snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/front-component/__snapshots__/failing-front-component-creation.integration-spec.ts.snap

@@ -0,0 +1,361 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Front component creation should fail when builtComponentPath contains path traversal 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must not contain path traversal (..)",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "TraversalTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when builtComponentPath has a completely unrelated extension (.pdf) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .mjs",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "PdfExtTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when builtComponentPath has an invalid extension (.js instead of .mjs) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .mjs",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "InvalidExtTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when builtComponentPath is a folder path without extension (bare UUID) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Filename must have an extension",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "FolderPathTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when builtComponentPath is an absolute path 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must be relative, not absolute",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "AbsolutePathTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when name is empty 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Front component name is required",
+              "userFriendlyMessage": "Front component name is required",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Front component name is required",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when name is whitespace-only 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Front component name is required",
+              "userFriendlyMessage": "Front component name is required",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Front component name is required",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when sourceComponentPath contains path traversal 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must not contain path traversal (..)",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "TraversalTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when sourceComponentPath has an invalid extension (.mjs instead of .ts/.tsx) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .ts, .tsx, .json",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "InvalidSourceExtTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component creation should fail when sourceComponentPath is a folder path without extension 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Filename must have an extension",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "name": "FolderSourcePathTest",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Multiple validation errors occurred while creating front component",
+  "name": "GraphQLError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/front-component/__snapshots__/failing-front-component-deletion.integration-spec.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Front component deletion should fail when front component does not exist 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "FRONT_COMPONENT_NOT_FOUND",
+    "userFriendlyMessage": "Front component not found.",
+  },
+  "message": "Front component to destroy not found",
+  "name": "NotFoundError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/front-component/__snapshots__/failing-front-component-update-path-traversal.integration-spec.ts.snap

@@ -0,0 +1,316 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is a folder path without extension (bare UUID) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Filename must have an extension",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is updated with a completely unrelated extension (.pdf) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .mjs",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is updated with absolute path via manifest sync 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must be relative, not absolute",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is updated with backslash path via manifest sync 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must not contain backslashes",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is updated with invalid extension (.js instead of .mjs) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .mjs",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when builtComponentPath is updated with path traversal via manifest sync 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must not contain path traversal (..)",
+              "userFriendlyMessage": "Built component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Built component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when sourceComponentPath is a folder path without extension 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Filename must have an extension",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when sourceComponentPath is updated with invalid extension (.mjs instead of .ts/.tsx) 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Invalid file extension. Allowed extensions: .ts, .tsx, .json",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Front component update via manifest sync should fail for path traversal when sourceComponentPath is updated with path traversal via manifest sync 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "frontComponent": [
+        {
+          "errors": [
+            {
+              "code": "INVALID_FRONT_COMPONENT_INPUT",
+              "message": "Resource path must not contain path traversal (..)",
+              "userFriendlyMessage": "Source component path is invalid",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "frontComponent",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 frontComponent",
+    "summary": {
+      "frontComponent": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "Source component path is invalid",
+  },
+  "message": "Validation errors occurred while syncing application manifest metadata",
+  "name": "GraphQLError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/front-component/__snapshots__/failing-front-component-update.integration-spec.ts.snap

@@ -0,0 +1,13 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Front component update should fail when front component does not exist 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "FRONT_COMPONENT_NOT_FOUND",
+    "userFriendlyMessage": "Front component not found.",
+  },
+  "message": "Front component not found",
+  "name": "NotFoundError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/front-component/failing-front-component-creation.integration-spec.ts

