snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/field-permission/__snapshots__/failing-field-permission-upsert.integration-spec.ts.snap

@@ -0,0 +1,131 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Field permission upsert should fail when canReadFieldValue is true (only restriction allowed) 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "subCode": "ONLY_FIELD_RESTRICTION_ALLOWED",
+    "userFriendlyMessage": "Field permissions can only be used to restrict access, not to grant additional permissions.",
+  },
+  "message": "Field permission can only introduce a restriction",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Field permission upsert should fail when canUpdateFieldValue is true (only restriction allowed) 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "subCode": "ONLY_FIELD_RESTRICTION_ALLOWED",
+    "userFriendlyMessage": "Field permissions can only be used to restrict access, not to grant additional permissions.",
+  },
+  "message": "Field permission can only introduce a restriction",
+  "name": "UserInputError",
+}
+`;
+
+exports[`Field permission upsert should fail when fieldMetadataId does not exist 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "FIELD_METADATA_NOT_FOUND",
+    "userFriendlyMessage": "The field you are trying to set permissions for could not be found. It may have been deleted.",
+  },
+  "message": "Field metadata not found",
+  "name": "NotFoundError",
+}
+`;
+
+exports[`Field permission upsert should fail when object is system object 1`] = `
+{
+  "extensions": {
+    "code": "FORBIDDEN",
+    "subCode": "CANNOT_ADD_FIELD_PERMISSION_ON_SYSTEM_OBJECT",
+    "userFriendlyMessage": "You cannot set field permissions on system objects as they are managed by the platform.",
+  },
+  "message": "Cannot add field permission on system object",
+  "name": "ForbiddenError",
+}
+`;
+
+exports[`Field permission upsert should fail when objectMetadataId does not exist 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "OBJECT_METADATA_NOT_FOUND_PERMISSIONS",
+    "userFriendlyMessage": "The object you are trying to set permissions for could not be found. It may have been deleted.",
+  },
+  "message": "Object metadata not found",
+  "name": "NotFoundError",
+}
+`;
+
+exports[`Field permission upsert should fail when role is not editable (system role) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "fieldPermission": [
+        {
+          "errors": [
+            {
+              "code": "ROLE_BELONGS_TO_ANOTHER_APPLICATION",
+              "message": "Cannot target a role owned by another application",
+              "userFriendlyMessage": "Cannot target a role owned by another application.",
+            },
+            {
+              "code": "ROLE_NOT_EDITABLE",
+              "message": "Role is not editable",
+              "userFriendlyMessage": "This role cannot be modified because it is a system role. Only custom roles can be edited.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "fieldMetadataUniversalIdentifier": Any<String>,
+            "objectMetadataUniversalIdentifier": Any<String>,
+            "roleUniversalIdentifier": Any<String>,
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "fieldPermission",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 fieldPermission",
+    "summary": {
+      "fieldPermission": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Cannot target a role owned by another application.",
+  },
+  "message": "Validation errors occurred while upserting field permissions",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Field permission upsert should fail when roleId does not exist 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "OBJECT_METADATA_NOT_FOUND_PERMISSIONS",
+    "userFriendlyMessage": "The object you are trying to set permissions for could not be found. It may have been deleted.",
+  },
+  "message": "Object metadata not found",
+  "name": "NotFoundError",
+}
+`;
+
+exports[`Field permission upsert should fail when roleId is not a valid UUID 1`] = `
+{
+  "extensions": {
+    "code": "GRAPHQL_VALIDATION_FAILED",
+    "http": {
+      "status": 400,
+    },
+    "userFriendlyMessage": "An error occurred.",
+    "value": "invalid-uuid",
+  },
+  "message": "Invalid UUID: 'invalid-uuid'",
