snapshot of https://github.com/twentyhq/twenty.git (main, 2026-09-17; blobs > 131072B omitted)

packages/twenty-server/test/integration/metadata/suites/role/__snapshots__/failing-delete-one-role.integration-spec.ts.snap

@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Role deletion should fail when deleting a non-editable system role (Admin) 1`] = `
+[
+  {
+    "extensions": {
+      "code": "FORBIDDEN",
+      "subCode": "CANNOT_UNASSIGN_LAST_ADMIN",
+      "userFriendlyMessage": "You cannot remove the admin role from the last administrator. Please assign another administrator first.",
+    },
+    "message": "Cannot unassign admin role from last admin of the workspace",
+    "name": "ForbiddenError",
+  },
+]
+`;
+
+exports[`Role deletion should fail when deleting a non-existent role 1`] = `
+[
+  {
+    "extensions": {
+      "code": "NOT_FOUND",
+      "subCode": "ROLE_NOT_FOUND",
+      "userFriendlyMessage": "The role you are looking for could not be found. It may have been deleted or you may not have access to it.",
+    },
+    "message": "Role not found",
+    "name": "NotFoundError",
+  },
+]
+`;
+
+exports[`Role deletion should fail when deleting the workspace default role (Member) 1`] = `
+[
+  {
+    "extensions": {
+      "code": "INTERNAL_SERVER_ERROR",
+      "exceptionEventId": Any<String>,
+      "userFriendlyMessage": "The default role cannot be deleted as it is required for the workspace to function properly.",
+    },
+    "message": "Default role cannot be deleted",
+  },
+]
+`;

packages/twenty-server/test/integration/metadata/suites/role/__snapshots__/failing-role-creation.integration-spec.ts.snap

@@ -0,0 +1,195 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Role creation should fail when canReadAllObjectRecords is false but canDestroyAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "label": "Inconsistent Destroy Role",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while creating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role creation should fail when canReadAllObjectRecords is false but canSoftDeleteAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "label": "Inconsistent Soft Delete Role",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while creating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role creation should fail when canReadAllObjectRecords is false but canUpdateAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "label": "Inconsistent Update Role",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while creating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role creation should fail when canReadAllObjectRecords is false but multiple write permissions are true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "label": "Inconsistent Multiple Write Role",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while creating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role creation should fail when label already exists 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "ROLE_LABEL_ALREADY_EXISTS",
+              "message": "A role with this label already exists",
+              "userFriendlyMessage": "A role with this label already exists.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "label": "Existing Test Role",
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "create",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "A role with this label already exists.",
+  },
+  "message": "Multiple validation errors occurred while creating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role creation should fail when label is missing 1`] = `
+{
+  "extensions": {
+    "code": "BAD_USER_INPUT",
+    "http": {
+      "status": 400,
+    },
+    "userFriendlyMessage": "An error occurred.",
+  },
+  "message": "Field "label" of required type "String!" was not provided.",
+  "name": "GraphQLError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/role/__snapshots__/failing-role-update.integration-spec.ts.snap

@@ -0,0 +1,258 @@
+// Jest Snapshot v1, https://jestjs.io/docs/snapshot-testing
+
+exports[`Role update should fail should fail when updating a non-existent role 1`] = `
+{
+  "extensions": {
+    "code": "NOT_FOUND",
+    "subCode": "ROLE_NOT_FOUND",
+    "userFriendlyMessage": "The role you are looking for could not be found. It may have been deleted or you may not have access to it.",
+  },
+  "message": "Role not found",
+  "name": "NotFoundError",
+}
+`;
+
+exports[`Role update should fail updating role with existing write permissions should fail when updating only canReadAllObjectRecords to false while role has existing write permissions 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating a non-editable system role 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "ROLE_NOT_EDITABLE",
+              "message": "Role is not editable",
+              "userFriendlyMessage": "This role cannot be modified because it is a system role. Only custom roles can be edited.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "This role cannot be modified because it is a system role. Only custom roles can be edited.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating canReadAllObjectRecords to false while canDestroyAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating canReadAllObjectRecords to false while canSoftDeleteAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating canReadAllObjectRecords to false while canUpdateAllObjectRecords is true 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating label to one that already exists 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "ROLE_LABEL_ALREADY_EXISTS",
+              "message": "A role with this label already exists",
+              "userFriendlyMessage": "A role with this label already exists.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "A role with this label already exists.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;
+
+exports[`Role update should fail when updating to enable write permissions without read permission 1`] = `
+{
+  "extensions": {
+    "code": "METADATA_VALIDATION_FAILED",
+    "errors": {
+      "role": [
+        {
+          "errors": [
+            {
+              "code": "CANNOT_GIVE_WRITING_PERMISSION_WITHOUT_READING_PERMISSION",
+              "message": "Cannot give writing permission without reading permission",
+              "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+            },
+          ],
+          "flatEntityMinimalInformation": {
+            "universalIdentifier": Any<String>,
+          },
+          "metadataName": "role",
+          "status": "fail",
+          "type": "update",
+        },
+      ],
+    },
+    "message": "Validation failed for 1 role",
+    "summary": {
+      "role": 1,
+      "totalErrors": 1,
+    },
+    "userFriendlyMessage": "You cannot grant edit permissions without also granting read permissions. Please enable read access first.",
+  },
+  "message": "Multiple validation errors occurred while updating role",
+  "name": "GraphQLError",
+}
+`;

packages/twenty-server/test/integration/metadata/suites/role/failing-delete-one-role.integration-spec.ts