@@ -0,0 +1,170 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
+import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
+import {
+  type EachTestingContext,
+  eachTestingContextFilter,
+} from 'twenty-shared/testing';
+
+import { type CreateFrontComponentInput } from 'src/engine/metadata-modules/front-component/dtos/create-front-component.input';
+
+type TestContext = {
+  input: CreateFrontComponentInput;
+};
+
+const FAILING_TEST_CASES: EachTestingContext<TestContext>[] = [
+  {
+    title: 'when name is empty',
+    context: {
+      input: {
+        name: '',
+        componentName: 'TestComponent',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title: 'when name is whitespace-only',
+    context: {
+      input: {
+        name: '   ',
+        componentName: 'TestComponent',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title: 'when builtComponentPath contains path traversal',
+    context: {
+      input: {
+        name: 'TraversalTest',
+        componentName: 'TraversalTest',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath:
+          '../../../other-workspace/other-app/BuiltFrontComponent/stolen.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title: 'when sourceComponentPath contains path traversal',
+    context: {
+      input: {
+        name: 'TraversalTest',
+        componentName: 'TraversalTest',
+        sourceComponentPath: '../../etc/passwd',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title: 'when builtComponentPath is an absolute path',
+    context: {
+      input: {
+        name: 'AbsolutePathTest',
+        componentName: 'AbsolutePathTest',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: '/etc/passwd',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is a folder path without extension (bare UUID)',
+    context: {
+      input: {
+        name: 'FolderPathTest',
+        componentName: 'FolderPathTest',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: '8b2df3cc-23ad-4e1b-87fd-f880d4cefd58',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title:
+      'when sourceComponentPath is a folder path without extension',
+    context: {
+      input: {
+        name: 'FolderSourcePathTest',
+        componentName: 'FolderSourcePathTest',
+        sourceComponentPath: 'src/front-components/my-component',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title:
+      'when builtComponentPath has an invalid extension (.js instead of .mjs)',
+    context: {
+      input: {
+        name: 'InvalidExtTest',
+        componentName: 'InvalidExtTest',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.js',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title:
+      'when sourceComponentPath has an invalid extension (.mjs instead of .ts/.tsx)',
+    context: {
+      input: {
+        name: 'InvalidSourceExtTest',
+        componentName: 'InvalidSourceExtTest',
+        sourceComponentPath: 'src/front-components/index.mjs',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+  {
+    title:
+      'when builtComponentPath has a completely unrelated extension (.pdf)',
+    context: {
+      input: {
+        name: 'PdfExtTest',
+        componentName: 'PdfExtTest',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.pdf',
+        builtComponentChecksum: 'abc123',
+      },
+    },
+  },
+];
+
+describe('Front component creation should fail', () => {
+  let cleanupBuiltFile: (() => void) | undefined;
+
+  beforeAll(async () => {
+    const { cleanup } = await seedBuiltFrontComponentFile({
+      builtComponentPath: 'src/front-components/index.mjs',
+    });
+
+    cleanupBuiltFile = cleanup;
+  });
+
+  afterAll(() => {
+    cleanupBuiltFile?.();
+  });
+
+  it.each(eachTestingContextFilter(FAILING_TEST_CASES))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await createFrontComponent({
+        expectToFail: true,
+        input: context.input,
+      });
+
+      expectOneNotInternalServerErrorSnapshot({ errors });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/front-component/failing-front-component-deletion.integration-spec.ts

@@ -0,0 +1,34 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { deleteFrontComponent } from 'test/integration/metadata/suites/front-component/utils/delete-front-component.util';
+import {
+  type EachTestingContext,
+  eachTestingContextFilter,
+} from 'twenty-shared/testing';
+import { v4 } from 'uuid';
+
+type TestContext = {
+  id: string;
+};
+
+const FAILING_TEST_CASES: EachTestingContext<TestContext>[] = [
+  {
+    title: 'when front component does not exist',
+    context: {
+      id: v4(),
+    },
+  },
+];
+
+describe('Front component deletion should fail', () => {
+  it.each(eachTestingContextFilter(FAILING_TEST_CASES))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await deleteFrontComponent({
+        expectToFail: true,
+        input: { id: context.id },
+      });
+
+      expectOneNotInternalServerErrorSnapshot({ errors });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/front-component/failing-front-component-update-path-traversal.integration-spec.ts

