fix(workspace): resolve architecture test failures and integration test 500s

- Move providers logic from controller to WorkspaceQueryService (fixes
  controllersAreThin: max 5 constructor params)
- Add @PreAuthorize("permitAll()") to public endpoints (fixes
  controllerMethodsHaveSecurityAnnotations)
- Add IdentityProviderController to workspace context test exclusions
  (fixes dataEndpointsReceiveWorkspaceContext)
- Make ensureAuthenticatedGitLabUser gracefully handle missing gitlab_id
  JWT claim instead of throwing (fixes integration test 500s for users
  authenticated via GitHub)

Author: FelixTJDietrich

server/application-server/src/main/java/de/tum/in/www1/hephaestus/account/IdentityProviderController.java

@@ -4,6 +4,7 @@
 import io.swagger.v3.oas.annotations.tags.Tag;
 import java.util.List;
 import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
@@ -24,6 +25,7 @@ public IdentityProviderController(AccountService accountService) {
     }
 
     @GetMapping("/identity-providers")
+    @PreAuthorize("permitAll()")
     @Operation(
         summary = "List available identity providers",
         description = "Returns all enabled identity providers that can be used for login. Public endpoint — no authentication required."

server/application-server/src/main/java/de/tum/in/www1/hephaestus/workspace/WorkspaceProvisioningService.java

@@ -284,10 +284,14 @@ public void ensureAuthenticatedGitLabUser(String serverUrl) {
             gitlabId = jwt.getClaim("gitlab_id");
         }
         if (gitlabId == null) {
-            throw new IllegalStateException(
-                "Cannot create GitLab user: gitlab_id claim missing from JWT. " +
-                    "Ensure the user has logged in via GitLab and the gitlab_id mapper is configured in Keycloak."
+            // The user may have logged in via GitHub (no gitlab_id in JWT).
+            // Skip user creation — the workspace will still be created, and the
+            // owner will be resolved from the existing GitHub-linked User entity.
+            log.info(
+                "Skipped GitLab user creation: reason=noGitlabIdInJwt, login={}",
+                LoggingUtils.sanitizeForLog(login)
             );
+            return;
         }
 
         upsertGitLabUser(

server/application-server/src/main/java/de/tum/in/www1/hephaestus/workspace/WorkspaceQueryService.java

@@ -1,9 +1,14 @@
 package de.tum.in.www1.hephaestus.workspace;
 
 import de.tum.in.www1.hephaestus.core.WorkspaceAgnostic;
+import de.tum.in.www1.hephaestus.feature.FeatureFlag;
+import de.tum.in.www1.hephaestus.feature.FeatureFlagService;
+import de.tum.in.www1.hephaestus.gitprovider.common.gitlab.GitLabProperties;
+import de.tum.in.www1.hephaestus.gitprovider.github.GitHubProperties;
 import de.tum.in.www1.hephaestus.gitprovider.repository.Repository;
 import de.tum.in.www1.hephaestus.gitprovider.user.User;
 import de.tum.in.www1.hephaestus.gitprovider.user.UserRepository;
+import de.tum.in.www1.hephaestus.workspace.dto.WorkspaceProvidersDTO;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Optional;
@@ -31,17 +36,42 @@ public class WorkspaceQueryService {
     private final WorkspaceMembershipRepository workspaceMembershipRepository;
     private final RepositoryToMonitorRepository repositoryToMonitorRepository;
     private final UserRepository userRepository;
+    private final GitHubProperties gitHubProperties;
+    private final GitLabProperties gitLabProperties;
+    private final FeatureFlagService featureFlagService;
 