@@ -0,0 +1,91 @@
+import { faker } from '@faker-js/faker';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { findOneRoleByLabel } from 'test/integration/metadata/suites/role/utils/find-one-role-by-label.util';
+import { extractRecordIdsAndDatesAsExpectAny } from 'test/utils/extract-record-ids-and-dates-as-expect-any';
+import {
+  eachTestingContextFilter,
+  type EachTestingContext,
+} from 'twenty-shared/testing';
+
+type TestContext = {
+  input: (testSetup: TestSetup) => {
+    idToDelete: string;
+  };
+};
+
+type TestSetup = {
+  adminRoleId: string;
+  memberRoleId: string;
+};
+
+type GlobalTestContext = {
+  adminRoleId: string;
+  memberRoleId: string;
+};
+
+const globalTestContext: GlobalTestContext = {
+  adminRoleId: '',
+  memberRoleId: '',
+};
+
+type DeleteOneRoleTestingContext = EachTestingContext<TestContext>[];
+
+describe('Role deletion should fail', () => {
+  beforeAll(async () => {
+    const adminRole = await findOneRoleByLabel({ label: 'Admin' });
+    const memberRole = await findOneRoleByLabel({ label: 'Member' });
+
+    globalTestContext.adminRoleId = adminRole.id;
+    globalTestContext.memberRoleId = memberRole.id;
+  });
+
+  const failingRoleDeletionTestCases: DeleteOneRoleTestingContext = [
+    {
+      title: 'when deleting a non-editable system role (Admin)',
+      context: {
+        input: (testSetup) => ({
+          idToDelete: testSetup.adminRoleId,
+        }),
+      },
+    },
+    {
+      title: 'when deleting the workspace default role (Member)',
+      context: {
+        input: (testSetup) => ({
+          idToDelete: testSetup.memberRoleId,
+        }),
+      },
+    },
+    {
+      title: 'when deleting a non-existent role',
+      context: {
+        input: () => ({
+          idToDelete: faker.string.uuid(),
+        }),
+      },
+    },
+  ];
+
+  it.each(eachTestingContextFilter(failingRoleDeletionTestCases))(
+    '$title',
+    async ({ context }) => {
+      const testSetup: TestSetup = {
+        adminRoleId: globalTestContext.adminRoleId,
+        memberRoleId: globalTestContext.memberRoleId,
+      };
+
+      const { idToDelete } = context.input(testSetup);
+
+      const { errors } = await deleteOneRole({
+        expectToFail: true,
+        input: {
+          idToDelete,
+        },
+      });
+
+      expect(errors).toMatchSnapshot(
+        extractRecordIdsAndDatesAsExpectAny(errors),
+      );
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/role/failing-role-creation.integration-spec.ts

@@ -0,0 +1,158 @@
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import {
+  eachTestingContextFilter,
+  type EachTestingContext,
+} from 'twenty-shared/testing';
+import { isDefined } from 'twenty-shared/utils';
+
+import { type CreateRoleInput } from 'src/engine/metadata-modules/role/dtos/create-role.input';
+
+type TestContext = {
+  input: CreateRoleInput;
+};
+
+type GlobalTestContext = {
+  existingRoleLabel: string;
+};
+
+const globalTestContext: GlobalTestContext = {
+  existingRoleLabel: 'Existing Test Role',
+};
+
+type CreateOneRoleTestingContext = EachTestingContext<TestContext>[];
+
+describe('Role creation should fail', () => {
+  let existingRoleId: string | undefined;
+
+  beforeAll(async () => {
+    const { data } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: globalTestContext.existingRoleLabel,
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+      },
+    });
+
+    existingRoleId = data.createOneRole.id;
+  });
+
+  afterAll(async () => {
+    if (isDefined(existingRoleId)) {
+      await deleteOneRole({
+        expectToFail: false,
+        input: { idToDelete: existingRoleId },
+      });
+    }
+  });
+
+  const failingRoleCreationTestCases: CreateOneRoleTestingContext = [
+    {
+      title: 'when label is missing',
+      context: {
+        input: {
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: true,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: false,
+        } as CreateRoleInput,
+      },
+    },
+    {
+      title: 'when label already exists',
+      context: {
+        input: {
+          label: globalTestContext.existingRoleLabel,
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: true,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: false,
+        },
+      },
+    },
+    {
+      title:
+        'when canReadAllObjectRecords is false but canUpdateAllObjectRecords is true',
+      context: {
+        input: {
+          label: 'Inconsistent Update Role',
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: true,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: false,
+        },
+      },
+    },
+    {
+      title:
+        'when canReadAllObjectRecords is false but canSoftDeleteAllObjectRecords is true',
+      context: {
+        input: {
+          label: 'Inconsistent Soft Delete Role',
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: true,
+          canDestroyAllObjectRecords: false,
+        },
+      },
+    },
+    {
+      title:
+        'when canReadAllObjectRecords is false but canDestroyAllObjectRecords is true',
+      context: {
+        input: {
+          label: 'Inconsistent Destroy Role',
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: true,
+        },
+      },
+    },
+    {
+      title:
+        'when canReadAllObjectRecords is false but multiple write permissions are true',
+      context: {
+        input: {
+          label: 'Inconsistent Multiple Write Role',
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: true,
+          canSoftDeleteAllObjectRecords: true,
+          canDestroyAllObjectRecords: true,
+        },
+      },
+    },
+  ];
+
+  it.each(eachTestingContextFilter(failingRoleCreationTestCases))(
+    '$title',
+    async ({ context }) => {
+      const { errors } = await createOneRole({
+        expectToFail: true,
+        input: context.input,
+      });
+
+      expectOneNotInternalServerErrorSnapshot({
+        errors,
+      });
+    },
+  );
+});

