feat(launchpad): populate all registered apps for Universal Sandbox guests on Launchpad and allow ForwardAuth access

src/features/admin/queries.ts

@@ -175,11 +175,22 @@ export const getDashboardApps = async (
       ORDER BY name ASC
     `;
   } else {
-    const appNames = (customScopes || [])
+    const scopes = customScopes || [];
+    const appNames = scopes
       .filter((s) => s.startsWith("app:"))
       .map((s) => s.split(":")[1]);
 
-    if (appNames.length > 0) {
+    const isUniversalGuest = scopes.includes("*") ||
+      (scopes.includes("guest") && appNames.length === 0);
+
+    if (isUniversalGuest) {
+      return await sqlWrapper.sql`
+        SELECT id, name, description, domain, 'Guest (Viewer)' as role
+        FROM apps
+        WHERE domain IS NOT NULL
+        ORDER BY name ASC
+      `;
+    } else if (appNames.length > 0) {
       return await sqlWrapper.sql`
         SELECT a.id, a.name, a.description, a.domain, g.role
         FROM apps a

src/features/forward_auth/routes.ts

@@ -130,8 +130,11 @@ forwardAuthRoutes.get("/api/forward-auth", async (c) => {
     (auth.customScopes && auth.customScopes.length > 0)
   ) {
     const customScopes = auth.customScopes || [];
+    const isUniversalGuest = customScopes.includes("guest") &&
+      !customScopes.some((s) => s.startsWith("app:"));
     const hasAppScope = customScopes.includes(`app:${appRecord.name}`) ||
-      customScopes.includes("*");
+      customScopes.includes("*") ||
+      isUniversalGuest;
 
     if (!hasAppScope) {
       return c.text(