+  "name": "ValidationError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/field-permission/failing-field-permission-upsert.integration-spec.ts

@@ -0,0 +1,308 @@
+import gql from 'graphql-tag';
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { findManyFieldsMetadata } from 'test/integration/metadata/suites/field-metadata/utils/find-many-fields-metadata.util';
+import { upsertFieldPermissions } from 'test/integration/metadata/suites/field-permission/utils/upsert-field-permissions.util';
+import { upsertObjectPermissions } from 'test/integration/metadata/suites/object-permission/utils/upsert-object-permissions.util';
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { findRoles } from 'test/integration/metadata/suites/role/utils/find-roles.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+import {
+  eachTestingContextFilter,
+  type EachTestingContext,
+} from 'twenty-shared/testing';
+import { isDefined } from 'twenty-shared/utils';
+import { v4 } from 'uuid';
+
+import { type UpsertFieldPermissionsInput } from 'src/engine/metadata-modules/object-permission/dtos/upsert-field-permissions.input';
+
+type GlobalTestContext = {
+  editableRoleId: string;
+  nonEditableRoleId: string;
+  systemObjectMetadataId: string;
+  nonSystemObjectMetadataId: string;
+  oneFieldMetadataId: string;
+};
+
+type TestContext = {
+  input: (globalContext: GlobalTestContext) => UpsertFieldPermissionsInput;
+};
+
+const failingFieldPermissionUpsertTestCases: EachTestingContext<TestContext>[] =
+  [
+    {
+      title: 'when roleId is not a valid UUID',
+      context: {
+        input: () => ({
+          roleId: 'invalid-uuid',
+          fieldPermissions: [
+            {
+              objectMetadataId: v4(),
+              fieldMetadataId: v4(),
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when roleId does not exist',
+      context: {
+        input: () => ({
+          roleId: v4(),
+          fieldPermissions: [
+            {
+              objectMetadataId: v4(),
+              fieldMetadataId: v4(),
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when role is not editable (system role)',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.nonEditableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: globalContext.nonSystemObjectMetadataId,
+              fieldMetadataId: globalContext.oneFieldMetadataId,
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when objectMetadataId does not exist',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.editableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: v4(),
+              fieldMetadataId: globalContext.oneFieldMetadataId,
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when fieldMetadataId does not exist',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.editableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: globalContext.nonSystemObjectMetadataId,
+              fieldMetadataId: v4(),
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when object is system object',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.editableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: globalContext.systemObjectMetadataId,
+              fieldMetadataId: globalContext.oneFieldMetadataId,
+              canReadFieldValue: false,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when canReadFieldValue is true (only restriction allowed)',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.editableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: globalContext.nonSystemObjectMetadataId,
+              fieldMetadataId: globalContext.oneFieldMetadataId,
+              canReadFieldValue: true,
+              canUpdateFieldValue: false,
+            },
+          ],
+        }),
+      },
+    },
+    {
+      title: 'when canUpdateFieldValue is true (only restriction allowed)',
+      context: {
+        input: (globalContext: GlobalTestContext) => ({
+          roleId: globalContext.editableRoleId,
+          fieldPermissions: [
+            {
+              objectMetadataId: globalContext.nonSystemObjectMetadataId,
+              fieldMetadataId: globalContext.oneFieldMetadataId,
+              canReadFieldValue: false,
+              canUpdateFieldValue: true,
+            },