packages/twenty-server/test/integration/metadata/suites/role/failing-role-update.integration-spec.ts

@@ -0,0 +1,266 @@
+import { faker } from '@faker-js/faker';
+import { expectOneNotInternalServerErrorSnapshot } from 'test/integration/graphql/utils/expect-one-not-internal-server-error-snapshot.util';
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { findOneRoleByLabel } from 'test/integration/metadata/suites/role/utils/find-one-role-by-label.util';
+import { updateOneRole } from 'test/integration/metadata/suites/role/utils/update-one-role.util';
+import {
+  eachTestingContextFilter,
+  type EachTestingContext,
+} from 'twenty-shared/testing';
+
+import { type UpdateRolePayload } from 'src/engine/metadata-modules/role/dtos/update-role.input';
+
+type TestContext = {
+  input: (testSetup: TestSetup) => {
+    idToUpdate: string;
+    updatePayload: UpdateRolePayload;
+  };
+};
+
+type TestSetup = {
+  testRoleId: string;
+  existingRoleLabelForDuplicate: string;
+  nonEditableRoleId: string;
+};
+
+type GlobalTestContext = {
+  existingRoleLabelForDuplicate: string;
+  nonEditableRoleId: string;
+};
+
+const globalTestContext: GlobalTestContext = {
+  existingRoleLabelForDuplicate: 'Existing Role For Duplicate Test',
+  nonEditableRoleId: '',
+};
+
+type UpdateOneRoleTestingContext = EachTestingContext<TestContext>[];
+
+describe('Role update should fail', () => {
+  let testRoleId: string;
+  let existingRoleIdForDuplicate: string;
+
+  beforeAll(async () => {
+    const adminRole = await findOneRoleByLabel({ label: 'Admin' });
+
+    globalTestContext.nonEditableRoleId = adminRole.id;
+
+    const { data: duplicateData } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: globalTestContext.existingRoleLabelForDuplicate,
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+      },
+    });
+
+    existingRoleIdForDuplicate = duplicateData.createOneRole.id;
+  });
+
+  beforeEach(async () => {
+    const { data } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Test Role To Update',
+        description: 'Original description',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    testRoleId = data.createOneRole.id;
+  });
+
+  afterEach(async () => {
+    await deleteOneRole({
+      expectToFail: false,
+      input: { idToDelete: testRoleId },
+    });
+  });
+
+  afterAll(async () => {
+    await deleteOneRole({
+      expectToFail: false,
+      input: { idToDelete: existingRoleIdForDuplicate },
+    });
+  });
+
+  describe('updating role with existing write permissions', () => {
+    let roleWithWritePermissionsId: string;
+
+    beforeEach(async () => {
+      const { data } = await createOneRole({
+        expectToFail: false,
+        input: {
+          label: 'Role With Write Permissions',
+          description: 'Role with write permissions for update tests',
+          canUpdateAllSettings: false,
+          canAccessAllTools: false,
+          canReadAllObjectRecords: true,
+          canUpdateAllObjectRecords: true,
+          canSoftDeleteAllObjectRecords: true,
+          canDestroyAllObjectRecords: true,
+        },
+      });
+
+      roleWithWritePermissionsId = data.createOneRole.id;
+    });
+
+    afterEach(async () => {
+      await deleteOneRole({
+        expectToFail: false,
+        input: { idToDelete: roleWithWritePermissionsId },
+      });
+    });
+
+    it('should fail when updating only canReadAllObjectRecords to false while role has existing write permissions', async () => {
+      const { errors } = await updateOneRole({
+        expectToFail: true,
+        input: {
+          idToUpdate: roleWithWritePermissionsId,
+          updatePayload: {
+            canReadAllObjectRecords: false,
+          },
+        },
+      });
+
+      expectOneNotInternalServerErrorSnapshot({
+        errors,
+      });
+    });
+  });
+
+  const failingRoleUpdateTestCases: UpdateOneRoleTestingContext = [
+    {
+      title: 'when updating label to one that already exists',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.testRoleId,
+          updatePayload: {
+            label: testSetup.existingRoleLabelForDuplicate,
+          },
+        }),
+      },
+    },
+    {
+      title: 'when updating a non-editable system role',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.nonEditableRoleId,
+          updatePayload: {
+            label: 'new role label',
+          },
+        }),
+      },
+    },
+    {
+      title:
+        'when updating canReadAllObjectRecords to false while canUpdateAllObjectRecords is true',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.testRoleId,
+          updatePayload: {
+            canReadAllObjectRecords: false,
+            canUpdateAllObjectRecords: true,
+          },
+        }),
+      },
+    },
+    {
+      title:
+        'when updating canReadAllObjectRecords to false while canSoftDeleteAllObjectRecords is true',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.testRoleId,
+          updatePayload: {
+            canReadAllObjectRecords: false,
+            canSoftDeleteAllObjectRecords: true,
+          },
+        }),
+      },
+    },
+    {
+      title:
+        'when updating canReadAllObjectRecords to false while canDestroyAllObjectRecords is true',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.testRoleId,
+          updatePayload: {
+            canReadAllObjectRecords: false,
+            canDestroyAllObjectRecords: true,
+          },
+        }),
+      },
+    },
+    {
+      title:
+        'when updating to enable write permissions without read permission',
+      context: {
+        input: (testSetup) => ({
+          idToUpdate: testSetup.testRoleId,
+          updatePayload: {
+            canReadAllObjectRecords: false,
+            canUpdateAllObjectRecords: true,
+            canSoftDeleteAllObjectRecords: true,
+          },
+        }),
+      },
+    },
+  ];
+
+  it.each(eachTestingContextFilter(failingRoleUpdateTestCases))(
+    '$title',
+    async ({ context }) => {
+      const testSetup: TestSetup = {
+        testRoleId,
+        existingRoleLabelForDuplicate:
+          globalTestContext.existingRoleLabelForDuplicate,
+        nonEditableRoleId: globalTestContext.nonEditableRoleId,
+      };
+
+      const { idToUpdate, updatePayload } = context.input(testSetup);
+
+      const { errors } = await updateOneRole({
+        expectToFail: true,
+        input: {
+          idToUpdate,
+          updatePayload,
+        },
+      });
+
+      expectOneNotInternalServerErrorSnapshot({
+        errors,
+      });
+    },
+  );
+
+  it('should fail when updating a non-existent role', async () => {
+    const nonExistentRoleId = faker.string.uuid();
+
+    const { errors } = await updateOneRole({
+      expectToFail: true,
+      input: {
+        idToUpdate: nonExistentRoleId,
+        updatePayload: {
+          label: 'Updated Label',
+        },
+      },
+    });
+
+    expectOneNotInternalServerErrorSnapshot({
+      errors,
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/role/successful-delete-one-role.integration-spec.ts