@@ -0,0 +1,186 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { uploadApplicationFile } from 'test/integration/metadata/suites/application/utils/upload-application-file.util';
+import {
+  type FrontComponentManifest,
+  type Manifest,
+} from 'twenty-shared/application';
+import {
+  type EachTestingContext,
+  eachTestingContextFilter,
+} from 'twenty-shared/testing';
+import { v4 as uuidv4 } from 'uuid';
+
+const TEST_APP_ID = uuidv4();
+const TEST_ROLE_ID = uuidv4();
+const FRONT_COMPONENT_ID = uuidv4();
+
+const VALID_BUILT_PATH = 'src/front-components/test.mjs';
+
+const buildValidFrontComponent = (): FrontComponentManifest => ({
+  universalIdentifier: FRONT_COMPONENT_ID,
+  name: 'TestComponent',
+  description: 'A test front component',
+  sourceComponentPath: 'src/front-components/test.tsx',
+  builtComponentPath: VALID_BUILT_PATH,
+  builtComponentChecksum: 'valid-checksum',
+  componentName: 'TestComponent',
+  isHeadless: false,
+});
+
+const buildManifest = (
+  frontComponentOverrides: Partial<FrontComponentManifest> = {},
+): Manifest =>
+  buildBaseManifest({
+    appId: TEST_APP_ID,
+    roleId: TEST_ROLE_ID,
+    overrides: {
+      frontComponents: [
+        {
+          ...buildValidFrontComponent(),
+          ...frontComponentOverrides,
+        },
+      ],
+    },
+  });
+
+type TestContext = {
+  manifest: Manifest;
+};
+
+const FAILING_UPDATE_TEST_CASES: EachTestingContext<TestContext>[] = [
+  {
+    title:
+      'when builtComponentPath is updated with path traversal via manifest sync',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath:
+          '../../../other-workspace/other-app/BuiltFrontComponent/stolen.mjs',
+      }),
+    },
+  },
+  {
+    title:
+      'when sourceComponentPath is updated with path traversal via manifest sync',
+    context: {
+      manifest: buildManifest({
+        sourceComponentPath: '../../etc/passwd',
+      }),
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is updated with absolute path via manifest sync',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath: '/etc/passwd',
+      }),
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is updated with backslash path via manifest sync',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath: '..\\..\\..\\etc\\passwd',
+      }),
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is a folder path without extension (bare UUID)',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath: '8b2df3cc-23ad-4e1b-87fd-f880d4cefd58',
+      }),
+    },
+  },
+  {
+    title:
+      'when sourceComponentPath is a folder path without extension',
+    context: {
+      manifest: buildManifest({
+        sourceComponentPath: 'src/front-components/my-component',
+      }),
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is updated with invalid extension (.js instead of .mjs)',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath: 'src/front-components/test.js',
+      }),
+    },
+  },
+  {
+    title:
+      'when sourceComponentPath is updated with invalid extension (.mjs instead of .ts/.tsx)',
+    context: {
+      manifest: buildManifest({
+        sourceComponentPath: 'src/front-components/test.mjs',
+      }),
+    },
+  },
+  {
+    title:
+      'when builtComponentPath is updated with a completely unrelated extension (.pdf)',
+    context: {
+      manifest: buildManifest({
+        builtComponentPath: 'src/front-components/test.pdf',
+      }),
+    },
+  },
+];
+
+describe('Front component update via manifest sync should fail for path traversal', () => {
+  beforeAll(async () => {
+    await setupApplicationForSync({
+      applicationUniversalIdentifier: TEST_APP_ID,
+      name: 'Test Path Traversal App',
+      description: 'App for testing path traversal validation on update',
+      sourcePath: 'test-path-traversal',
+    });
+
+    jest.useRealTimers();
+
+    await uploadApplicationFile({
+      applicationUniversalIdentifier: TEST_APP_ID,
+      fileFolder: 'BuiltFrontComponent',
+      filePath: VALID_BUILT_PATH,
+      fileBuffer: Buffer.from('dummy built component content'),
+      filename: 'test.mjs',
+      contentType: 'application/javascript',
+      expectToFail: false,
+    });
+
+    jest.useFakeTimers();
+
+    await syncApplication({
+      manifest: buildManifest(),
+      expectToFail: false,
+    });
+  }, 60000);
+
+  afterAll(async () => {
+    await cleanupApplicationAndAppRegistration({
+      applicationUniversalIdentifier: TEST_APP_ID,
+    });
+  });
+
+  it.each(eachTestingContextFilter(FAILING_UPDATE_TEST_CASES))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await syncApplication({
+        manifest: context.manifest,
+        expectToFail: true,
+      });
+
+      expectOneNotInternalServerErrorSnapshot({ errors });
+    },
+    60000,
+  );
+});

packages/twenty-server/test/integration/metadata/suites/front-component/failing-front-component-update.integration-spec.ts

