Make call recordings private and share them at creation

Declare callRecording PRIVATE in the standard application, have the
fathom, fireflies and call-recorder apps state who may read each
recording through shareWith when they create it, and add two 2.39
workspace commands: one flips the readability of the existing
callRecording object, the other backfills one EVERYONE FULL share row
per existing recording so enabling IS_RECORD_SHARING_ENABLED loses
nothing a workspace member could already do.

Author: martmull

packages/twenty-apps/public/call-recorder/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@twentyhq/call-recorder",
-  "version": "1.12.0",
+  "version": "1.12.1",
   "license": "MIT",
   "engines": {
     "node": "^24.5.0",
     "npm": "please-use-yarn",
     "yarn": ">=4.0.2",
-    "twenty": ">=2.37.0"
+    "twenty": ">=2.39.0"
   },
   "keywords": [
     "twenty-app"

packages/twenty-apps/public/call-recorder/src/__tests__/call-recorder-lifecycle.integration-test.ts

@@ -491,6 +491,7 @@ describe('call recorder app lifecycle (integration)', () => {
             calendarEventId,
             ...overrides,
           },
+          shareWith: [{ everyone: true, accessLevel: 'READ' }],
         },
         id: true,
       },

packages/twenty-apps/public/call-recorder/src/logic-functions/data/create-call-recording.util.ts

@@ -25,6 +25,7 @@ export const createCallRecording = async (
     createCallRecording: {
       __args: {
         data: { id, ...data },
+        shareWith: [{ everyone: true, accessLevel: 'READ' }],
       },
       id: true,
     },

packages/twenty-apps/public/call-recorder/src/logic-functions/flows/__tests__/reconcile-call-recorder.test.ts

@@ -124,7 +124,7 @@ class FakeCoreApiClient {
 
   async mutation(mutation: any): Promise<any> {
     if (mutation.createCallRecording !== undefined) {
-      const data = mutation.createCallRecording.__args.data;
+      const { data, shareWith } = mutation.createCallRecording.__args;
 
       if (this.callRecordings.some((candidate) => candidate.id === data.id)) {
         throw new Error(`Duplicate call recording id ${data.id}`);
@@ -135,7 +135,7 @@ class FakeCoreApiClient {
       this.callRecordings.push(createdCallRecording);
       this.mutations.push({
         name: 'createCallRecording',
-        args: data,
+        args: { data, shareWith },
       });
 
       return {
@@ -274,6 +274,12 @@ describe('reconcileCallRecorderForCalendarEventIds', () => {
         callRecordingId: buildCustomerSyncCallRecordingId(),
       }),
     ]);
+    expect(client.mutations).toContainEqual({
+      name: 'createCallRecording',
+      args: expect.objectContaining({
+        shareWith: [{ everyone: true, accessLevel: 'READ' }],
+      }),
+    });
     expect(client.callRecordings).toEqual([
       {
         id: buildCustomerSyncCallRecordingId(),

packages/twenty-apps/public/fathom/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this application are documented in this file.
 
+## 0.1.1
+
+- State who may read each synced Call Recording at creation: the connecting
+  workspace member for a personal Fathom connection, everyone otherwise.
+  Requires Twenty 2.39.0 or later.
+
 ## 0.1.0
 
 - Add per-user Fathom OAuth and signed webhook registration.

packages/twenty-apps/public/fathom/package.json

@@ -1,11 +1,12 @@
 {
   "name": "@twentyhq/fathom",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "license": "MIT",
   "engines": {
     "node": "^24.5.0",
     "npm": "please-use-yarn",
-    "yarn": ">=4.0.2"
+    "yarn": ">=4.0.2",
+    "twenty": ">=2.39.0"
   },
   "keywords": [],
   "packageManager": "yarn@4.13.0",
@@ -26,8 +27,8 @@
     "@types/node": "^24.7.2",
     "@typescript/native-preview": "^7.0.0-dev.20260116.1",
     "oxlint": "^0.16.0",
-    "twenty-client-sdk": "2.35.0",
-    "twenty-sdk": "2.35.0",
+    "twenty-client-sdk": "2.37.0",
+    "twenty-sdk": "2.37.0",
     "typescript": "^5.9.3",
     "vite-tsconfig-paths": "^4.2.1",
     "vitest": "^4.0.0"

packages/twenty-apps/public/fathom/src/logic-functions/fathom-backfill-batch.ts

@@ -51,11 +51,13 @@ export const fathomBackfillBatchHandler = async (payload: {
     // meetings already imported, which costs calls but cannot duplicate
     // records: the CallRecording id is derived from the recording.
     results.push(
-      await syncFathomMeetingToCallRecording({ coreApiClient, meeting }).catch(
-        (error: unknown) => {
-          throw new RetryableLogicFunctionError(toErrorMessage(error));
-        },
-      ),
+      await syncFathomMeetingToCallRecording({
+        coreApiClient,
+        meeting,
+        connection,
+      }).catch((error: unknown) => {
+        throw new RetryableLogicFunctionError(toErrorMessage(error));
+      }),
     );
   }
 

packages/twenty-apps/public/fathom/src/logic-functions/fathom-sync-call.ts

@@ -80,6 +80,7 @@ export const fathomSyncCallHandler = async (
         fathomClient,
         serializedMeeting: serializeFathomMeeting(meeting),
       }),
+      connection,
     });
 
     return { success: true, recordingId, ...syncResult };

packages/twenty-apps/public/fathom/src/logic-functions/fathom-webhook.ts

@@ -10,6 +10,7 @@ import { FATHOM_WEBHOOK_CONNECTION_QUERY_PARAMETER } from 'src/constants/fathom.
 import { FATHOM_WEBHOOK_UNIVERSAL_IDENTIFIER } from 'src/constants/universal-identifiers';
 import { type FathomWebhookRegistration } from 'src/logic-functions/types/fathom-webhook-registration.type';
 import { getFathomWebhookRegistrationKey } from 'src/logic-functions/utils/get-fathom-webhook-registration-key.util';
+import { listFathomConnections } from 'src/logic-functions/utils/list-fathom-connections.util';
 import { syncFathomMeetingToCallRecording } from 'src/logic-functions/utils/sync-fathom-meeting-to-call-recording.util';
 
 type FathomWebhookResult =
@@ -86,9 +87,18 @@ export const fathomWebhookHandler = async (
     return { success: false, error: 'Invalid Fathom meeting payload' };
   }
 
+  const connection = (await listFathomConnections()).find(
+    (candidate) => candidate.id === connectedAccountId,
+  );
+
+  if (!isDefined(connection)) {
+    return { success: false, error: 'Fathom connection must be reconnected' };
+  }
+
   const syncResult = await syncFathomMeetingToCallRecording({
     coreApiClient: new CoreApiClient({ runAs: 'application' }),
     meeting: meetingParseResult.value,
+    connection,
   });
 
   return { success: true, ...syncResult };

packages/twenty-apps/public/fathom/src/logic-functions/types/call-recording-share-with.type.ts

@@ -0,0 +1,3 @@
+export type CallRecordingShareWith =
+  | { workspaceMemberId: string; accessLevel: 'FULL' }
+  | { everyone: true; accessLevel: 'READ' };