@@ -0,0 +1,75 @@
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { findOneRoleByLabel } from 'test/integration/metadata/suites/role/utils/find-one-role-by-label.util';
+
+describe('Role deletion should succeed', () => {
+  it('should successfully delete a custom editable role', async () => {
+    const { data: createData, errors: createErrors } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Deletable Custom Role',
+        description: 'A custom role that can be deleted',
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+      },
+    });
+
+    expect(createErrors).toBeUndefined();
+    expect(createData.createOneRole.id).toBeDefined();
+
+    const customRoleId = createData.createOneRole.id;
+
+    const { data, errors } = await deleteOneRole({
+      expectToFail: false,
+      input: {
+        idToDelete: customRoleId,
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.deleteOneRole).toBe(customRoleId);
+  });
+
+  it('should delete a custom role and verify it can no longer be found', async () => {
+    const testLabel = 'Role To Be Deleted And Verified';
+
+    const { data: createData } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: testLabel,
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+      },
+    });
+
+    const roleId = createData.createOneRole.id;
+
+    const roleBefore = await findOneRoleByLabel({ label: testLabel });
+
+    expect(roleBefore).toBeDefined();
+    expect(roleBefore.id).toBe(roleId);
+
+    const { data, errors } = await deleteOneRole({
+      expectToFail: false,
+      input: {
+        idToDelete: roleId,
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data.deleteOneRole).toBe(roleId);
+
+    await expect(findOneRoleByLabel({ label: testLabel })).rejects.toThrow(
+      `Role with label "${testLabel}" not found`,
+    );
+  });
+});

packages/twenty-server/test/integration/metadata/suites/role/successful-role-creation.integration-spec.ts

