[Permissions] Add userWorkspaceId to JWT token

[ijreilly]

This information will be used to fetch a user's role and check their permissions

[greptile-apps]

PR Summary

This PR adds userWorkspaceId to JWT tokens and request context to support role-based permission checking across the application.

• Added new USER_WORKSPACE_NOT_FOUND exception code and validation in JwtAuthStrategy to handle cases where user workspace associations are missing
• Added AuthUserWorkspaceId decorator in /decorators/auth/auth-user-workspace-id.decorator.ts to extract workspace IDs from requests, though it lacks error handling
• Extended AuthContext and JwtPayload types in /types/auth-context.type.ts to include optional userWorkspaceId field
• Modified AccessTokenService to include userWorkspaceId in token generation and validation flow
• Added UserWorkspace entity to TypeORM configurations in both AuthModule and TokenModule for database operations

_{10 file(s) reviewed, 3 comment(s)
Edit PR Review Bot Settings | Greptile}

[greptile-apps]

style: Consider also validating that the userWorkspace belongs to both the user and workspace being validated to prevent unauthorized access.

Suggested change

	const userWorkspace = await this.userWorkspaceRepository.findOne({
	where: {
	id: payload.userWorkspaceId,
	},
	});
	const userWorkspace = await this.userWorkspaceRepository.findOne({
	where: {
	id: payload.userWorkspaceId,
	userId: user.id,
	workspaceId: workspace.id,
	},
	});

[greptile-apps]

logic: No error handling if userWorkspace lookup fails. Consider throwing AuthException with USER_WORKSPACE_NOT_FOUND code since userWorkspaceId is required for permissions.

[greptile-apps]

logic: No error handling if userWorkspaceId is undefined. Could silently fail permission checks. Consider throwing AuthException with USER_WORKSPACE_NOT_FOUND code.

Suggested change

	(data: unknown, ctx: ExecutionContext) => {
	const request = getRequest(ctx);
	return request.userWorkspaceId;
	},
	(data: unknown, ctx: ExecutionContext) => {
	const request = getRequest(ctx);
	if (!request.userWorkspaceId) {
	throw new UnauthorizedException('User workspace not found');
	}
	return request.userWorkspaceId;
	},

[Weiko]

LGTM, thank you @ijreilly