Currently on auction creation the check is if the address calling is approved:
require(msg.sender == IERC721(tokenContract).getApproved(tokenId) || msg.sender == tokenOwner, "Caller must be approved or owner for token id");
However, if you're calling this from a smart contract setApprovalForAll does not work, it needs to be set for each token.
Is it a good idea to add in the isApprovedForAll check here?
require(msg.sender == IERC721(tokenContract).getApproved(tokenId) || IERC721(tokenContract).isApprovedForAll(msg.sender) || msg.sender == tokenOwner, "Caller must be approved or owner for token id");