From 5ea93d2612a63c55c37bbe3daec7126a6a507e7a Mon Sep 17 00:00:00 2001
From: Hemachandar <hmac.devo@gmail.com>
Date: Tue, 24 Mar 2026 17:50:19 +0530
Subject: [PATCH] check session

---
 app/controllers/general.php | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/app/controllers/general.php b/app/controllers/general.php
index 90750a0705..b69fd9c44c 100644
--- a/app/controllers/general.php
+++ b/app/controllers/general.php
@@ -382,17 +382,35 @@ function router(Http $utopia, Database $dbForPlatform, callable $getProjectDB, S
                     // isExecutionAllowed remains false
                 }
 
+                $userExists = false;
                 $userId = $payload['userId'] ?? '';
                 if (!empty($userId)) {
                     /** @var \Appwrite\Utopia\Database\Documents\User */
                     $user = $authorization->skip(fn () => $dbForProject->getDocument('users', $userId));
                     if (!$user->isEmpty() && $user->getAttribute('status', false)) {
-                        foreach ($user->getRoles($authorization) as $role) {
-                            $authorization->addRole($role);
-                        }
-                        $isExecutionAllowed = $authorization->isValid(new Input('execute', $permissions));
+                        $userExists = true;
                     }
                 }
+
+                $sessionExists = false;
+                $jwtSessionId = $payload['sessionId'] ?? '';
+                if (!empty($jwtSessionId) && isset($user)) {
+                    $sessionExists = !empty($user->find('$id', $jwtSessionId, 'sessions'));
+                }
+
+                $membershipExists = false;
+                $project = $authorization->skip(fn () => $dbForPlatform->getDocument('projects', $projectId));
+                if (!$project->isEmpty() && isset($user)) {
+                    $teamId = $project->getAttribute('teamId', '');
+                    $membershipExists = !empty($user->find('teamId', $teamId, 'memberships'));
+                }
+
+                if ($userExists && $sessionExists && $membershipExists) {
+                    foreach ($user->getRoles($authorization) as $role) {
+                        $authorization->addRole((string) $role);
+                    }
+                    $isExecutionAllowed = $authorization->isValid(new Input('execute', $permissions));
+                }
             }
 
             if (!$isExecutionAllowed) {