@@ -0,0 +1,112 @@
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+
+describe('Role creation should succeed', () => {
+  let createdRoleId: string;
+
+  afterEach(async () => {
+    await deleteOneRole({
+      expectToFail: false,
+      input: { idToDelete: createdRoleId },
+    });
+  });
+
+  it('should create a basic custom role with minimal input', async () => {
+    const { data, errors } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Test Custom Role',
+        description: 'A custom role for integration testing',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: true,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    createdRoleId = data?.createOneRole?.id;
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.createOneRole).toMatchObject({
+      id: expect.any(String),
+      label: 'Test Custom Role',
+      description: 'A custom role for integration testing',
+      icon: 'IconSettings',
+      isEditable: true,
+      canUpdateAllSettings: false,
+      canAccessAllTools: true,
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: false,
+      canSoftDeleteAllObjectRecords: false,
+      canDestroyAllObjectRecords: false,
+      canBeAssignedToUsers: true,
+      canBeAssignedToAgents: false,
+      canBeAssignedToApiKeys: false,
+    });
+  });
+
+  it('should create role with read and write permissions', async () => {
+    const { data, errors } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Role With All Permissions',
+        description: 'Role with read and write permissions',
+        canUpdateAllSettings: true,
+        canAccessAllTools: true,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: true,
+        canSoftDeleteAllObjectRecords: true,
+        canDestroyAllObjectRecords: true,
+      },
+    });
+
+    createdRoleId = data?.createOneRole?.id;
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.createOneRole).toMatchObject({
+      id: expect.any(String),
+      label: 'Role With All Permissions',
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: true,
+      canSoftDeleteAllObjectRecords: true,
+      canDestroyAllObjectRecords: true,
+    });
+  });
+
+  it('should create role with read=false and all write permissions=false', async () => {
+    const { data, errors } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Read-Only False Role',
+        description: 'Role with no read or write permissions',
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: false,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+      },
+    });
+
+    createdRoleId = data?.createOneRole?.id;
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.createOneRole).toMatchObject({
+      id: expect.any(String),
+      label: 'Read-Only False Role',
+      canReadAllObjectRecords: false,
+      canUpdateAllObjectRecords: false,
+      canSoftDeleteAllObjectRecords: false,
+      canDestroyAllObjectRecords: false,
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/role/successful-role-update.integration-spec.ts

@@ -0,0 +1,258 @@
+import { createOneRole } from 'test/integration/metadata/suites/role/utils/create-one-role.util';
+import { deleteOneRole } from 'test/integration/metadata/suites/role/utils/delete-one-role.util';
+import { updateOneRole } from 'test/integration/metadata/suites/role/utils/update-one-role.util';
+
+describe('Role update should succeed', () => {
+  let testRoleId: string;
+
+  beforeEach(async () => {
+    const { data } = await createOneRole({
+      expectToFail: false,
+      input: {
+        label: 'Original Role Label',
+        description: 'Original description',
+        icon: 'IconSettings',
+        canUpdateAllSettings: false,
+        canAccessAllTools: false,
+        canReadAllObjectRecords: true,
+        canUpdateAllObjectRecords: false,
+        canSoftDeleteAllObjectRecords: false,
+        canDestroyAllObjectRecords: false,
+        canBeAssignedToUsers: true,
+        canBeAssignedToAgents: false,
+        canBeAssignedToApiKeys: false,
+      },
+    });
+
+    testRoleId = data.createOneRole.id;
+  });
+
+  afterEach(async () => {
+    await deleteOneRole({
+      expectToFail: false,
+      input: { idToDelete: testRoleId },
+    });
+  });
+
+  it('should update role label', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          label: 'Updated Role Label',
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      label: 'Updated Role Label',
+      description: 'Original description',
+      icon: 'IconSettings',
+    });
+  });
+
+  it('should update role description', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          description: 'Updated description for the role',
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      label: 'Original Role Label',
+      description: 'Updated description for the role',
+    });
+  });
+
+  it('should update role icon', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          icon: 'IconUser',
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      icon: 'IconUser',
+    });
+  });
+
+  it('should update role permissions', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canUpdateAllSettings: true,
+          canAccessAllTools: true,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      canUpdateAllSettings: true,
+      canAccessAllTools: true,
+      canReadAllObjectRecords: true,
+    });
+  });
+
+  it('should update role object record permissions', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canUpdateAllObjectRecords: true,
+          canSoftDeleteAllObjectRecords: true,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: true,
+      canSoftDeleteAllObjectRecords: true,
+      canDestroyAllObjectRecords: false,
+    });
+  });
+
+  it('should update role assignment permissions', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canBeAssignedToAgents: true,
+          canBeAssignedToApiKeys: true,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      canBeAssignedToUsers: true,
+      canBeAssignedToAgents: true,
+      canBeAssignedToApiKeys: true,
+    });
+  });
+
+  it('should update multiple role properties at once', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          label: 'Comprehensive Update',
+          description: 'Updated multiple fields',
+          icon: 'IconBriefcase',
+          canUpdateAllSettings: true,
+          canAccessAllTools: true,
+          canUpdateAllObjectRecords: true,
+          canBeAssignedToAgents: true,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      label: 'Comprehensive Update',
+      description: 'Updated multiple fields',
+      icon: 'IconBriefcase',
+      canUpdateAllSettings: true,
+      canAccessAllTools: true,
+      canReadAllObjectRecords: true,
+      canUpdateAllObjectRecords: true,
+      canBeAssignedToUsers: true,
+      canBeAssignedToAgents: true,
+    });
+  });
+
+  it('should update role to read=false when explicitly setting all write permissions to false', async () => {
+    await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canUpdateAllObjectRecords: true,
+          canSoftDeleteAllObjectRecords: true,
+          canDestroyAllObjectRecords: true,
+        },
+      },
+    });
+
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: false,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      canReadAllObjectRecords: false,
+      canUpdateAllObjectRecords: false,
+      canSoftDeleteAllObjectRecords: false,
+      canDestroyAllObjectRecords: false,
+    });
+  });
+
+  it('should update role from read=true to read=false with all write=false', async () => {
+    const { data, errors } = await updateOneRole({
+      expectToFail: false,
+      input: {
+        idToUpdate: testRoleId,
+        updatePayload: {
+          canReadAllObjectRecords: false,
+          canUpdateAllObjectRecords: false,
+          canSoftDeleteAllObjectRecords: false,
+          canDestroyAllObjectRecords: false,
+        },
+      },
+    });
+
+    expect(errors).toBeUndefined();
+    expect(data).toBeDefined();
+    expect(data.updateOneRole).toMatchObject({
+      id: testRoleId,
+      canReadAllObjectRecords: false,
+      canUpdateAllObjectRecords: false,
+      canSoftDeleteAllObjectRecords: false,
+      canDestroyAllObjectRecords: false,
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/role/successful-update-workspace-member-role.integration-spec.ts