@@ -0,0 +1,41 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { updateFrontComponent } from 'test/integration/metadata/suites/front-component/utils/update-front-component.util';
+import {
+  type EachTestingContext,
+  eachTestingContextFilter,
+} from 'twenty-shared/testing';
+import { v4 } from 'uuid';
+
+type TestContext = {
+  id: string;
+  name: string;
+};
+
+const FAILING_TEST_CASES: EachTestingContext<TestContext>[] = [
+  {
+    title: 'when front component does not exist',
+    context: {
+      id: v4(),
+      name: 'updatedName',
+    },
+  },
+];
+
+describe('Front component update should fail', () => {
+  it.each(eachTestingContextFilter(FAILING_TEST_CASES))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await updateFrontComponent({
+        expectToFail: true,
+        input: {
+          id: context.id,
+          update: {
+            name: context.name,
+          },
+        },
+      });
+
+      expectOneNotInternalServerErrorSnapshot({ errors });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/front-component/successful-front-component-application-variables.integration-spec.ts

@@ -0,0 +1,134 @@
+import { buildBaseManifest } from 'test/integration/metadata/suites/application/utils/build-base-manifest.util';
+import { cleanupApplicationAndAppRegistration } from 'test/integration/metadata/suites/application/utils/cleanup-application-and-app-registration.util';
+import { setupApplicationForSync } from 'test/integration/metadata/suites/application/utils/setup-application-for-sync.util';
+import { syncApplication } from 'test/integration/metadata/suites/application/utils/sync-application.util';
+import { uploadApplicationFile } from 'test/integration/metadata/suites/application/utils/upload-application-file.util';
+import { findFrontComponent } from 'test/integration/metadata/suites/front-component/utils/find-front-component.util';
+import { findFrontComponents } from 'test/integration/metadata/suites/front-component/utils/find-front-components.util';
+import { type Manifest } from 'twenty-shared/application';
+import { isDefined } from 'twenty-shared/utils';
+import { v4 as uuidv4 } from 'uuid';
+
+const TEST_APP_ID = uuidv4();
+const TEST_ROLE_ID = uuidv4();
+const FRONT_COMPONENT_ID = uuidv4();
+const PUBLIC_VARIABLE_ID = uuidv4();
+const SECRET_VARIABLE_ID = uuidv4();
+
+const BUILT_COMPONENT_PATH = 'src/front-components/variables.mjs';
+const PUBLIC_VARIABLE_VALUE = 'pk.public-access-token';
+
+const buildManifest = (): Manifest => {
+  const baseManifest = buildBaseManifest({
+    appId: TEST_APP_ID,
+    roleId: TEST_ROLE_ID,
+  });
+
+  return {
+    ...baseManifest,
+    application: {
+      ...baseManifest.application,
+      applicationVariables: {
+        PUBLIC_ACCESS_TOKEN: {
+          universalIdentifier: PUBLIC_VARIABLE_ID,
+          value: PUBLIC_VARIABLE_VALUE,
+        },
+        API_SECRET: {
+          universalIdentifier: SECRET_VARIABLE_ID,
+          isSecret: true,
+        },
+      },
+    },
+    frontComponents: [
+      {
+        universalIdentifier: FRONT_COMPONENT_ID,
+        name: 'VariablesComponent',
+        description: 'A front component reading application variables',
+        sourceComponentPath: 'src/front-components/variables.tsx',
+        builtComponentPath: BUILT_COMPONENT_PATH,
+        builtComponentChecksum: 'variables-checksum',
+        componentName: 'VariablesComponent',
+        isHeadless: false,
+      },
+    ],
+  };
+};
+
+describe('Front component application variables', () => {
+  let frontComponentId: string;
+
+  beforeAll(async () => {
+    await setupApplicationForSync({
+      applicationUniversalIdentifier: TEST_APP_ID,
+      name: 'Test Application Variables App',
+      description: 'App for testing front component application variables',
+      sourcePath: 'test-application-variables',
+    });
+
+    jest.useRealTimers();
+
+    await uploadApplicationFile({
+      applicationUniversalIdentifier: TEST_APP_ID,
+      fileFolder: 'BuiltFrontComponent',
+      filePath: BUILT_COMPONENT_PATH,
+      fileBuffer: Buffer.from('dummy built component content'),
+      filename: 'variables.mjs',
+      contentType: 'application/javascript',
+      expectToFail: false,
+    });
+
+    jest.useFakeTimers();
+
+    await syncApplication({
+      manifest: buildManifest(),
+      expectToFail: false,
+    });
+
+    const { data } = await findFrontComponents({});
+
+    const syncedFrontComponent = data.frontComponents.find(
+      ({ universalIdentifier }) => universalIdentifier === FRONT_COMPONENT_ID,
+    );
+
+    if (!isDefined(syncedFrontComponent)) {
+      throw new Error('Synced front component was not found');
+    }
+
+    frontComponentId = syncedFrontComponent.id;
+  }, 60000);
+
+  afterAll(async () => {
+    await cleanupApplicationAndAppRegistration({
+      applicationUniversalIdentifier: TEST_APP_ID,
+    });
+  });
+
+  it('should store application variable values encrypted at rest', async () => {
+    const rows = await globalThis.testDataSource.query(
+      `SELECT key, value FROM core."applicationVariable"
+       WHERE "universalIdentifier" = ANY($1)`,
+      [[PUBLIC_VARIABLE_ID, SECRET_VARIABLE_ID]],
+    );
+
+    const publicVariable = rows.find(
+      ({ key }: { key: string }) => key === 'PUBLIC_ACCESS_TOKEN',
+    );
+
+    expect(publicVariable.value).toMatch(/^enc:v2:/);
+    expect(publicVariable.value).not.toContain(PUBLIC_VARIABLE_VALUE);
+  });
+
+  it('should expose non-secret application variables decrypted and exclude secret ones', async () => {
+    const { data } = await findFrontComponent({
+      input: { id: frontComponentId },
+      gqlFields: `
+        id
+        applicationVariables
+      `,
+    });
+
+    expect(data.frontComponent.applicationVariables).toEqual({
+      PUBLIC_ACCESS_TOKEN: PUBLIC_VARIABLE_VALUE,
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/front-component/successful-front-component-creation.integration-spec.ts

