refactor(api): move app-scoped end users behind application services (#41398)

api/controllers/openapi/auth/subjects.py

@@ -15,12 +15,12 @@ from werkzeug.exceptions import Unauthorized
 from controllers.openapi.auth.context import Context
 from controllers.openapi.auth.data import ExternalIdentity
 from controllers.openapi.auth.loaders import load_app, load_workspace, route_has_app
+from extensions.ext_application_services import application_services
 from libs.oauth_bearer import AuthContext, Scope, SubjectType
 from models.account import Account
 from models.enums import CreatorUserRole, EndUserType
 from models.model import EndUser
 from services.account_service import AccountService
-from services.end_user_service import EndUserService
 from services.enterprise.enterprise_service import WebAppAccessMode
 
 _SUBJECT_CLASSES: dict[SubjectType, type[Subject]] = {}
@@ -123,7 +123,7 @@ class ExternalSsoSubject(Subject):
         identity = self.external_identity
         if identity is None:
             raise Unauthorized("missing context for external user resolution")
-        return EndUserService.get_or_create_end_user_by_type(
+        return application_services().app_scoped_end_users.commands.get_or_create_end_user_by_type(
             EndUserType.OPENAPI,
             tenant_id=str(load_workspace(ctx).id),
             app_id=str(load_app(ctx).id),