@@ -0,0 +1,109 @@
+import { findOneRoleByLabel } from 'test/integration/metadata/suites/role/utils/find-one-role-by-label.util';
+import { updateWorkspaceMemberRole } from 'test/integration/metadata/suites/role/utils/update-workspace-member-role.util';
+import { jestExpectToBeDefined } from 'test/utils/jest-expect-to-be-defined.util.test';
+
+import { WORKSPACE_MEMBER_DATA_SEED_IDS } from 'src/engine/workspace-manager/dev-seeder/data/constants/workspace-member-data-seeds.constant';
+
+describe('Workspace member role update should succeed', () => {
+  let adminRoleId: string;
+  let guestRoleId: string;
+  let memberRoleId: string;
+  let shouldRestorePhilRole: boolean = false;
+
+  beforeAll(async () => {
+    const adminRole = await findOneRoleByLabel({ label: 'Admin' });
+    const guestRole = await findOneRoleByLabel({ label: 'Guest' });
+    const memberRole = await findOneRoleByLabel({ label: 'Member' });
+
+    adminRoleId = adminRole.id;
+    guestRoleId = guestRole.id;
+    memberRoleId = memberRole.id;
+  });
+
+  afterEach(async () => {
+    if (shouldRestorePhilRole) {
+      await updateWorkspaceMemberRole({
+        input: {
+          workspaceMemberId: WORKSPACE_MEMBER_DATA_SEED_IDS.PHIL,
+          roleId: guestRoleId,
+        },
+      });
+    }
+
+    shouldRestorePhilRole = false;
+  });
+
+  it('should update Phil from Guest to Admin role', async () => {
+    const { data: updateAdminData } = await updateWorkspaceMemberRole({
+      expectToFail: false,
+      input: {
+        workspaceMemberId: WORKSPACE_MEMBER_DATA_SEED_IDS.PHIL,
+        roleId: adminRoleId,
+      },
+      gqlFields: `
+          id
+          name {
+            firstName
+            lastName
+          }
+          userEmail
+          roles {
+            id
+            label
+            icon
+          }
+        `,
+    });
+
+    shouldRestorePhilRole = true;
+
+    expect(updateAdminData.updateWorkspaceMemberRole).toMatchObject({
+      id: WORKSPACE_MEMBER_DATA_SEED_IDS.PHIL,
+      name: {
+        firstName: 'Phil',
+        lastName: 'Schiler',
+      },
+    });
+    jestExpectToBeDefined(updateAdminData.updateWorkspaceMemberRole.roles);
+    expect(updateAdminData.updateWorkspaceMemberRole.roles).toHaveLength(1);
+    expect(updateAdminData.updateWorkspaceMemberRole.roles[0]).toMatchObject({
+      id: adminRoleId,
+      label: 'Admin',
+    });
+
+    const { data } = await updateWorkspaceMemberRole({
+      expectToFail: false,
+      input: {
+        workspaceMemberId: WORKSPACE_MEMBER_DATA_SEED_IDS.PHIL,
+        roleId: memberRoleId,
+      },
+      gqlFields: `
+          id
+          name {
+            firstName
+            lastName
+          }
+          userEmail
+          roles {
+            id
+            label
+            icon
+          }
+        `,
+    });
+
+    expect(data.updateWorkspaceMemberRole).toMatchObject({
+      id: WORKSPACE_MEMBER_DATA_SEED_IDS.PHIL,
+      name: {
+        firstName: 'Phil',
+        lastName: 'Schiler',
+      },
+    });
+    jestExpectToBeDefined(data.updateWorkspaceMemberRole.roles);
+    expect(data.updateWorkspaceMemberRole.roles).toHaveLength(1);
+    expect(data.updateWorkspaceMemberRole.roles[0]).toMatchObject({
+      id: memberRoleId,
+      label: 'Member',
+    });
+  });
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/create-one-role-query-factory.util.ts

@@ -0,0 +1,39 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+import { type CreateRoleInput } from 'src/engine/metadata-modules/role/dtos/create-role.input';
+
+export type CreateOneRoleFactoryInput = CreateRoleInput;
+
+const DEFAULT_ROLE_GQL_FIELDS = `
+  id
+  label
+  description
+  icon
+  isEditable
+  canUpdateAllSettings
+  canAccessAllTools
+  canReadAllObjectRecords
+  canUpdateAllObjectRecords
+  canSoftDeleteAllObjectRecords
+  canDestroyAllObjectRecords
+  canBeAssignedToUsers
+  canBeAssignedToAgents
+  canBeAssignedToApiKeys
+`;
+
+export const createOneRoleQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_ROLE_GQL_FIELDS,
+}: PerformMetadataQueryParams<CreateOneRoleFactoryInput>) => ({
+  query: gql`
+        mutation CreateOneRole($createRoleInput: CreateRoleInput!) {
+          createOneRole(createRoleInput: $createRoleInput) {
+            ${gqlFields}
+          }
+        }
+      `,
+  variables: {
+    createRoleInput: input,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/create-one-role.util.ts