@@ -0,0 +1,70 @@
+import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
+import { deleteFrontComponent } from 'test/integration/metadata/suites/front-component/utils/delete-front-component.util';
+import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
+
+describe('Front component creation should succeed', () => {
+  let createdFrontComponentId: string | undefined;
+  let cleanupBuiltFile: (() => void) | undefined;
+
+  beforeAll(async () => {
+    const { cleanup } = await seedBuiltFrontComponentFile({
+      builtComponentPath: 'src/front-components/index.mjs',
+    });
+
+    cleanupBuiltFile = cleanup;
+  });
+
+  afterAll(() => {
+    cleanupBuiltFile?.();
+  });
+
+  afterEach(async () => {
+    if (createdFrontComponentId) {
+      await deleteFrontComponent({
+        expectToFail: false,
+        input: { id: createdFrontComponentId },
+      });
+      createdFrontComponentId = undefined;
+    }
+  });
+
+  it('should create a basic front component with minimal input', async () => {
+    const { data } = await createFrontComponent({
+      expectToFail: false,
+      input: {
+        name: 'testFrontComponent',
+        componentName: 'TestFrontComponent',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    });
+
+    createdFrontComponentId = data?.createFrontComponent?.id;
+
+    expect(data.createFrontComponent).toMatchObject({
+      id: expect.any(String),
+      name: 'testFrontComponent',
+    });
+  });
+
+  it('should sanitize input by trimming whitespace', async () => {
+    const { data } = await createFrontComponent({
+      expectToFail: false,
+      input: {
+        name: '  frontComponentWithSpaces  ',
+        componentName: 'FrontComponentWithSpaces',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    });
+
+    createdFrontComponentId = data?.createFrontComponent?.id;
+
+    expect(data.createFrontComponent).toMatchObject({
+      id: expect.any(String),
+      name: 'frontComponentWithSpaces',
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/front-component/successful-front-component-deletion.integration-spec.ts

