Let a create state who may read the record with shareWith

createOne and createMany accept a shareWith argument next to data: a
list of workspace members, roles or everyone, each with an access
level. On a PRIVATE object the share rows are written in the same
transaction as the record. A person creating a record gets one OWNER
FULL row by default plus one MANUAL row per entry; an API key, an
application or a system caller must pass shareWith or the create is
refused with a message naming the argument. OPEN objects ignore the
argument. Rows are written whether or not the record sharing flag is
on, so the data is ready when the flag flips.

Author: martmull

packages/twenty-docs/developers/extend/apps/logic/logic-functions.mdx

@@ -803,8 +803,28 @@ const { createCompany } = await client.mutation({
     name: true,
   },
 });
+
+// Create a record of a private object and choose who can read it
+const { createContract } = await client.mutation({
+  createContract: {
+    __args: {
+      data: {
+        name: 'Acme Corp renewal',
+      },
+      shareWith: [
+        {
+          roleId: '7f0c1b6e-2d4a-4c8e-9b3f-5a6d7e8f9a0b',
+          accessLevel: 'READ_WRITE',
+        },
+      ],
+    },
+    id: true,
+  },
+});
 ```
 
+On an object whose readability is `PRIVATE`, `shareWith` lists who gets access to the created record: each entry targets exactly one of `workspaceMemberId`, `roleId` or `everyone: true` with an `accessLevel` of `READ`, `READ_WRITE` or `FULL`. A workspace member creating a record always receives a `FULL` owner grant, so the argument is optional for them; a logic function acting as its application, an API key or a system caller must pass it or the create is rejected. On other objects the argument is ignored.
+
 The client uses a selection-set syntax: pass `true` to include a field, use `__args` for arguments, and nest objects for relations. You get full autocompletion and type checking based on your workspace schema.
 
 <Note>

packages/twenty-server/src/engine/api/common/common-query-runners/common-create-many-query-runner/common-create-many-query-runner.service.ts

@@ -2,7 +2,7 @@ import { Injectable } from '@nestjs/common';
 
 import { msg } from '@lingui/core/macro';
 import { QUERY_MAX_RECORDS } from 'twenty-shared/constants';
-import { ObjectRecord } from 'twenty-shared/types';
+import { MetadataReadability, ObjectRecord } from 'twenty-shared/types';
 import { isDefined } from 'twenty-shared/utils';
 import {
   Brackets,
@@ -15,9 +15,11 @@ import {
 import { CommonBaseQueryRunnerService } from 'src/engine/api/common/common-query-runners/common-base-query-runner.service';
 import { type ConflictingFieldGroup } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/types/conflicting-field-group.type';
 import { PartialObjectRecordWithId } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/types/partial-object-record-with-id.type';
+import { buildRecordShareInputsForCreatedRecords } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/utils/build-record-share-inputs-for-created-records.util';
 import { buildWhereConditions } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/utils/build-where-conditions.util';
 import { categorizeRecords } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/utils/categorize-records.util';
 import { getConflictingFields } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/utils/get-conflicting-fields.util';
+import { validateShareWithArg } from 'src/engine/api/common/common-query-runners/common-create-many-query-runner/utils/validate-share-with-arg.util';
 import {
   CommonQueryRunnerException,
   CommonQueryRunnerExceptionCode,
@@ -33,6 +35,7 @@ import {
 } from 'src/engine/api/common/types/common-query-args.type';
 import { CommonSelectedFieldsResult } from 'src/engine/api/common/types/common-selected-fields-result.type';
 import { type NestedRelationsReadPathOptions } from 'src/engine/api/common/types/nested-relations-read-path-options.type';
+import { type ShareWithInput } from 'src/engine/api/common/types/share-with-input.type';