+          ],
+        }),
+      },
+    },
+  ];
+
+describe('Field permission upsert should fail', () => {
+  let editableRoleId: string;
+  let nonEditableRoleId: string;
+  let systemObjectMetadataId: string;
+  let nonSystemObjectMetadataId: string;
+  let oneFieldMetadataId: string;
+
+  beforeAll(async () => {
+    const { data: roleData } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Test Role For Field Permission Failing',
+        description: 'Role for field permission failing tests',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: true,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    editableRoleId = roleData?.createOneRole?.id;
+    jestExpectToBeDefined(editableRoleId);
+
+    const { data: rolesData } = await findRoles({
+      expectToFail: false,
+      gqlFields: `
+        id
+        label
+        isEditable
+      `,
+    });
+
+    jestExpectToBeDefined(rolesData?.getRoles);
+    const adminRole = rolesData.getRoles.find(
+      (role: { label: string; isEditable: boolean }) =>
+        role.label === 'Admin' && role.isEditable === false,
+    );
+    jestExpectToBeDefined(adminRole);
+    nonEditableRoleId = adminRole.id;
+
+    const getObjectMetadataOperation = {
+      query: gql`
+        query {
+          objects(paging: { first: 1000 }) {
+            edges {
+              node {
+                id
+                nameSingular
+                isSystem
+              }
+            }
+          }
+        }
+      `,
+    };
+
+    const objectMetadataResponse = await makeMetadataAPIRequest(
+      getObjectMetadataOperation,
+    );
+    const edges = objectMetadataResponse.body.data?.objects?.edges ?? [];
+    const systemObjectNode = edges.find(
+      (edge: { node: { isSystem: boolean | string } }) =>
+        edge.node.isSystem === true || String(edge.node.isSystem) === 'true',
+    )?.node;
+    jestExpectToBeDefined(systemObjectNode);
+    systemObjectMetadataId = systemObjectNode.id;
+
+    const nonSystemObjectNode = edges.find(
+      (edge: { node: { isSystem: boolean | string } }) =>
+        edge.node.isSystem === false || String(edge.node.isSystem) === 'false',
+    )?.node;
+    jestExpectToBeDefined(nonSystemObjectNode);
+    nonSystemObjectMetadataId = nonSystemObjectNode.id;
+
+    const { fields } = await findManyFieldsMetadata({
+      expectToFail: false,
+      input: {
+        filter: { objectMetadataId: { eq: nonSystemObjectMetadataId } },
+        paging: { first: 50 },
+      },
+      gqlFields: 'id type',
+    });
+    jestExpectToBeDefined(fields);
+    expect(fields?.length).toBeGreaterThan(0);
+    const nonRelationField = fields.find(
+      (field: { node: { type: string } }) => field.node.type !== 'RELATION',
+    );
+    jestExpectToBeDefined(nonRelationField);
+    oneFieldMetadataId = nonRelationField.node.id;
+
+    await upsertObjectPermissions({
+      expectToFail: false,
+      input: {
+        roleId: editableRoleId,
+        objectPermissions: [
+          {
+            objectMetadataId: nonSystemObjectMetadataId,
+            canReadObjectRecords: true,
+            canUpdateObjectRecords: false,
+            canSoftDeleteObjectRecords: false,
+            canDestroyObjectRecords: false,
+          },
+        ],
+      },
+    });
+  });
+
+  afterAll(async () => {
+    if (isDefined(editableRoleId)) {
+      await deleteOneRole({
+        expectToFail: false,
+        input: { idToDelete: editableRoleId },
+      });
+    }
+  });
+
+  it.each(eachTestingContextFilter(failingFieldPermissionUpsertTestCases))(
+    '$title',
+    async ({ context }) => {
+      const globalContext: GlobalTestContext = {
+        editableRoleId: editableRoleId ?? '',
+        nonEditableRoleId: nonEditableRoleId ?? '',
+        systemObjectMetadataId: systemObjectMetadataId ?? '',
+        nonSystemObjectMetadataId: nonSystemObjectMetadataId ?? '',
+        oneFieldMetadataId: oneFieldMetadataId ?? '',
+      };
+      const input = context.input(globalContext);
+
+      const { errors } = await upsertFieldPermissions({
+        expectToFail: true,
+        input,
+      });
+
+      expectOneNotInternalServerErrorSnapshot({
+        errors,
+      });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/field-permission/relation-field-permission-grant-back.integration-spec.ts

