fix: ensure unique GraphQL schema caching per API key

[abdulrahmancodes]

Description

This PR fixes an issue where the GraphQL schema was being incorrectly cached and shared across different API keys within the same workspace. This resulted in the createdBy field (Actor) from the first API key's request being erroneously attributed to subsequent requests made by different API keys.

Changes

• Updated the @graphql-yoga/nestjs patch to include the request's Authorization header in the schema cache key generation logic.
• This ensures that every unique authentication token (and thus every unique API key) generates a distinct cache entry, preventing schema context collisions.

Closes #15093

[greptile-apps]

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

[cubic-dev-ai]

No issues found across 2 files

---

Since this is your first cubic review, here's how it works:

• cubic automatically reviews your code and comments on bugs and improvements
• Teach cubic by replying to its comments. cubic learns from your replies and gets better over time
• Ask questions if you need clarification on any suggestion

[github-actions]

🚀 Preview Environment Ready!

Your preview environment is available at: http://bore.pub:62417

This environment will automatically shut down when the PR is closed or after 5 hours.

[charlesBochet]

@abdulrahmancodes thanks!

Question / feedbacks:

1. Could you document how you were able to generate the patch, I was struggling with it last time I try, if you found a reliable way to generate it, that's great, we should document it somewhere :)
2. I'm surprised about all the changes, I would expect that we just need to add the apiKeyId instead of workspaceUserId in the cacheKey.
3. storing authHeader as cacheKey is a bad idea, security wise

[abdulrahmancodes]

@charlesBochet Thanks for the feedback.
I manually edited the patch file. The patch format is a standard git diff, so I located the cache key generation sections, added the authHeader extraction and included it in the cacheKey. Then I ran yarn to apply the patch and verify it worked. I wasn't aware of the autogeneration process

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​ai-sdk/​react@​2.0.52
	@​ai-sdk/​provider-utils@​3.0.9
	@​ai-sdk/​xai@​2.0.19
	@​ai-sdk/​anthropic@​2.0.17
	@​ai-sdk/​openai@​2.0.30

View full report

[twenty-eng-sync]

Hey @charlesBochet! After you've done the QA of your Pull Request, you can mark it as done here. Thank you!