fix(apps): initialize launch permissions from license policy

src/apps/apps.service.ts

@@ -62,7 +62,7 @@ export class AppsService {
   async getApps(accessToken?: string) {
     const authUserId = await this.getAuthUserId(accessToken);
     if (authUserId) {
-      await this.ensureDefaultAppViewPermissions(authUserId);
+      await this.ensureDefaultAppViewPermissions(authUserId, accessToken!);
     }
 
     const apps = await this.prisma.launcherApp.findMany({
@@ -119,6 +119,9 @@ export class AppsService {
   async getUpdateStatus(appKey: string, input: UpdateStatusInput) {
     const isLauncherUpdate = appKey.toLowerCase() === 'launcher';
     const authUserId = isLauncherUpdate ? null : await this.getAuthUserId(input.accessToken);
+    if (authUserId) {
+      await this.ensureDefaultAppViewPermissions(authUserId, input.accessToken!);
+    }
     const canLaunch = isLauncherUpdate
       ? true
       : authUserId
@@ -301,19 +304,31 @@ export class AppsService {
     return Boolean(permission);
   }
 
-  private async ensureDefaultAppViewPermissions(authUserId: string) {
+  private async ensureDefaultAppViewPermissions(authUserId: string, accessToken: string) {
     const apps = await this.prisma.launcherApp.findMany({
       where: { isEnabled: true },
-      select: { id: true },
+      select: { id: true, appKey: true },
     });
     if (!apps.length) return;
 
+    const existing = await this.prisma.launcherUserApp.findMany({
+      where: { authUserId },
+      select: { appId: true },
+    });
+    const existingIds = new Set(existing.map((permission) => permission.appId));
+    const missing = apps.filter((app) => !existingIds.has(app.id));
+    if (!missing.length) return;
+
+    // Do not persist deny defaults when policy lookup fails; retry on the next request.
+    const policy = await this.authService.getLauncherAppPolicy(accessToken);
+    const byAppKey = new Map(policy.permissions.map((permission) => [permission.appKey, permission.canLaunch]));
+
     await this.prisma.launcherUserApp.createMany({
-      data: apps.map((app) => ({
+      data: missing.map((app) => ({
         authUserId,
         appId: app.id,
         canView: true,
-        canLaunch: false,
+        canLaunch: byAppKey.get(app.appKey) ?? policy.defaultCanLaunch,
       })),
       skipDuplicates: true,
     });