@@ -0,0 +1,241 @@
+import { upsertFieldPermissions } from 'test/integration/metadata/suites/field-permission/utils/upsert-field-permissions.util';
+import { createOneObjectMetadata } from 'test/integration/metadata/suites/object-metadata/utils/create-one-object-metadata.util';
+import { createRelationBetweenObjects } from 'test/integration/metadata/suites/object-metadata/utils/create-relation-between-objects.util';
+import { deleteOneObjectMetadata } from 'test/integration/metadata/suites/object-metadata/utils/delete-one-object-metadata.util';
+import { updateOneObjectMetadata } from 'test/integration/metadata/suites/object-metadata/utils/update-one-object-metadata.util';
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { findRoles } from 'test/integration/metadata/suites/role/utils/find-roles.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+import { FieldMetadataType } from 'twenty-shared/types';
+import { isDefined } from 'twenty-shared/utils';
+
+import { RelationType } from 'src/engine/metadata-modules/field-metadata/interfaces/relation-type.interface';
+
+const ROLE_GQL_FIELDS_WITH_FIELD_PERMISSIONS = `
+  id
+  label
+  fieldPermissions {
+    objectMetadataId
+    fieldMetadataId
+    canReadFieldValue
+    canUpdateFieldValue
+  }
+`;
+
+describe('Relation field permission grant-back', () => {
+  let createdRoleId: string;
+  let sourceObjectMetadataId: string;
+  let targetObjectMetadataId: string;
+  let relationFieldMetadataId: string;
+  let inverseRelationFieldMetadataId: string;
+
+  const findFieldPermissionsForRole = async () => {
+    const { data } = await findRoles({
+      expectToFail: false,
+      gqlFields: ROLE_GQL_FIELDS_WITH_FIELD_PERMISSIONS,
+    });
+
+    const role = data?.getRoles?.find((r) => r.id === createdRoleId);
+
+    jestExpectToBeDefined(role);
+
+    return role.fieldPermissions ?? [];
+  };
+
+  const restrictFieldUpdate = (field: {
+    objectMetadataId: string;
+    fieldMetadataId: string;
+  }) =>
+    upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [{ ...field, canUpdateFieldValue: false }],
+      },
+    });
+
+  const grantBackField = (field: {
+    objectMetadataId: string;
+    fieldMetadataId: string;
+  }) =>
+    upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [
+          { ...field, canReadFieldValue: null, canUpdateFieldValue: null },
+        ],
+      },
+    });
+
+  beforeAll(async () => {
+    const { data: roleData } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Test Role For Relation Field Permission Grant Back',
+        description: 'Role for relation field permission mirror tests',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: true,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: true,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    createdRoleId = roleData?.createOneRole?.id;
+    jestExpectToBeDefined(createdRoleId);
+
+    const {
+      data: { createOneObject: sourceObject },
+    } = await createOneObjectMetadata({
+      expectToFail: false,
+      input: {
+        nameSingular: 'fpGrantBackSource',
+        namePlural: 'fpGrantBackSources',
+        labelSingular: 'Fp Grant Back Source',
+        labelPlural: 'Fp Grant Back Sources',
+        icon: 'IconSettings',
+      },
+    });
+
+    sourceObjectMetadataId = sourceObject.id;
+    jestExpectToBeDefined(sourceObjectMetadataId);
+
+    const {
+      data: { createOneObject: targetObject },
+    } = await createOneObjectMetadata({
+      expectToFail: false,
+      input: {
+        nameSingular: 'fpGrantBackTarget',
+        namePlural: 'fpGrantBackTargets',
+        labelSingular: 'Fp Grant Back Target',
+        labelPlural: 'Fp Grant Back Targets',
+        icon: 'IconSettings',
+      },
+    });
+
+    targetObjectMetadataId = targetObject.id;
+    jestExpectToBeDefined(targetObjectMetadataId);
+
+    const relationField = await createRelationBetweenObjects({
+      objectMetadataId: sourceObjectMetadataId,
+      targetObjectMetadataId,
+      type: FieldMetadataType.RELATION,
+      relationType: RelationType.MANY_TO_ONE,
+      name: 'grantBackTarget',
+      label: 'Grant Back Target',
+      targetFieldLabel: 'Grant Back Sources',
+    });
+