@@ -0,0 +1,59 @@
+import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
+import { deleteFrontComponent } from 'test/integration/metadata/suites/front-component/utils/delete-front-component.util';
+import { findFrontComponent } from 'test/integration/metadata/suites/front-component/utils/find-front-component.util';
+import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
+
+describe('Front component deletion should succeed', () => {
+  let cleanupBuiltFile: (() => void) | undefined;
+
+  beforeAll(async () => {
+    const { cleanup } = await seedBuiltFrontComponentFile({
+      builtComponentPath: 'src/front-components/index.mjs',
+    });
+
+    cleanupBuiltFile = cleanup;
+  });
+
+  afterAll(() => {
+    cleanupBuiltFile?.();
+  });
+
+  it('should successfully delete a front component', async () => {
+    const { data: createData } = await createFrontComponent({
+      expectToFail: false,
+      input: {
+        name: 'frontComponentToDelete',
+        componentName: 'FrontComponentToDelete',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    });
+
+    const frontComponentId = createData.createFrontComponent.id;
+
+    const { data: findBeforeData } = await findFrontComponent({
+      expectToFail: false,
+      input: { id: frontComponentId },
+    });
+
+    expect(findBeforeData.frontComponent.id).toBe(frontComponentId);
+
+    const { data: deleteData } = await deleteFrontComponent({
+      expectToFail: false,
+      input: { id: frontComponentId },
+    });
+
+    expect(deleteData.deleteFrontComponent).toMatchObject({
+      id: frontComponentId,
+      name: 'frontComponentToDelete',
+    });
+
+    const { data: findAfterData } = await findFrontComponent({
+      expectToFail: false,
+      input: { id: frontComponentId },
+    });
+
+    expect(findAfterData.frontComponent).toBeNull();
+  });
+});

packages/twenty-server/test/integration/metadata/suites/front-component/successful-front-component-update.integration-spec.ts

@@ -0,0 +1,68 @@
+import { createFrontComponent } from 'test/integration/metadata/suites/front-component/utils/create-front-component.util';
+import { deleteFrontComponent } from 'test/integration/metadata/suites/front-component/utils/delete-front-component.util';
+import { seedBuiltFrontComponentFile } from 'test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util';
+import { updateFrontComponent } from 'test/integration/metadata/suites/front-component/utils/update-front-component.util';
+import { isDefined } from 'twenty-shared/utils';
+
+describe('Front component update should succeed', () => {
+  let testFrontComponentId: string | undefined;
+  let cleanupBuiltFile: (() => void) | undefined;
+
+  beforeAll(async () => {
+    const { cleanup } = await seedBuiltFrontComponentFile({
+      builtComponentPath: 'src/front-components/index.mjs',
+    });
+
+    cleanupBuiltFile = cleanup;
+  });
+
+  afterAll(() => {
+    cleanupBuiltFile?.();
+  });
+
+  beforeEach(async () => {
+    const { data } = await createFrontComponent({
+      expectToFail: false,
+      input: {
+        name: 'testFrontComponentToUpdate',
+        componentName: 'TestFrontComponentToUpdate',
+        sourceComponentPath: 'src/front-components/index.tsx',
+        builtComponentPath: 'src/front-components/index.mjs',
+        builtComponentChecksum: 'abc123',
+      },
+    });
+
+    testFrontComponentId = data.createFrontComponent.id;
+  });
+
+  afterEach(async () => {
+    if (isDefined(testFrontComponentId)) {
+      await deleteFrontComponent({
+        expectToFail: false,
+        input: { id: testFrontComponentId },
+      });
+      testFrontComponentId = undefined;
+    }
+  });
+
+  it('should update front component name', async () => {
+    if (!isDefined(testFrontComponentId)) {
+      throw new Error('testFrontComponentId should be defined');
+    }
+
+    const { data } = await updateFrontComponent({
+      expectToFail: false,
+      input: {
+        id: testFrontComponentId,
+        update: {
+          name: 'updatedFrontComponentName',
+        },
+      },
+    });
+
+    expect(data.updateFrontComponent).toMatchObject({
+      id: testFrontComponentId,
+      name: 'updatedFrontComponentName',
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/create-front-component-query-factory.util.ts