     public WorkspaceQueryService(
         WorkspaceRepository workspaceRepository,
         WorkspaceMembershipRepository workspaceMembershipRepository,
         RepositoryToMonitorRepository repositoryToMonitorRepository,
-        UserRepository userRepository
+        UserRepository userRepository,
+        GitHubProperties gitHubProperties,
+        GitLabProperties gitLabProperties,
+        FeatureFlagService featureFlagService
     ) {
         this.workspaceRepository = workspaceRepository;
         this.workspaceMembershipRepository = workspaceMembershipRepository;
         this.repositoryToMonitorRepository = repositoryToMonitorRepository;
         this.userRepository = userRepository;
+        this.gitHubProperties = gitHubProperties;
+        this.gitLabProperties = gitLabProperties;
+        this.featureFlagService = featureFlagService;
+    }
+
+    /**
+     * Returns available workspace creation providers based on server configuration.
+     */
+    public WorkspaceProvidersDTO getAvailableProviders() {
+        var github =
+            gitHubProperties.app().id() > 0 && gitHubProperties.app().installationUrl() != null
+                ? new WorkspaceProvidersDTO.GitHubProviderDTO(gitHubProperties.app().installationUrl())
+                : null;
+
+        var gitlab = featureFlagService.isEnabled(FeatureFlag.GITLAB_WORKSPACE_CREATION)
+            ? new WorkspaceProvidersDTO.GitLabProviderDTO(gitLabProperties.defaultServerUrl())
+            : null;
+
+        return new WorkspaceProvidersDTO(github, gitlab);
     }
 
     /**

server/application-server/src/main/java/de/tum/in/www1/hephaestus/workspace/WorkspaceRegistryController.java

@@ -2,8 +2,6 @@
 
 import de.tum.in.www1.hephaestus.feature.FeatureFlag;
 import de.tum.in.www1.hephaestus.feature.FeatureFlagService;
-import de.tum.in.www1.hephaestus.gitprovider.common.gitlab.GitLabProperties;
-import de.tum.in.www1.hephaestus.gitprovider.github.GitHubProperties;
 import de.tum.in.www1.hephaestus.workspace.dto.CreateWorkspaceRequestDTO;
 import de.tum.in.www1.hephaestus.workspace.dto.GitLabGroupDTO;
 import de.tum.in.www1.hephaestus.workspace.dto.GitLabPreflightRequestDTO;
@@ -47,26 +45,16 @@ public class WorkspaceRegistryController {
     private final WorkspaceProvisioningService workspaceProvisioningService;
     private final GitLabPreflightService gitLabPreflightService;
     private final FeatureFlagService featureFlagService;
-    private final GitHubProperties gitHubProperties;
-    private final GitLabProperties gitLabProperties;
 
     @GetMapping("/providers")
     @Operation(
         summary = "List available workspace creation providers",
         description = "Returns available workspace providers with their configuration. Public endpoint — no authentication required."
     )
     @io.swagger.v3.oas.annotations.security.SecurityRequirements
+    @PreAuthorize("permitAll()")
     public ResponseEntity<WorkspaceProvidersDTO> getProviders() {
-        var github =
-            gitHubProperties.app().id() > 0 && gitHubProperties.app().installationUrl() != null
-                ? new WorkspaceProvidersDTO.GitHubProviderDTO(gitHubProperties.app().installationUrl())
-                : null;
-
-        var gitlab = featureFlagService.isEnabled(FeatureFlag.GITLAB_WORKSPACE_CREATION)
-            ? new WorkspaceProvidersDTO.GitLabProviderDTO(gitLabProperties.defaultServerUrl())
-            : null;
-
-        return ResponseEntity.ok(new WorkspaceProvidersDTO(github, gitlab));
+        return ResponseEntity.ok(workspaceQueryService.getAvailableProviders());
     }
 
     @PostMapping

server/application-server/src/test/java/de/tum/in/www1/hephaestus/architecture/MultiTenancyArchitectureTest.java

@@ -897,7 +897,11 @@ public void check(JavaMethod method, ConditionEvents events) {
 
                     // Skip user account operations - these are USER-scoped, not WORKSPACE-scoped.
                     // Users can access their account settings regardless of workspace context.
-                    if (controllerName.contains("Account") || controllerName.contains("FeatureFlag")) {
+                    if (
+                        controllerName.contains("Account") ||
+                        controllerName.contains("FeatureFlag") ||
+                        controllerName.contains("IdentityProvider")
+                    ) {
                         return;
                     }