+    relationFieldMetadataId = relationField.id;
+    inverseRelationFieldMetadataId =
+      relationField.relation.targetFieldMetadata.id;
+    jestExpectToBeDefined(relationFieldMetadataId);
+    jestExpectToBeDefined(inverseRelationFieldMetadataId);
+  });
+
+  afterAll(async () => {
+    if (isDefined(createdRoleId)) {
+      await deleteOneRole({
+        expectToFail: false,
+        input: { idToDelete: createdRoleId },
+      });
+    }
+
+    for (const objectMetadataId of [
+      sourceObjectMetadataId,
+      targetObjectMetadataId,
+    ]) {
+      if (!isDefined(objectMetadataId)) {
+        continue;
+      }
+
+      await updateOneObjectMetadata({
+        expectToFail: false,
+        input: {
+          idToUpdate: objectMetadataId,
+          updatePayload: { isActive: false },
+        },
+      });
+      await deleteOneObjectMetadata({
+        expectToFail: false,
+        input: { idToDelete: objectMetadataId },
+      });
+    }
+  });
+
+  describe.each([
+    {
+      side: 'many-to-one',
+      restricted: () => ({
+        objectMetadataId: sourceObjectMetadataId,
+        fieldMetadataId: relationFieldMetadataId,
+      }),
+      mirrored: () => ({
+        objectMetadataId: targetObjectMetadataId,
+        fieldMetadataId: inverseRelationFieldMetadataId,
+      }),
+    },
+    {
+      side: 'one-to-many',
+      restricted: () => ({
+        objectMetadataId: targetObjectMetadataId,
+        fieldMetadataId: inverseRelationFieldMetadataId,
+      }),
+      mirrored: () => ({
+        objectMetadataId: sourceObjectMetadataId,
+        fieldMetadataId: relationFieldMetadataId,
+      }),
+    },
+  ])('restricting the $side side', ({ restricted, mirrored }) => {
+    afterEach(async () => {
+      await grantBackField(restricted());
+    });
+
+    it('should mirror the edit restriction onto the inverse relation field', async () => {
+      await restrictFieldUpdate(restricted());
+
+      const fieldPermissions = await findFieldPermissionsForRole();
+
+      expect(fieldPermissions).toHaveLength(2);
+      expect(fieldPermissions).toEqual(
+        expect.arrayContaining([
+          expect.objectContaining({
+            ...restricted(),
+            canReadFieldValue: null,
+            canUpdateFieldValue: false,
+          }),
+          expect.objectContaining({
+            ...mirrored(),
+            canReadFieldValue: null,
+            canUpdateFieldValue: false,
+          }),
+        ]),
+      );
+    });
+
+    it('should delete both rows when the restricted field is granted back', async () => {
+      await restrictFieldUpdate(restricted());
+
+      expect(await findFieldPermissionsForRole()).toHaveLength(2);
+
+      await grantBackField(restricted());
+
+      expect(await findFieldPermissionsForRole()).toHaveLength(0);
+    });
+
+    it('should not create empty rows when granting back a field that has no permissions', async () => {
+      expect(await findFieldPermissionsForRole()).toHaveLength(0);
+
+      await grantBackField(restricted());
+
+      expect(await findFieldPermissionsForRole()).toHaveLength(0);
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/field-permission/successful-field-permission-upsert.integration-spec.ts

@@ -0,0 +1,238 @@
+import { findManyFieldsMetadata } from 'test/integration/metadata/suites/field-metadata/utils/find-many-fields-metadata.util';
+import { upsertFieldPermissions } from 'test/integration/metadata/suites/field-permission/utils/upsert-field-permissions.util';
+import { createOneObjectMetadata } from 'test/integration/metadata/suites/object-metadata/utils/create-one-object-metadata.util';
+import { deleteOneObjectMetadata } from 'test/integration/metadata/suites/object-metadata/utils/delete-one-object-metadata.util';
+import { upsertObjectPermissions } from 'test/integration/metadata/suites/object-permission/utils/upsert-object-permissions.util';
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+import { isDefined } from 'twenty-shared/utils';
+
+describe('Field permission upsert should succeed', () => {
+  let createdRoleId: string;
+  let customObjectMetadataId: string;
+  let oneFieldMetadataId: string;
+  let objectWithNoObjectPermissionMetadataId: string;
+  let objectWithNoObjectPermissionFieldMetadataId: string;
