refactor(workspace): pass workspace object instead of id to service methods

- Replace workspace_id parameter with Workspace object reference in all workspace service methods
- Remove redundant find_workspace_by_id calls that were duplicated in each method
- Update all method signatures across approval, audit, billing, branding, core, settings and stats modules
- Modify SQL queries to bind ws.id instead of separate workspace_id parameter
- Add Workspace import to all affected modules
- Adjust method calls in API handlers to pass workspace object instead of id
- Consolidate workspace retrieval logic to single location per operation flow

service/workspace/invitations.rs

@@ -3,7 +3,7 @@ use uuid::Uuid;
 
 use crate::error::AppError;
 use crate::models::common::Role;
-use crate::models::workspaces::WorkspaceInvitation;
+use crate::models::workspaces::{Workspace, WorkspaceInvitation};
 use crate::pb::email::{EmailAddress, SendEmailRequest};
 use crate::service::WorkspaceService;
 use crate::session::Session;
@@ -25,12 +25,11 @@ impl WorkspaceService {
     pub async fn workspace_invitations(
         &self,
         ctx: &Session,
-        workspace_id: Uuid,
+        ws: &Workspace,
         limit: i64,
         offset: i64,
     ) -> Result<Vec<WorkspaceInvitation>, AppError> {
         let user_uid = ctx.user().ok_or(AppError::Unauthorized)?;
-        let ws = self.find_workspace_by_id(workspace_id).await?;
         self.ensure_workspace_role_at_least(user_uid, &ws, Role::Admin)
             .await?;
         let (limit, offset) = clamp_limit_offset(limit, offset);
@@ -40,7 +39,7 @@ impl WorkspaceService {
              WHERE workspace_id = $1 AND revoked_at IS NULL AND accepted_at IS NULL \
              AND expires_at > NOW() ORDER BY created_at DESC LIMIT $2 OFFSET $3",
         )
-        .bind(workspace_id)
+        .bind(ws.id)
         .bind(limit)
         .bind(offset)
         .fetch_all(self.ctx.db.reader())
@@ -51,11 +50,10 @@ impl WorkspaceService {
     pub async fn workspace_create_invitation(
         &self,
         ctx: &Session,
-        workspace_id: Uuid,
+        ws: &Workspace,
         params: CreateInvitationParams,
     ) -> Result<CreateInvitationResponse, AppError> {
         let user_uid = ctx.user().ok_or(AppError::Unauthorized)?;
-        let ws = self.find_workspace_by_id(workspace_id).await?;
         let actor_role = self
             .ensure_workspace_role_at_least(user_uid, &ws, Role::Admin)
             .await?;
@@ -70,7 +68,7 @@ impl WorkspaceService {
              WHERE workspace_id = $1 AND lower(email) = lower($2) \
              AND revoked_at IS NULL AND accepted_at IS NULL AND expires_at > NOW())",
         )
-        .bind(workspace_id)
+        .bind(ws.id)
         .bind(&email)
         .fetch_one(self.ctx.db.reader())
         .await
@@ -92,7 +90,6 @@ impl WorkspaceService {
             return Err(AppError::BadRequest("invalid role for invitation".into()));
         }
 
-        // Non-owner admins cannot invite with roles equal to or higher than their own
         if actor_role != Role::Owner && role_level(role) >= role_level(actor_role) {
             return Err(AppError::BadRequest(
                 "cannot invite with role equal to or higher than your own".into(),
@@ -124,7 +121,7 @@ impl WorkspaceService {
              accepted_at, revoked_at, expires_at, created_at",
         )
         .bind(Uuid::now_v7())
-        .bind(workspace_id)
+        .bind(ws.id)
         .bind(&email)
         .bind(role.to_string())
         .bind(&token_hash)
@@ -167,11 +164,10 @@ impl WorkspaceService {
     pub async fn workspace_revoke_invitation(
         &self,
         ctx: &Session,
-        workspace_id: Uuid,
+        ws: &Workspace,
         invitation_id: Uuid,
     ) -> Result<(), AppError> {
         let user_uid = ctx.user().ok_or(AppError::Unauthorized)?;
-        let ws = self.find_workspace_by_id(workspace_id).await?;
         self.ensure_workspace_role_at_least(user_uid, &ws, Role::Admin)
             .await?;
 
@@ -195,7 +191,7 @@ impl WorkspaceService {
         )
         .bind(now)
         .bind(invitation_id)
-        .bind(workspace_id)
+        .bind(ws.id)
         .execute(&mut *txn)
         .await
         .map_err(AppError::Database)?;