@@ -0,0 +1,30 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+import { type CreateFrontComponentInput } from 'src/engine/metadata-modules/front-component/dtos/create-front-component.input';
+
+export type CreateFrontComponentFactoryInput = CreateFrontComponentInput;
+
+const DEFAULT_FRONT_COMPONENT_GQL_FIELDS = `
+  id
+  name
+  applicationId
+  createdAt
+  updatedAt
+`;
+
+export const createFrontComponentQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_FRONT_COMPONENT_GQL_FIELDS,
+}: PerformMetadataQueryParams<CreateFrontComponentFactoryInput>) => ({
+  query: gql`
+    mutation CreateFrontComponent($input: CreateFrontComponentInput!) {
+      createFrontComponent(input: $input) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    input,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/create-front-component.util.ts

@@ -0,0 +1,43 @@
+import {
+  type CreateFrontComponentFactoryInput,
+  createFrontComponentQueryFactory,
+} from 'test/integration/metadata/suites/front-component/utils/create-front-component-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FrontComponentDTO } from 'src/engine/metadata-modules/front-component/dtos/front-component.dto';
+
+export const createFrontComponent = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<CreateFrontComponentFactoryInput>): CommonResponseBody<{
+  createFrontComponent: FrontComponentDTO;
+}> => {
+  const graphqlOperation = createFrontComponentQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Front component creation should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Front component creation has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/front-component/utils/delete-front-component-query-factory.util.ts

@@ -0,0 +1,27 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+export type DeleteFrontComponentFactoryInput = {
+  id: string;
+};
+
+const DEFAULT_FRONT_COMPONENT_GQL_FIELDS = `
+  id
+  name
+`;
+
+export const deleteFrontComponentQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_FRONT_COMPONENT_GQL_FIELDS,
+}: PerformMetadataQueryParams<DeleteFrontComponentFactoryInput>) => ({
+  query: gql`
+    mutation DeleteFrontComponent($id: UUID!) {
+      deleteFrontComponent(id: $id) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    id: input.id,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/delete-front-component.util.ts

@@ -0,0 +1,43 @@
+import {
+  type DeleteFrontComponentFactoryInput,
+  deleteFrontComponentQueryFactory,
+} from 'test/integration/metadata/suites/front-component/utils/delete-front-component-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FrontComponentDTO } from 'src/engine/metadata-modules/front-component/dtos/front-component.dto';
+
+export const deleteFrontComponent = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<DeleteFrontComponentFactoryInput>): CommonResponseBody<{
+  deleteFrontComponent: FrontComponentDTO;
+}> => {
+  const graphqlOperation = deleteFrontComponentQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Front component deletion should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Front component deletion has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/front-component/utils/find-front-component-query-factory.util.ts

@@ -0,0 +1,30 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+export type FindFrontComponentFactoryInput = {
+  id: string;
+};
+
+const DEFAULT_FRONT_COMPONENT_GQL_FIELDS = `
+  id
+  name
+  applicationId
+  createdAt
+  updatedAt
+`;
+
+export const findFrontComponentQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_FRONT_COMPONENT_GQL_FIELDS,
+}: PerformMetadataQueryParams<FindFrontComponentFactoryInput>) => ({
+  query: gql`
+    query FrontComponent($id: UUID!) {
+      frontComponent(id: $id) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    id: input.id,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/find-front-component.util.ts

@@ -0,0 +1,43 @@
+import {
+  type FindFrontComponentFactoryInput,
+  findFrontComponentQueryFactory,
+} from 'test/integration/metadata/suites/front-component/utils/find-front-component-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FrontComponentDTO } from 'src/engine/metadata-modules/front-component/dtos/front-component.dto';
+
+export const findFrontComponent = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<FindFrontComponentFactoryInput>): CommonResponseBody<{
+  frontComponent: FrontComponentDTO;
+}> => {
+  const graphqlOperation = findFrontComponentQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Finding front component should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Finding front component has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/front-component/utils/find-front-components-query-factory.util.ts

