fix google oauth guard (#4987)

## Context
Recent PR introduced a verifyTransientToken inside the
GoogleAPIsProviderEnabledGuard guard. This is used to extract the
workspaceId from the token. This is working fine for the first call sent
to google however the callback is calling the same guard which is
causing an issue because the transientToken is missing from the
callback.
Imho, the same guard shouldn't be used by the callback but for the time
being I'm adding a check to prevent using feature flag when
transientToken is absent. In fact, it is present in the request but not
in the same key. Because the scope is only relevant for the first call,
I'm simply adding a check there.

packages/twenty-server/src/engine/core-modules/auth/guards/google-apis-provider-enabled.guard.ts

@@ -9,7 +9,10 @@ import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
 
 import { TokenService } from 'src/engine/core-modules/auth/services/token.service';
-import { GoogleAPIsStrategy } from 'src/engine/core-modules/auth/strategies/google-apis.auth.strategy';
+import {
+  GoogleAPIScopeConfig,
+  GoogleAPIsStrategy,
+} from 'src/engine/core-modules/auth/strategies/google-apis.auth.strategy';
 import {
   FeatureFlagEntity,
   FeatureFlagKeys,
@@ -34,21 +37,26 @@ export class GoogleAPIsProviderEnabledGuard implements CanActivate {
       throw new NotFoundException('Google apis auth is not enabled');
     }
 
-    const { workspaceId } = await this.tokenService.verifyTransientToken(
-      getRequest(context)?.query?.transientToken ?? '',
-    );
+    const transientToken = getRequest(context)?.query?.transientToken;
 
-    const isCalendarEnabledFlag = await this.featureFlagRepository.findOneBy({
-      workspaceId,
-      key: FeatureFlagKeys.IsCalendarEnabled,
-      value: true,
-    });
+    const scopeConfig: GoogleAPIScopeConfig = {
+      isCalendarEnabled: false,
+    };
 
-    const isCalendarEnabled = !!isCalendarEnabledFlag?.value;
+    if (transientToken && typeof transientToken === 'string') {
+      const { workspaceId } =
+        await this.tokenService.verifyTransientToken(transientToken);
 
-    new GoogleAPIsStrategy(this.environmentService, {
-      isCalendarEnabled,
-    });
+      const isCalendarEnabledFlag = await this.featureFlagRepository.findOneBy({
+        workspaceId,
+        key: FeatureFlagKeys.IsCalendarEnabled,
+        value: true,
+      });
+
+      scopeConfig.isCalendarEnabled = !!isCalendarEnabledFlag?.value;
+    }
+
+    new GoogleAPIsStrategy(this.environmentService, scopeConfig);
 
     return true;
   }

packages/twenty-server/src/engine/core-modules/auth/services/token.service.ts

@@ -60,7 +60,7 @@ export class TokenService {
     @InjectRepository(Workspace, 'core')
     private readonly workspaceRepository: Repository<Workspace>,
     private readonly emailService: EmailService,
-  ) { }
+  ) {}
 
   async generateAccessToken(
     userId: string,
@@ -382,7 +382,9 @@ export class TokenService {
     });
 
     if (!user) {
-      throw new NotFoundException('User who generated the token does not exist');
+      throw new NotFoundException(
+        'User who generated the token does not exist',
+      );
     }
 
     if (!user.defaultWorkspace) {

packages/twenty-server/src/engine/core-modules/auth/strategies/google-apis.auth.strategy.ts

@@ -22,6 +22,10 @@ export type GoogleAPIsRequest = Omit<
   };
 };
 
+export type GoogleAPIScopeConfig = {
+  isCalendarEnabled?: boolean;
+};
+
 @Injectable()
 export class GoogleAPIsStrategy extends PassportStrategy(
   Strategy,
@@ -29,9 +33,7 @@ export class GoogleAPIsStrategy extends PassportStrategy(
 ) {
   constructor(
     environmentService: EnvironmentService,
-    scopeConfig: {
-      isCalendarEnabled?: boolean;
-    },
+    scopeConfig: GoogleAPIScopeConfig,
   ) {
     const scope = ['email', 'profile'];