 import { buildColumnsToReturn } from 'src/engine/api/graphql/graphql-query-runner/utils/build-columns-to-return';
 import { buildColumnsToSelect } from 'src/engine/api/graphql/graphql-query-runner/utils/build-columns-to-select';
 import { assertIsValidUuid } from 'src/engine/api/graphql/workspace-query-runner/utils/assert-is-valid-uuid.util';
@@ -46,6 +49,7 @@ import { buildFieldMapsFromFlatObjectMetadata } from 'src/engine/metadata-module
 import { type FlatIndexMetadata } from 'src/engine/metadata-modules/flat-index-metadata/types/flat-index-metadata.type';
 import { type FlatObjectMetadata } from 'src/engine/metadata-modules/flat-object-metadata/types/flat-object-metadata.type';
 import { assertMutationNotOnRemoteObject } from 'src/engine/metadata-modules/object-metadata/utils/assert-mutation-not-on-remote-object.util';
+import { RecordShareService } from 'src/engine/record-share/services/record-share.service';
 import { WorkspaceRepository } from 'src/engine/twenty-orm/repository/workspace-repository';
 import { RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';
 import { containsNestedRelationCreate } from 'src/engine/twenty-orm/utils/contains-nested-relation-create.util';
@@ -60,23 +64,38 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
 > {
   protected readonly operationName = CommonQueryNames.CREATE_MANY;
 
-  constructor(private readonly recordPositionService: RecordPositionService) {
+  constructor(
+    private readonly recordPositionService: RecordPositionService,
+    private readonly recordShareService: RecordShareService,
+  ) {
     super();
   }
 
   async run(
     args: CommonExtendedInput<CreateManyQueryArgs>,
     queryRunnerContext: CommonExtendedQueryRunnerContext,
   ): Promise<ObjectRecord[]> {
+    const isPrivateObject =
+      queryRunnerContext.flatObjectMetadata.readability ===
+      MetadataReadability.PRIVATE;
+
+    if (isPrivateObject) {
+      validateShareWithArg({
+        authContext: queryRunnerContext.authContext,
+        shareWith: args.shareWith,
+      });
+    }
+
     if (
       !isDefined(queryRunnerContext.transactionScope) &&
-      containsNestedRelationCreate(
-        args.data,
-        getNestedRelationFieldNames({
-          flatObjectMetadata: queryRunnerContext.flatObjectMetadata,
-          flatFieldMetadataMaps: queryRunnerContext.flatFieldMetadataMaps,
-        }),
-      )
+      (isPrivateObject ||
+        containsNestedRelationCreate(
+          args.data,
+          getNestedRelationFieldNames({
+            flatObjectMetadata: queryRunnerContext.flatObjectMetadata,
+            flatFieldMetadataMaps: queryRunnerContext.flatFieldMetadataMaps,
+          }),
+        ))
     ) {
       return this.workspaceOrmManager.runInWorkspaceTransaction(
         (transactionScope) =>
@@ -135,7 +154,13 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
       flatObjectMetadata,
       flatObjectMetadataMaps,
       flatFieldMetadataMaps,
-      repository,
+      repository:
+        isPrivateObject && isDefined(queryRunnerContext.transactionScope)
+          ? queryRunnerContext.transactionScope.getRepository(
+              flatObjectMetadata.nameSingular,
+              { shouldBypassPermissionChecks: true },
+            )
+          : repository,
       selectedFieldsResult: args.selectedFieldsResult,
     });
 
@@ -268,14 +293,23 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
 
       const writeRepository = this.getWriteRepository(queryRunnerContext);
 
-      return writeRepository.runInsert({
+      const insertResult = await writeRepository.runInsert({
         records: await this.resolveNestedRelationsForCreate({
           records: args.data,
+          shareWith: args.shareWith,
           queryRunnerContext,
           writeRepository,
         }),
         columnsToReturn: selectedColumns,
       });
+
+      await this.insertRecordShares({
+        insertResult,
+        shareWith: args.shareWith,
+        queryRunnerContext,
