fix: allow users with view-only permissions to execute workflows

The SettingsPermissionGuard for WORKFLOWS was applied at the class
level on WorkflowTriggerResolver, requiring the "manage workflow"
settings permission for ALL mutations — including runWorkflowVersion.
This prevented users with view-only access from executing active
workflows they could see.

Move the WORKFLOWS permission guard from class-level to method-level
on the three management mutations (activateWorkflowVersion,
deactivateWorkflowVersion, stopWorkflowRun). The runWorkflowVersion
mutation now only requires WorkspaceAuthGuard + UserAuthGuard,
allowing any authenticated workspace member to trigger workflows
they have view access to.

Permission model after this change:
- activateWorkflowVersion: requires WORKFLOWS settings permission
- deactivateWorkflowVersion: requires WORKFLOWS settings permission
- stopWorkflowRun: requires WORKFLOWS settings permission
- runWorkflowVersion: requires authentication only (view access)

Fixes #15231

Signed-off-by: V Govindarajan <vijay.govindarajan91@gmail.com>

Author: vijaygovindaraja

packages/twenty-server/src/engine/core-modules/workflow/resolvers/workflow-trigger.resolver.ts

@@ -26,11 +26,7 @@ import { WorkflowTriggerWorkspaceService } from 'src/modules/workflow/workflow-t
 import { WorkspaceMemberWorkspaceEntity } from 'src/modules/workspace-member/standard-objects/workspace-member.workspace-entity';
 
 @CoreResolver()
-@UseGuards(
-  WorkspaceAuthGuard,
-  UserAuthGuard,
-  SettingsPermissionGuard(PermissionFlagType.WORKFLOWS),
-)
+@UseGuards(WorkspaceAuthGuard, UserAuthGuard)
 @UsePipes(ResolverValidationPipe)
 @UseFilters(
   WorkflowTriggerGraphqlApiExceptionFilter,
@@ -44,6 +40,7 @@ export class WorkflowTriggerResolver {
   ) {}
 
   @Mutation(() => Boolean)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
   async activateWorkflowVersion(
     @AuthWorkspace() workspace: WorkspaceEntity,
     @Args('workflowVersionId', { type: () => UUIDScalarType })
@@ -56,6 +53,7 @@ export class WorkflowTriggerResolver {
   }
 
   @Mutation(() => Boolean)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
   async deactivateWorkflowVersion(
     @AuthWorkspace() workspace: WorkspaceEntity,
     @Args('workflowVersionId', { type: () => UUIDScalarType })
@@ -111,6 +109,7 @@ export class WorkflowTriggerResolver {
   }
 
   @Mutation(() => WorkflowRunDTO)
+  @UseGuards(SettingsPermissionGuard(PermissionFlagType.WORKFLOWS))
   async stopWorkflowRun(
     @AuthWorkspace() workspace: WorkspaceEntity,
     @Args('workflowRunId', { type: () => UUIDScalarType })