Apply PR #7 security changes directly to main: app/projects/api.py

app/projects/api.py

@@ -66,8 +66,8 @@ async def update_notification_preference(request: Request, payload: dict[str, An
 
 @router.post("/workspace/invitations", response_model=InvitationResponse)
 async def invite_member(request: Request, payload: InvitationCreate) -> InvitationResponse:
-    workspace_id, _, _, _ = _identity(request)
-    return await request.app.state.container.collaboration.invite_member(workspace_id, payload.email, payload.role)
+    workspace_id, actor_user_id, _, _ = _identity(request)
+    return await request.app.state.container.collaboration.invite_member(workspace_id, actor_user_id, payload.email, payload.role)
 
 @router.patch("/workspace/teams/{team_id}", response_model=TeamResponse)
 async def update_team(request: Request, team_id: str, payload: TeamBase) -> TeamResponse:
@@ -82,7 +82,8 @@ async def archive_team(request: Request, team_id: str) -> Response:
 
 @router.get("/workspace/workflows/{workflow_id}/requests", response_model=list[ApprovalRequest])
 async def list_approval_requests(request: Request, workflow_id: str) -> list[ApprovalRequest]:
-    return await request.app.state.container.approval.list_requests(workflow_id)
+    workspace_id, _, _, _ = _identity(request)
+    return await request.app.state.container.approval.list_requests(workspace_id, workflow_id)
 
 
 @router.post("/workspace/requests/{request_id}/approve", response_model=ApprovalRequest)
@@ -90,16 +91,16 @@ async def approve_request(
     request: Request,
     request_id: str
 ) -> ApprovalRequest:
-    _, user_id, _, _ = _identity(request)
-    return await request.app.state.container.approval.approve_request(request_id, user_id)
+    workspace_id, user_id, _, _ = _identity(request)
+    return await request.app.state.container.approval.approve_request(workspace_id, request_id, user_id)
 
 @router.post("/workspace/requests/{request_id}/reject", response_model=ApprovalRequest)
 async def reject_request(
     request: Request,
     request_id: str
 ) -> ApprovalRequest:
-    _, user_id, _, _ = _identity(request)
-    return await request.app.state.container.approval.reject_request(request_id, user_id)
+    workspace_id, user_id, _, _ = _identity(request)
+    return await request.app.state.container.approval.reject_request(workspace_id, request_id, user_id)
 
 @router.post("/workspace/requests/{request_id}/comments", response_model=ReviewComment)
 async def add_review_comment(
@@ -327,7 +328,8 @@ async def list_project_collaborators(
     request: Request,
     project_id: UUID
 ) -> list[MemberResponse]:
-    return await request.app.state.container.collaboration.list_project_collaborators(str(project_id))
+    workspace_id, _, _, _ = _identity(request)
+    return await request.app.state.container.collaboration.list_project_collaborators(workspace_id, str(project_id))
 
 @router.post("/{project_id}/collaborators", response_model=MemberResponse)
 async def add_project_collaborator(
@@ -347,7 +349,8 @@ async def remove_project_collaborator(
     project_id: UUID,
     user_id: str
 ) -> Response:
-    await request.app.state.container.collaboration.remove_project_collaborator(str(project_id), user_id)
+    workspace_id, _, _, _ = _identity(request)
+    await request.app.state.container.collaboration.remove_project_collaborator(workspace_id, str(project_id), user_id)
     return Response(status_code=status.HTTP_204_NO_CONTENT)