id: CONNECTED_ACCOUNT_DATA_SEED_IDS.CONTACT_GROUP },
+      });
+
+      expect(response.status).toBe(200);
+      expect(response.body.errors).toBeUndefined();
+      expect(response.body.data.deleteConnectedAccount.id).toBe(
+        CONNECTED_ACCOUNT_DATA_SEED_IDS.CONTACT_GROUP,
+      );
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/connected-account/failing-save-imap-smtp-caldav-account.integration-spec.ts

@@ -0,0 +1,137 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { saveImapSmtpCaldavAccount } from 'test/integration/metadata/suites/connected-account/utils/save-imap-smtp-caldav-account.util';
+import {
+  eachTestingContextFilter,
+  type EachTestingContext,
+} from 'twenty-shared/testing';
+
+import { EmailConnectionSecurity } from 'src/engine/core-modules/imap-smtp-caldav-connection/enums/email-connection-security.enum';
+
+type ProtocolConnectionContext = {
+  host: string;
+  port: number;
+  username?: string;
+  password?: string;
+  connectionSecurity?: EmailConnectionSecurity;
+};
+
+type TestContext = {
+  handle: string;
+  connectionParameters: {
+    IMAP?: ProtocolConnectionContext;
+    SMTP?: ProtocolConnectionContext;
+    CALDAV?: ProtocolConnectionContext;
+  };
+  id?: string;
+};
+
+type FailingTestContext = EachTestingContext<TestContext>[];
+
+const VALID_HANDLE = 'test-failing@example.com';
+
+describe('Connected account creation should fail', () => {
+  const failingCreationTestCases: FailingTestContext = [
+    {
+      title: 'when IMAP password is missing on creation',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.example.com',
+            port: 993,
+            username: 'user@example.com',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+    {
+      title: 'when SMTP password is missing on creation',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          SMTP: {
+            host: 'smtp.example.com',
+            port: 465,
+            username: 'user@example.com',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+    {
+      title: 'when CALDAV password is missing on creation',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          CALDAV: {
+            host: 'caldav.example.com',
+            port: 443,
+            username: 'user@example.com',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+    {
+      title: 'when IMAP host is empty',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          IMAP: {
+            host: '',
+            port: 993,
+            password: 'secret',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+    {
+      title: 'when IMAP port is zero',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.example.com',
+            port: 0,
+            password: 'secret',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+    {
+      title: 'when IMAP password is empty string on creation',
+      context: {
+        handle: VALID_HANDLE,
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.example.com',
+            port: 993,
+            password: '',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    },
+  ];
+
+  it.each(eachTestingContextFilter(failingCreationTestCases))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await saveImapSmtpCaldavAccount({
+        expectToFail: true,
+        input: {
+          handle: context.handle,
+          connectionParameters: context.connectionParameters,
+          id: context.id,
+        },
+      });
+
+      expectOneNotInternalServerErrorSnapshot({
+        errors,
+      });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/connected-account/successful-save-imap-smtp-caldav-account.integration-spec.ts

