From 2f5a5e3387f8323f7387232fc7b25059e3e67f54 Mon Sep 17 00:00:00 2001
From: Hemachandar <hmac.devo@gmail.com>
Date: Fri, 30 Jan 2026 15:19:37 +0530
Subject: [PATCH] simplify

---
 app/controllers/shared/api.php                  | 16 +++++-----------
 src/Appwrite/Utopia/Database/Documents/User.php |  5 -----
 2 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index 9b4247a0d6..e3a1210f5d 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -274,7 +274,7 @@ App::init()
 
             /**
              * For listing, updating and deleting projects, we use platform DB.
-             * Enabling authorization restricts admin user has access to the ones they have access to.
+             * Enabling authorization restricts admin user to the projects they have access to.
              */
             if ($project->getId() === 'console' && str_starts_with($route->getPath(), '/v1/projects')) {
                 $authorization->setDefaultStatus(true);
@@ -294,16 +294,10 @@ App::init()
         /**
          * We disable authorization checks above to ensure other endpoints (list teams, members, etc.) will continue working.
          * But, for actions on resources (sites, functions, etc.) in a non-console project, we explicitly check
-         * whether the admin user has necessary permission on the project (sites, functions don't have permissions associated to them).
+         * whether the admin user has necessary permission on the project (sites, functions, etc. don't have permissions associated to them).
          */
         if ($project->getId() !== 'console' && $mode === APP_MODE_ADMIN) {
-            $action = match ($route->getMethod()) {
-                Request::METHOD_GET => Database::PERMISSION_READ,
-                Request::METHOD_DELETE => Database::PERMISSION_DELETE,
-                default => Database::PERMISSION_UPDATE,
-            };
-            $input = new Input($action, $project->getPermissionsByType($action));
-
+            $input = new Input(Database::PERMISSION_READ, $project->getPermissionsByType(Database::PERMISSION_READ));
             $initialStatus = $authorization->getStatus();
             $authorization->enable();
             if (!$authorization->isValid($input)) {
@@ -326,10 +320,10 @@ App::init()
             if (DateTime::formatTz(DateTime::addSeconds(new \DateTime(), -APP_USER_ACCESS)) > $accessedAt) {
                 $user->setAttribute('accessedAt', DateTime::now());
 
-                if (APP_MODE_ADMIN !== $mode) {
+                if ($project->getId() !== 'console' && APP_MODE_ADMIN !== $mode) {
                     $dbForProject->updateDocument('users', $user->getId(), $user);
                 } else {
-                    $dbForPlatform->updateDocument('users', $user->getId(), $user);
+                    $authorization->skip(fn () => $dbForPlatform->updateDocument('users', $user->getId(), $user));
                 }
             }
         }
diff --git a/src/Appwrite/Utopia/Database/Documents/User.php b/src/Appwrite/Utopia/Database/Documents/User.php
index 69bc4077a9..cbd22aaee5 100644
--- a/src/Appwrite/Utopia/Database/Documents/User.php
+++ b/src/Appwrite/Utopia/Database/Documents/User.php
@@ -72,11 +72,6 @@ class User extends Document
                     foreach ($node['roles'] as $nodeRole) { // Set all team roles
                         $roles[] = Role::team($node['teamId'], $nodeRole)->toString();
                     }
-
-                    if (str_starts_with($nodeRole, 'project-')) {
-                        $projectBaseRole = substr($nodeRole, 0, strrpos($nodeRole, '-'));
-                        $roles[] = Role::team($node['teamId'], $projectBaseRole)->toString(); // Add base role for project-specific permission
-                    }
                 }
             }
         }