fix: add WorkspaceAuthGuard to generateTransientToken and authorizeApp mutations

https://sonarly.com/issue/19372?type=bug The `generateTransientToken` and `authorizeApp` mutations on the `/metadata` endpoint use `UserAuthGuard` (which only checks for a user) but also use the `@AuthWorkspace()` parameter decorator (which requires a workspace). When a user with a workspace-agnostic token calls these mutations, the guard passes but the decorator throws an InternalServerErrorException.
2026-03-29 14:09:07 +00:00
1 changed files with 2 additions and 2 deletions
@@ -534,7 +534,7 @@ export class AuthResolver {
  }

  @Mutation(() => TransientTokenDTO)
-  @UseGuards(UserAuthGuard, NoPermissionGuard)
+  @UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
  async generateTransientToken(
    @AuthUser() user: AuthContextUser,
    @AuthWorkspace() workspace: WorkspaceEntity,
@@ -780,7 +780,7 @@ export class AuthResolver {
  }

  @Mutation(() => AuthorizeAppDTO)
-  @UseGuards(UserAuthGuard, NoPermissionGuard)
+  @UseGuards(WorkspaceAuthGuard, NoPermissionGuard)
  async authorizeApp(
    @Args() authorizeAppInput: AuthorizeAppInput,
    @AuthUser() user: AuthContextUser,