@@ -0,0 +1,287 @@
+import {
+  CalendarChannelVisibility,
+  MessageChannelVisibility,
+} from 'twenty-shared/types';
+
+import { deleteConnectedAccount } from 'test/integration/metadata/suites/connected-account/utils/delete-connected-account.util';
+import { getConnectedImapSmtpCaldavAccount } from 'test/integration/metadata/suites/connected-account/utils/get-connected-imap-smtp-caldav-account.util';
+import { saveImapSmtpCaldavAccount } from 'test/integration/metadata/suites/connected-account/utils/save-imap-smtp-caldav-account.util';
+import {
+  queryCalendarChannels,
+  queryMessageChannels,
+} from 'test/integration/utils/query-messaging.util';
+
+import { EmailConnectionSecurity } from 'src/engine/core-modules/imap-smtp-caldav-connection/enums/email-connection-security.enum';
+
+const createAccount = async (handle: string): Promise<string> => {
+  const { data } = await saveImapSmtpCaldavAccount({
+    expectToFail: false,
+    input: {
+      handle,
+      connectionParameters: {
+        IMAP: {
+          host: 'imap.fastmail.com',
+          port: 993,
+          username: 'user@example.com',
+          password: 'test-password',
+          connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+        },
+        SMTP: {
+          host: 'smtp.fastmail.com',
+          port: 465,
+          username: 'user@example.com',
+          password: 'test-password',
+          connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+        },
+      },
+    },
+  });
+
+  return data.connectedAccountId as string;
+};
+
+describe('Successful save IMAP/SMTP/CALDAV account', () => {
+  const accountIdsToCleanup: string[] = [];
+
+  afterAll(async () => {
+    for (const id of accountIdsToCleanup) {
+      await deleteConnectedAccount({ id, expectToFail: false });
+    }
+  });
+
+  it('should create a connected account with IMAP and SMTP', async () => {
+    const { data } = await saveImapSmtpCaldavAccount({
+      expectToFail: false,
+      input: {
+        handle: 'test-create@example.com',
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.fastmail.com',
+            port: 993,
+            username: 'user@example.com',
+            password: 'test-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+          SMTP: {
+            host: 'smtp.fastmail.com',
+            port: 465,
+            username: 'user@example.com',
+            password: 'test-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    });
+
+    expect(data).toEqual({
+      success: true,
+      connectedAccountId: expect.any(String),
+    });
+
+    accountIdsToCleanup.push(data.connectedAccountId);
+
+    const account = await getConnectedImapSmtpCaldavAccount({
+      id: data.connectedAccountId,
+    });
+
+    expect(account.connectionParameters).toEqual({
+      IMAP: {
+        host: 'imap.fastmail.com',
+        port: 993,
+        username: 'user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      SMTP: {
+        host: 'smtp.fastmail.com',
+        port: 465,
+        username: 'user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      CALDAV: null,
+    });
+  });
+
+  it('should update connection parameters without providing password', async () => {
+    const accountId = await createAccount('test-update-no-pwd@example.com');
+
+    accountIdsToCleanup.push(accountId);
+
+    const { data } = await saveImapSmtpCaldavAccount({
+      expectToFail: false,
+      input: {
+        handle: 'test-update-no-pwd@example.com',
+        connectionParameters: {
+          IMAP: {
+            host: 'imap-updated.fastmail.com',
+            port: 993,
+            username: 'updated-user@example.com',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+          SMTP: {
+            host: 'smtp-updated.fastmail.com',
+            port: 587,
+            username: 'updated-user@example.com',
+            connectionSecurity: EmailConnectionSecurity.STARTTLS,
+          },
+        },
+        id: accountId,
+      },
+    });
+
+    expect(data).toEqual({
+      success: true,
+      connectedAccountId: accountId,
+    });
+
+    const account = await getConnectedImapSmtpCaldavAccount({ id: accountId });
+
+    expect(account.connectionParameters).toEqual({
+      IMAP: {
+        host: 'imap-updated.fastmail.com',
+        port: 993,
+        username: 'updated-user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      SMTP: {
+        host: 'smtp-updated.fastmail.com',
+        port: 587,
+        username: 'updated-user@example.com',
+        connectionSecurity: EmailConnectionSecurity.STARTTLS,
+      },
+      CALDAV: null,
+    });
+  });
+
+  it('should remove SMTP when updating with only IMAP', async () => {
+    const accountId = await createAccount('test-remove-smtp@example.com');
+
+    accountIdsToCleanup.push(accountId);
+
+    const { data } = await saveImapSmtpCaldavAccount({
+      expectToFail: false,
+      input: {
+        handle: 'test-remove-smtp@example.com',
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.fastmail.com',
+            port: 993,
+            username: 'user@example.com',
+            password: 'test-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+        id: accountId,
+      },
+    });
+
+    expect(data).toEqual({
+      success: true,
+      connectedAccountId: accountId,
+    });
+
+    const account = await getConnectedImapSmtpCaldavAccount({ id: accountId });
+
+    expect(account.connectionParameters).toEqual({
+      IMAP: {
+        host: 'imap.fastmail.com',
+        port: 993,
+        username: 'user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      SMTP: null,
+      CALDAV: null,
+    });
+  });
+
+  it('should update only the password when other fields stay the same', async () => {
+    const accountId = await createAccount('test-update-pwd@example.com');
+
+    accountIdsToCleanup.push(accountId);
+
+    const { data } = await saveImapSmtpCaldavAccount({
+      expectToFail: false,
+      input: {
+        handle: 'test-update-pwd@example.com',
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.fastmail.com',
+            port: 993,
+            username: 'user@example.com',
+            password: 'new-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+          SMTP: {
+            host: 'smtp.fastmail.com',
+            port: 465,
+            username: 'user@example.com',
+            password: 'new-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+        id: accountId,
+      },
+    });
+
+    expect(data).toEqual({
+      success: true,
+      connectedAccountId: accountId,
+    });
+
+    const account = await getConnectedImapSmtpCaldavAccount({ id: accountId });
+
+    expect(account.connectionParameters).toEqual({
+      IMAP: {
+        host: 'imap.fastmail.com',
+        port: 993,
+        username: 'user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      SMTP: {
+        host: 'smtp.fastmail.com',
+        port: 465,
+        username: 'user@example.com',
+        connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+      },
+      CALDAV: null,
+    });
+  });
+
+  it('should create message and calendar channels with METADATA visibility', async () => {
+    const { data } = await saveImapSmtpCaldavAccount({
+      expectToFail: false,
+      input: {
+        handle: 'test-visibility@example.com',
+        connectionParameters: {
+          IMAP: {
+            host: 'imap.fastmail.com',
+            port: 993,
+            username: 'user@example.com',
+            password: 'test-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+          CALDAV: {
+            host: 'caldav.fastmail.com',
+            port: 443,
+            username: 'user@example.com',
+            password: 'test-password',
+            connectionSecurity: EmailConnectionSecurity.SSL_TLS,
+          },
+        },
+      },
+    });
+
+    accountIdsToCleanup.push(data.connectedAccountId);
+
+    const messageChannel = (await queryMessageChannels()).find(
+      (channel) => channel.connectedAccountId === data.connectedAccountId,
+    );
+
+    expect(messageChannel?.visibility).toBe(MessageChannelVisibility.METADATA);
+
+    const [calendarChannel] = await queryCalendarChannels(
+      data.connectedAccountId,
+    );
+
+    expect(calendarChannel.visibility).toBe(CalendarChannelVisibility.METADATA);
+  });
+});