@@ -0,0 +1,43 @@
+import {
+  type CreateOneRoleFactoryInput,
+  createOneRoleQueryFactory,
+} from 'test/integration/metadata/suites/role/utils/create-one-role-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type RoleDTO } from 'src/engine/metadata-modules/role/dtos/role.dto';
+
+export const createOneRole = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<CreateOneRoleFactoryInput>): CommonResponseBody<{
+  createOneRole: RoleDTO;
+}> => {
+  const graphqlOperation = createOneRoleQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Role creation should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Role creation has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/role/utils/delete-one-role-query-factory.util.ts

@@ -0,0 +1,19 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+export type DeleteOneRoleFactoryInput = {
+  idToDelete: string;
+};
+
+export const deleteOneRoleQueryFactory = ({
+  input,
+}: PerformMetadataQueryParams<DeleteOneRoleFactoryInput>) => ({
+  query: gql`
+    mutation DeleteOneRole($idToDelete: UUID!) {
+      deleteOneRole(roleId: $idToDelete)
+    }
+  `,
+  variables: {
+    idToDelete: input.idToDelete,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/delete-one-role.util.ts

@@ -0,0 +1,41 @@
+import {
+  type DeleteOneRoleFactoryInput,
+  deleteOneRoleQueryFactory,
+} from 'test/integration/metadata/suites/role/utils/delete-one-role-query-factory.util';
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+export const deleteOneRole = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: PerformMetadataQueryParams<DeleteOneRoleFactoryInput>): CommonResponseBody<{
+  deleteOneRole: string;
+}> => {
+  const graphqlOperation = deleteOneRoleQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Role deletion should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Role deletion has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/role/utils/find-one-role-by-label.util.ts

@@ -0,0 +1,33 @@
+import { findRoles } from 'test/integration/metadata/suites/role/utils/find-roles.util';
+
+import { type RoleDTO } from 'src/engine/metadata-modules/role/dtos/role.dto';
+
+export const findOneRoleByLabel = async ({
+  label,
+  gqlFields,
+  token,
+}: {
+  label: string;
+  gqlFields?: string;
+  token?: string;
+}): Promise<RoleDTO> => {
+  const { data, errors } = await findRoles({
+    gqlFields,
+    expectToFail: false,
+    token,
+  });
+
+  if (errors || !data?.getRoles) {
+    throw new Error(
+      `Failed to get roles: ${JSON.stringify(errors || 'No data returned')}`,
+    );
+  }
+
+  const role = data.getRoles.find((r) => r.label === label);
+
+  if (!role) {
+    throw new Error(`Role with label "${label}" not found`);
+  }
+
+  return role;
+};

packages/twenty-server/test/integration/metadata/suites/role/utils/find-roles-query-factory.util.ts

@@ -0,0 +1,34 @@
+import gql from 'graphql-tag';
+
+const DEFAULT_ROLE_GQL_FIELDS = `
+  id
+  label
+  description
+  icon
+  universalIdentifier
+  isEditable
+  canUpdateAllSettings
+  canAccessAllTools
+  canReadAllObjectRecords
+  canUpdateAllObjectRecords
+  canSoftDeleteAllObjectRecords
+  canDestroyAllObjectRecords
+  canBeAssignedToUsers
+  canBeAssignedToAgents
+  canBeAssignedToApiKeys
+`;
+
+export const findRolesQueryFactory = ({
+  gqlFields = DEFAULT_ROLE_GQL_FIELDS,
+}: {
+  gqlFields?: string;
+} = {}) => ({
+  query: gql`
+    query GetRoles {
+      getRoles {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {},
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/find-roles.util.ts

@@ -0,0 +1,41 @@
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import { findRolesQueryFactory } from 'test/integration/metadata/suites/role/utils/find-roles-query-factory.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type RoleDTO } from 'src/engine/metadata-modules/role/dtos/role.dto';
+
+export const findRoles = async ({
+  gqlFields,
+  expectToFail,
+  token,
+}: {
+  gqlFields?: string;
+  expectToFail?: boolean;
+  token?: string;
+} = {}): CommonResponseBody<{
+  getRoles: RoleDTO[];
+}> => {
+  const graphqlOperation = findRolesQueryFactory({
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Role search should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Role search has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/role/utils/update-one-role-query-factory.util.ts