+      });
+
+      return insertResult;
     }
 
     return this.performUpsertOperation({
@@ -359,6 +393,7 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
         flatFieldMetadataMaps,
         result,
         columnsToReturn,
+        shareWith: args.shareWith,
         queryRunnerContext,
       });
     }
@@ -367,6 +402,7 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
       recordsToInsert: recordsToInsertWithPosition,
       result,
       columnsToReturn,
+      shareWith: args.shareWith,
       queryRunnerContext,
     });
 
@@ -469,13 +505,15 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
     flatFieldMetadataMaps,
     result,
     columnsToReturn,
+    shareWith,
     queryRunnerContext,
   }: {
     partialRecordsToUpdate: PartialObjectRecordWithId[];
     flatObjectMetadata: FlatObjectMetadata;
     flatFieldMetadataMaps: FlatEntityMaps<OrmFlatFieldMetadata>;
     result: InsertResult;
     columnsToReturn: string[];
+    shareWith?: ShareWithInput[];
     queryRunnerContext: CommonExtendedQueryRunnerContext;
   }): Promise<void> {
     const updateInputs = partialRecordsToUpdate
@@ -494,6 +532,7 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
     const writeRepository = this.getWriteRepository(queryRunnerContext);
     const resolvedData = await this.resolveNestedRelationsForCreate({
       records: updateInputs.map((input) => input.data),
+      shareWith,
       queryRunnerContext,
       writeRepository,
     });
@@ -518,11 +557,13 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
     recordsToInsert,
     result,
     columnsToReturn,
+    shareWith,
     queryRunnerContext,
   }: {
     recordsToInsert: Partial<ObjectRecord>[];
     result: InsertResult;
     columnsToReturn: string[];
+    shareWith?: ShareWithInput[];
     queryRunnerContext: CommonExtendedQueryRunnerContext;
   }): Promise<void> {
     if (recordsToInsert.length === 0) {
@@ -534,23 +575,60 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
     const insertResult = await writeRepository.runInsert({
       records: await this.resolveNestedRelationsForCreate({
         records: recordsToInsert,
+        shareWith,
         queryRunnerContext,
         writeRepository,
       }),
       columnsToReturn,
     });
 
+    await this.insertRecordShares({
+      insertResult,
+      shareWith,
+      queryRunnerContext,
+    });
+
     result.identifiers.push(...insertResult.identifiers);
     result.generatedMaps.push(...insertResult.generatedMaps);
     result.raw.push(...insertResult.raw);
   }
 
+  private async insertRecordShares({
+    insertResult,
+    shareWith,
+    queryRunnerContext,
+  }: {
+    insertResult: InsertResult;
+    shareWith?: ShareWithInput[];
+    queryRunnerContext: CommonExtendedQueryRunnerContext;
+  }): Promise<void> {
+    const { authContext, flatObjectMetadata, transactionScope } =
+      queryRunnerContext;
+
+    if (flatObjectMetadata.readability !== MetadataReadability.PRIVATE) {
+      return;
+    }
+
+    await this.recordShareService.insertMany({
+      workspaceId: authContext.workspace.id,
+      recordShares: buildRecordShareInputsForCreatedRecords({
+        recordIds: insertResult.generatedMaps.map((record) => record.id),
+        objectMetadataId: flatObjectMetadata.id,
+        authContext,
+        shareWith,
+      }),
+      transactionScope,
+    });
+  }
+
   private resolveNestedRelationsForCreate({
     records,
+    shareWith,
     queryRunnerContext,
     writeRepository,
   }: {
     records: Partial<ObjectRecord>[];
+    shareWith?: ShareWithInput[];
     queryRunnerContext: CommonExtendedQueryRunnerContext;
     writeRepository: WorkspaceRepository;
   }): Promise<Partial<ObjectRecord>[]> {
@@ -591,6 +669,7 @@ export class CommonCreateManyQueryRunnerService extends CommonBaseQueryRunnerSer
         const { results } = await this.execute(
           {
             data: targetRecords,
+            shareWith,
             selectedFields: { id: true },
           },
           {