packages/twenty-server/test/integration/metadata/suites/connected-account/utils/delete-connected-account.util.ts

@@ -0,0 +1,31 @@
+import { gql } from 'graphql-tag';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+
+export const deleteConnectedAccount = async ({
+  id,
+  expectToFail,
+}: {
+  id: string;
+  expectToFail: boolean;
+}) => {
+  const response = await makeMetadataAPIRequest({
+    query: gql`
+      mutation DeleteConnectedAccount($id: UUID!) {
+        deleteConnectedAccount(id: $id) {
+          id
+        }
+      }
+    `,
+    variables: { id },
+  });
+
+  if (expectToFail) {
+    expect(response.body.data?.deleteConnectedAccount).toBeNull();
+
+    return { errors: response.body.errors, data: null };
+  }
+
+  expect(response.body.errors).toBeUndefined();
+
+  return { errors: null, data: response.body.data.deleteConnectedAccount };
+};

packages/twenty-server/test/integration/metadata/suites/connected-account/utils/get-connected-imap-smtp-caldav-account.util.ts

@@ -0,0 +1,46 @@
+import { gql } from 'graphql-tag';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+
+export const getConnectedImapSmtpCaldavAccount = async ({
+  id,
+}: {
+  id: string;
+}) => {
+  const response = await makeMetadataAPIRequest({
+    query: gql`
+      query GetConnectedImapSmtpCaldavAccount($id: UUID!) {
+        getConnectedImapSmtpCaldavAccount(id: $id) {
+          id
+          handle
+          provider
+          userWorkspaceId
+          connectionParameters {
+            IMAP {
+              host
+              port
+              username
+              connectionSecurity
+            }
+            SMTP {
+              host
+              port
+              username
+              connectionSecurity
+            }
+            CALDAV {
+              host
+              port
+              username
+              connectionSecurity
+            }
+          }
+        }
+      }
+    `,
+    variables: { id },
+  });
+
+  expect(response.body.errors).toBeUndefined();
+
+  return response.body.data.getConnectedImapSmtpCaldavAccount;
+};

packages/twenty-server/test/integration/metadata/suites/connected-account/utils/save-imap-smtp-caldav-account.util.ts

@@ -0,0 +1,64 @@
+import { gql } from 'graphql-tag';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+
+import { EmailConnectionSecurity } from 'src/engine/core-modules/imap-smtp-caldav-connection/enums/email-connection-security.enum';
+
+type ProtocolConnectionInput = {
+  host: string;
+  port: number;
+  username?: string;
+  password?: string;
+  connectionSecurity?: EmailConnectionSecurity;
+};
+
+type SaveImapSmtpCaldavAccountInput = {
+  handle: string;
+  connectionParameters: {
+    IMAP?: ProtocolConnectionInput;
+    SMTP?: ProtocolConnectionInput;
+    CALDAV?: ProtocolConnectionInput;
+  };
+  id?: string;
+};
+
+export const saveImapSmtpCaldavAccount = async ({
+  input,
+  expectToFail,
+}: {
+  input: SaveImapSmtpCaldavAccountInput;
+  expectToFail: boolean;
+}) => {
+  const response = await makeMetadataAPIRequest({
+    query: gql`
+      mutation SaveImapSmtpCaldavAccount(
+        $handle: String!
+        $connectionParameters: EmailAccountConnectionParameters!
+        $id: UUID
+      ) {
+        saveImapSmtpCaldavAccount(
+          handle: $handle
+          connectionParameters: $connectionParameters
+          id: $id
+        ) {
+          success
+          connectedAccountId
+        }
+      }
+    `,
+    variables: {
+      handle: input.handle,
+      connectionParameters: input.connectionParameters,
+      ...(input.id && { id: input.id }),
+    },
+  });
+
+  if (expectToFail) {
+    expect(response.body.errors).toBeDefined();
+
+    return { errors: response.body.errors, data: null };
+  }
+
+  expect(response.body.errors).toBeUndefined();
+
+  return { errors: null, data: response.body.data.saveImapSmtpCaldavAccount };
+};