From 9c5f76852b9c232ea49d96469fa4996495aaee21 Mon Sep 17 00:00:00 2001
From: Hemachandar <hmac.devo@gmail.com>
Date: Thu, 8 Jan 2026 16:28:20 +0530
Subject: [PATCH] better checks

---
 app/controllers/shared/api.php                | 31 +++++++++++--------
 .../Services/Teams/TeamsConsoleClientTest.php |  1 -
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/app/controllers/shared/api.php b/app/controllers/shared/api.php
index a995546d2c..47db7dff8d 100644
--- a/app/controllers/shared/api.php
+++ b/app/controllers/shared/api.php
@@ -389,23 +389,28 @@ App::init()
             }
 
             $scopes = []; // Reset scope if admin
+            $projectRoles = \array_filter($adminRoles, fn ($role) => str_starts_with($role, Roles::ROLE_PROJECT));
 
-            $hasProjectSpecificPermissions = false;
-            foreach ($adminRoles as $adminRole) {
-                $adminRole = Role::parse($adminRole);
-                if ($adminRole->getRole() === Roles::ROLE_PROJECT) {
-                    $hasProjectSpecificPermissions = true;
-                    $adminRole = $adminRole->getDimension();
-                } else {
-                    $adminRole = $adminRole->getRole();
+            // No project-specific permissions present for the user
+            if (empty($projectRoles)) {
+                foreach ($adminRoles as $role) {
+                    $scopes = \array_merge($scopes, $roles[$role]['scopes']);
                 }
-                $scopes = \array_merge($scopes, $roles[$adminRole]['scopes'] ?? []);
-            }
+                Authorization::setDefaultStatus(false); // Cancel security segmentation for admin users.
+            } else {
+                // Project-specific permissions present for the user
+                if ($project->getId() === 'console') {
+                    $role = User::ROLE_MEMBER; // Per-project users are considered to have 'member' role at the team level.
+                } else {
+                    $projectRoles = \array_filter($adminRoles, fn ($role) => str_starts_with($role, Role::project($project->getId())->toString()));
 
-            Authorization::setDefaultStatus($hasProjectSpecificPermissions);  // Cancel security segmentation for admin users.
+                    if (empty($projectRoles)) {
+                        throw new Exception(Exception::USER_UNAUTHORIZED);
+                    }
 
-            if (!$hasProjectSpecificPermissions) {
-                $role = $adminRole;
+                    $role = Role::parse($projectRoles[0])->getDimension(); // There must be only one role for a project.
+                }
+                $scopes = $roles[$role]['scopes'];
             }
         }
 
diff --git a/tests/e2e/Services/Teams/TeamsConsoleClientTest.php b/tests/e2e/Services/Teams/TeamsConsoleClientTest.php
index 85409e4255..baf3a361da 100644
--- a/tests/e2e/Services/Teams/TeamsConsoleClientTest.php
+++ b/tests/e2e/Services/Teams/TeamsConsoleClientTest.php
@@ -264,7 +264,6 @@ class TeamsConsoleClientTest extends Scope
         ], $this->getHeaders()), [
             'teamId' => ID::unique(),
             'name' => 'Arsenal',
-            'roles' => ['player'],
         ]);
 
         $this->assertEquals(201, $team['headers']['status-code']);