@@ -0,0 +1,43 @@
+import gql from 'graphql-tag';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+
+import { type UpdateRolePayload } from 'src/engine/metadata-modules/role/dtos/update-role.input';
+
+export type UpdateOneRoleFactoryInput = {
+  idToUpdate: string;
+  updatePayload: UpdateRolePayload;
+};
+
+const DEFAULT_ROLE_GQL_FIELDS = `
+  id
+  label
+  description
+  icon
+  isEditable
+  canUpdateAllSettings
+  canAccessAllTools
+  canReadAllObjectRecords
+  canUpdateAllObjectRecords
+  canSoftDeleteAllObjectRecords
+  canDestroyAllObjectRecords
+  canBeAssignedToUsers
+  canBeAssignedToAgents
+  canBeAssignedToApiKeys
+`;
+
+export const updateOneRoleQueryFactory = ({
+  gqlFields = DEFAULT_ROLE_GQL_FIELDS,
+  input,
+}: PerformMetadataQueryParams<UpdateOneRoleFactoryInput>) => ({
+  query: gql`
+        mutation UpdateOneRole($idToUpdate: UUID!, $updatePayload: UpdateRolePayload!) {
+            updateOneRole(updateRoleInput: {id: $idToUpdate, update: $updatePayload}) {
+            ${gqlFields}
+        }
+      }
+      `,
+  variables: {
+    idToUpdate: input.idToUpdate,
+    updatePayload: input.updatePayload,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/update-one-role.util.ts

@@ -0,0 +1,42 @@
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import {
+  type UpdateOneRoleFactoryInput,
+  updateOneRoleQueryFactory,
+} from 'test/integration/metadata/suites/role/utils/update-one-role-query-factory.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { type PerformMetadataQueryParams } from 'test/integration/metadata/types/perform-metadata-query.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type RoleDTO } from 'src/engine/metadata-modules/role/dtos/role.dto';
+
+export const updateOneRole = async ({
+  input,
+  gqlFields,
+  expectToFail,
+}: PerformMetadataQueryParams<UpdateOneRoleFactoryInput>): CommonResponseBody<{
+  updateOneRole: RoleDTO;
+}> => {
+  const graphqlOperation = updateOneRoleQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage: 'Role update should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Role update has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};

packages/twenty-server/test/integration/metadata/suites/role/utils/update-workspace-member-role-query-factory.util.ts

@@ -0,0 +1,43 @@
+import gql from 'graphql-tag';
+
+export type UpdateWorkspaceMemberRoleInput = {
+  workspaceMemberId: string;
+  roleId: string;
+};
+
+const DEFAULT_WORKSPACE_MEMBER_GQL_FIELDS = `
+  id
+  name {
+    firstName
+    lastName
+  }
+  userEmail
+  roles {
+    id
+    label
+    icon
+  }
+`;
+
+export const updateWorkspaceMemberRoleQueryFactory = ({
+  input,
+  gqlFields = DEFAULT_WORKSPACE_MEMBER_GQL_FIELDS,
+}: {
+  input: UpdateWorkspaceMemberRoleInput;
+  gqlFields?: string;
+}) => ({
+  query: gql`
+    mutation UpdateWorkspaceMemberRole($workspaceMemberId: UUID!, $roleId: UUID!) {
+      updateWorkspaceMemberRole(
+        workspaceMemberId: $workspaceMemberId
+        roleId: $roleId
+      ) {
+        ${gqlFields}
+      }
+    }
+  `,
+  variables: {
+    workspaceMemberId: input.workspaceMemberId,
+    roleId: input.roleId,
+  },
+});

packages/twenty-server/test/integration/metadata/suites/role/utils/update-workspace-member-role.util.ts

@@ -0,0 +1,48 @@
+import { makeMetadataAPIRequest } from 'test/integration/metadata/suites/utils/make-metadata-api-request.util';
+import {
+  type UpdateWorkspaceMemberRoleInput,
+  updateWorkspaceMemberRoleQueryFactory,
+} from 'test/integration/metadata/suites/role/utils/update-workspace-member-role-query-factory.util';
+import { type CommonResponseBody } from 'test/integration/metadata/types/common-response-body.type';
+import { warnIfErrorButNotExpectedToFail } from 'test/integration/metadata/utils/warn-if-error-but-not-expected-to-fail.util';
+import { warnIfNoErrorButExpectedToFail } from 'test/integration/metadata/utils/warn-if-no-error-but-expected-to-fail.util';
+
+import { type WorkspaceMemberDTO } from 'src/engine/core-modules/user/dtos/workspace-member.dto';
+
+export const updateWorkspaceMemberRole = async ({
+  input,
+  gqlFields,
+  expectToFail = false,
+  token,
+}: {
+  input: UpdateWorkspaceMemberRoleInput;
+  gqlFields?: string;
+  expectToFail?: boolean;
+  token?: string;
+}): CommonResponseBody<{
+  updateWorkspaceMemberRole: WorkspaceMemberDTO;
+}> => {
+  const graphqlOperation = updateWorkspaceMemberRoleQueryFactory({
+    input,
+    gqlFields,
+  });
+
+  const response = await makeMetadataAPIRequest(graphqlOperation, token);
+
+  if (expectToFail === true) {
+    warnIfNoErrorButExpectedToFail({
+      response,
+      errorMessage:
+        'Workspace member role update should have failed but did not',
+    });
+  }
+
+  if (expectToFail === false) {
+    warnIfErrorButNotExpectedToFail({
+      response,
+      errorMessage: 'Workspace member role update has failed but should not',
+    });
+  }
+
+  return { data: response.body.data, errors: response.body.errors };
+};