cms-api: Validate UUID format of AffectedEntity id args before loading the entity

[VP-DS]

Problem

@AffectedEntity() loads the affected entity in UserPermissionsGuard to determine the content scope for the permission check. Guards run before pipes, so validation decorators such as @IsUUID() haven't run at that point. A malformed id therefore reached PostgreSQL through findOneOrFail(), which failed with invalid input syntax for type uuid (22P02). Instead of a validation error, the client got an internal server error.

Solution

Validate the id arguments in ContentScopeService before the entity is loaded:

• idArg values are checked with isUUID() when the affected entity's primary key is a uuid column. The primary key type is read from the MikroORM metadata, so both @PrimaryKey({ type: "uuid" }) and @PrimaryKey({ columnType: "uuid" }) are covered. Entities with a non-uuid primary key are unaffected.
• pageTreeNodeIdArg values are checked as well, as they were exposed to the same failure in pageTreeApi.getNode().

Malformed ids now throw a DextinityValidationException, which the global ExceptionFilter turns into a 400 Bad Request.

Example

query {
    product(id: "not-a-uuid") {
        id
    }
}

Before, this failed with invalid input syntax for type uuid: "not-a-uuid".
Now it fails with Invalid UUID 'not-a-uuid' for argument 'id' of ProductResolver::product().

Screenshots

Before	After