+
+  beforeAll(async () => {
+    const { data: roleData } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Test Role For Field Permission Success',
+        description: 'Role for field permission successful tests',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: true,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    createdRoleId = roleData?.createOneRole?.id;
+    jestExpectToBeDefined(createdRoleId);
+
+    const {
+      data: { createOneObject },
+    } = await createOneObjectMetadata({
+      input: {
+        nameSingular: 'testFieldPermissionSuccess',
+        namePlural: 'testFieldPermissionSuccesses',
+        labelSingular: 'Test Field Permission Success',
+        labelPlural: 'Test Field Permission Successes',
+        icon: 'IconSettings',
+      },
+    });
+
+    customObjectMetadataId = createOneObject.id;
+    jestExpectToBeDefined(customObjectMetadataId);
+
+    const {
+      data: { createOneObject: createOneObjectWithNoObjectPermission },
+    } = await createOneObjectMetadata({
+      input: {
+        nameSingular: 'testFieldPermissionNoObjPerm',
+        namePlural: 'testFieldPermissionNoObjPerms',
+        labelSingular: 'Test Field Permission No Obj Perm',
+        labelPlural: 'Test Field Permission No Obj Perms',
+        icon: 'IconSettings',
+      },
+    });
+    objectWithNoObjectPermissionMetadataId =
+      createOneObjectWithNoObjectPermission.id;
+    jestExpectToBeDefined(objectWithNoObjectPermissionMetadataId);
+
+    await upsertObjectPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        objectPermissions: [
+          {
+            objectMetadataId: customObjectMetadataId,
+            canReadObjectRecords: true,
+            canUpdateObjectRecords: true,
+            canSoftDeleteObjectRecords: false,
+            canDestroyObjectRecords: false,
+          },
+        ],
+      },
+    });
+
+    const { fields } = await findManyFieldsMetadata({
+      expectToFail: false,
+      input: {
+        filter: { objectMetadataId: { eq: customObjectMetadataId } },
+        paging: { first: 1 },
+      },
+      gqlFields: 'id',
+    });
+    jestExpectToBeDefined(fields);
+    expect(fields?.length).toBeGreaterThan(0);
+    oneFieldMetadataId = fields[0].node.id;
+
+    const { fields: fieldsNoObjectPermission } = await findManyFieldsMetadata({
+      expectToFail: false,
+      input: {
+        filter: {
+          objectMetadataId: { eq: objectWithNoObjectPermissionMetadataId },
+        },
+        paging: { first: 1 },
+      },
+      gqlFields: 'id',
+    });
+    jestExpectToBeDefined(fieldsNoObjectPermission);
+    expect(fieldsNoObjectPermission?.length).toBeGreaterThan(0);
+    objectWithNoObjectPermissionFieldMetadataId =
+      fieldsNoObjectPermission[0].node.id;
+  });
+
+  afterAll(async () => {
+    if (isDefined(createdRoleId)) {
+      await deleteOneRole({
+        expectToFail: false,
+        input: { idToDelete: createdRoleId },
+      });
+    }
+    if (isDefined(customObjectMetadataId)) {
+      await deleteOneObjectMetadata({
+        expectToFail: false,
+        input: { idToDelete: customObjectMetadataId },
+      });
+    }
+    if (isDefined(objectWithNoObjectPermissionMetadataId)) {
+      await deleteOneObjectMetadata({
+        expectToFail: false,
+        input: { idToDelete: objectWithNoObjectPermissionMetadataId },
+      });
+    }
+  });
+
+  it('should upsert one field permission (create)', async () => {
+    const { data } = await upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [
+          {
+            objectMetadataId: customObjectMetadataId,
+            fieldMetadataId: oneFieldMetadataId,
+            canReadFieldValue: false,
+            canUpdateFieldValue: false,
+          },
+        ],
+      },
+    });
+
+    expect(data?.upsertFieldPermissions).toHaveLength(1);
+    expect(data?.upsertFieldPermissions?.[0]).toMatchObject({
+      objectMetadataId: customObjectMetadataId,
+      fieldMetadataId: oneFieldMetadataId,
+      roleId: createdRoleId,
+      canReadFieldValue: false,
+      canUpdateFieldValue: false,
+    });
+  });
+
+  it('should upsert to update existing field permission', async () => {
+    const { data } = await upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [
+          {
+            objectMetadataId: customObjectMetadataId,
+            fieldMetadataId: oneFieldMetadataId,
+            canReadFieldValue: false,
+            canUpdateFieldValue: false,
+          },
+        ],
+      },
+    });
+
+    expect(data?.upsertFieldPermissions).toHaveLength(1);
+    expect(data?.upsertFieldPermissions?.[0]).toMatchObject({
+      objectMetadataId: customObjectMetadataId,
+      fieldMetadataId: oneFieldMetadataId,
+      roleId: createdRoleId,
+      canReadFieldValue: false,
+      canUpdateFieldValue: false,
+    });
+  });
+
+  it('should upsert with both canReadFieldValue and canUpdateFieldValue false', async () => {
+    const { data } = await upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [
+          {
+            objectMetadataId: customObjectMetadataId,
+            fieldMetadataId: oneFieldMetadataId,
+            canReadFieldValue: false,
+            canUpdateFieldValue: false,
+          },
+        ],
+      },
+    });
+
+    expect(data?.upsertFieldPermissions).toHaveLength(1);
+    expect(data?.upsertFieldPermissions?.[0]).toMatchObject({
+      objectMetadataId: customObjectMetadataId,
+      fieldMetadataId: oneFieldMetadataId,
+      roleId: createdRoleId,
+      canReadFieldValue: false,
+      canUpdateFieldValue: false,
+    });
+  });
+
+  it('should upsert even when object permission is not found for role on object', async () => {
+    const { data } = await upsertFieldPermissions({
+      expectToFail: false,
+      input: {
+        roleId: createdRoleId,
+        fieldPermissions: [
+          {
+            objectMetadataId: objectWithNoObjectPermissionMetadataId,
+            fieldMetadataId: objectWithNoObjectPermissionFieldMetadataId,
+            canReadFieldValue: false,
+            canUpdateFieldValue: false,
+          },
+        ],
+      },
+    });
+
+    expect(data?.upsertFieldPermissions).toHaveLength(1);
+    expect(data?.upsertFieldPermissions?.[0]).toMatchObject({
+      objectMetadataId: objectWithNoObjectPermissionMetadataId,
+      fieldMetadataId: objectWithNoObjectPermissionFieldMetadataId,
+      roleId: createdRoleId,
+      canReadFieldValue: false,
+      canUpdateFieldValue: false,
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/field-permission/utils/upsert-field-permissions-query-factory.util.ts

@@ -0,0 +1,35 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+import { type UpsertFieldPermissionsInput } from 'src/engine/metadata-modules/object-permission/dtos/upsert-field-permissions.input';
+
+export type UpsertFieldPermissionsFactoryInput = UpsertFieldPermissionsInput;
+
+const DEFAULT_FIELD_PERMISSION_GQL_FIELDS = `
+  id
+  objectMetadataId
+  fieldMetadataId
+  roleId
+  canReadFieldValue
+  canUpdateFieldValue
+`;
+
+export const upsertFieldPermissionsQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_FIELD_PERMISSION_GQL_FIELDS,
+}: PerformMetadataQueryParams<UpsertFieldPermissionsFactoryInput>) => ({
+  query: gql`
+    mutation UpsertFieldPermissions(
+      $upsertFieldPermissionsInput: UpsertFieldPermissionsInput!
+    ) {
+      upsertFieldPermissions(
+        upsertFieldPermissionsInput: $upsertFieldPermissionsInput
+      ) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    upsertFieldPermissionsInput: input,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/field-permission/utils/upsert-field-permissions.util.ts

@@ -0,0 +1,43 @@
+import {
+  type UpsertFieldPermissionsFactoryInput,
+  upsertFieldPermissionsQueryFactory,
+} from 'test/integration/metadata/suites/field-permission/utils/upsert-field-permissions-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FieldPermissionDTO } from 'src/engine/metadata-modules/object-permission/dtos/field-permission.dto';
+
+export const upsertFieldPermissions = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<UpsertFieldPermissionsFactoryInput>): CommonResponseBody<{
+  upsertFieldPermissions: FieldPermissionDTO[];
+}> => {
+  const graphqlOperation = upsertFieldPermissionsQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Field permissions upsert should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Field permissions upsert has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};