From d8d9b27bd0f6ab4321a390255cd7bb71675cfde7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gerg=C5=91=20Jedlicska?=
 <57442769+gjedlicska@users.noreply.github.com>
Date: Wed, 8 Oct 2025 17:33:21 +0200
Subject: [PATCH] fix(dashboards): use the workspaceId for dashboard auth
 (#5719)

---
 .../modules/dashboards/graph/resolvers/dashboards.ts  | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/packages/server/modules/dashboards/graph/resolvers/dashboards.ts b/packages/server/modules/dashboards/graph/resolvers/dashboards.ts
index a7e941745..d0ee67130 100644
--- a/packages/server/modules/dashboards/graph/resolvers/dashboards.ts
+++ b/packages/server/modules/dashboards/graph/resolvers/dashboards.ts
@@ -91,15 +91,14 @@ const resolvers: Resolvers = {
   },
   Project: {
     dashboards: async (parent, args, context) => {
-      const authResult = await context.authPolicies.workspace.canListDashboards({
-        userId: context.userId,
-        workspaceId: parent.id
-      })
-      throwIfAuthNotOk(authResult)
-
       if (!parent.workspaceId) {
         throw new WorkspaceNotFoundError()
       }
+      const authResult = await context.authPolicies.workspace.canListDashboards({
+        userId: context.userId,
+        workspaceId: parent.workspaceId
+      })
+      throwIfAuthNotOk(authResult)
 
       return await getPaginatedDashboardsFactory({
         listDashboards: listDashboardsFactory({ db }),