@@ -0,0 +1,21 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+const DEFAULT_FRONT_COMPONENTS_GQL_FIELDS = `
+  id
+  name
+  universalIdentifier
+  applicationId
+`;
+
+export const findFrontComponentsQueryFactory = ({
+  gqlFields = DEFAULT_FRONT_COMPONENTS_GQL_FIELDS,
+}: Partial<PerformMetadataQueryParams<undefined>>) => ({
+  query: gql`
+    query FrontComponents {
+      frontComponents {
+        ${gqlFields}
+      }
+    }
+  `,
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/find-front-components.util.ts

@@ -0,0 +1,36 @@
+import { findFrontComponentsQueryFactory } from 'test/integration/metadata/suites/front-component/utils/find-front-components-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FrontComponentDTO } from 'src/engine/metadata-modules/front-component/dtos/front-component.dto';
+
+export const findFrontComponents = async ({
+  gqlFields,
+  expectToFail = false,
+  token,
+}: Partial<PerformMetadataQueryParams<undefined>>): CommonResponseBody<{
+  frontComponents: FrontComponentDTO[];
+}> => {
+  const graphqlOperation = findFrontComponentsQueryFactory({ gqlFields });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Finding front components should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Finding front components has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/front-component/utils/seed-built-front-component-file.util.ts

@@ -0,0 +1,47 @@
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+
+import { SEED_APPLE_WORKSPACE_ID } from 'src/engine/workspace-manager/dev-seeder/core/constants/seeder-workspaces.constant';
+
+const STORAGE_LOCAL_PATH = join(process.cwd(), '.local-storage');
+
+const getWorkspaceCustomApplicationUniversalIdentifier = async (
+  workspaceId: string,
+): Promise<string> => {
+  const result = await global.testDataSource.query(
+    'SELECT "workspaceCustomApplicationId" FROM core.workspace WHERE id = $1',
+    [workspaceId],
+  );
+
+  return result[0].workspaceCustomApplicationId;
+};
+
+export const seedBuiltFrontComponentFile = async ({
+  workspaceId = SEED_APPLE_WORKSPACE_ID,
+  builtComponentPath,
+}: {
+  workspaceId?: string;
+  builtComponentPath: string;
+}): Promise<{ cleanup: () => void }> => {
+  const applicationUniversalIdentifier =
+    await getWorkspaceCustomApplicationUniversalIdentifier(workspaceId);
+
+  const filePath = join(
+    STORAGE_LOCAL_PATH,
+    workspaceId,
+    applicationUniversalIdentifier,
+    'built-front-component',
+    builtComponentPath,
+  );
+
+  mkdirSync(dirname(filePath), { recursive: true });
+  writeFileSync(filePath, 'dummy built component content');
+
+  return {
+    cleanup: () => {
+      if (existsSync(filePath)) {
+        rmSync(filePath);
+      }
+    },
+  };
+};

packages/twenty-server/test/integration/metadata/suites/front-component/utils/update-front-component-query-factory.util.ts

@@ -0,0 +1,30 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+import { type UpdateFrontComponentInput } from 'src/engine/metadata-modules/front-component/dtos/update-front-component.input';
+
+export type UpdateFrontComponentFactoryInput = UpdateFrontComponentInput;
+
+const DEFAULT_FRONT_COMPONENT_GQL_FIELDS = `
+  id
+  name
+  applicationId
+  createdAt
+  updatedAt
+`;
+
+export const updateFrontComponentQueryFactory = ({
+  gqlFields = DEFAULT_FRONT_COMPONENT_GQL_FIELDS,
+  input,
+}: PerformMetadataQueryParams<UpdateFrontComponentFactoryInput>) => ({
+  query: gql`
+    mutation UpdateFrontComponent($input: UpdateFrontComponentInput!) {
+      updateFrontComponent(input: $input) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    input,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/front-component/utils/update-front-component.util.ts

@@ -0,0 +1,43 @@
+import {
+  type UpdateFrontComponentFactoryInput,
+  updateFrontComponentQueryFactory,
+} from 'test/integration/metadata/suites/front-component/utils/update-front-component-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type FrontComponentDTO } from 'src/engine/metadata-modules/front-component/dtos/front-component.dto';
+
+export const updateFrontComponent = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<UpdateFrontComponentFactoryInput>): CommonResponseBody<{
+  updateFrontComponent: FrontComponentDTO;
+}> => {
+  const graphqlOperation = updateFrontComponentQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Front component update should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Front component update has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};