From e0d1c0a95d6d0dfe9f62100534a1ba798cf34f2e Mon Sep 17 00:00:00 2001
From: Hemachandar <hmac.devo@gmail.com>
Date: Wed, 25 Feb 2026 13:51:01 +0530
Subject: [PATCH] Authorize function execution with user JWT header

---
 app/controllers/general.php | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/app/controllers/general.php b/app/controllers/general.php
index 7fdbeb1855..fb8393e8fd 100644
--- a/app/controllers/general.php
+++ b/app/controllers/general.php
@@ -364,8 +364,22 @@ function router(Http $utopia, Database $dbForPlatform, callable $getProjectDB, S
         }
 
         if ($type === 'function') {
+            $userJwt = $request->getHeader('x-appwrite-user-jwt', '');
             $permissions = $resource->getAttribute('execute');
-            if (!(\in_array('any', $permissions)) && !(\in_array('guests', $permissions))) {
+            $isExecutionAllowed = (\in_array('any', $permissions)) || (\in_array('guests', $permissions));
+
+            if (!$isExecutionAllowed && !empty($userJwt)) {
+                $jwt = new JWT(System::getEnv('_APP_OPENSSL_KEY_V1'), 'HS256', 3600, 0);
+                $payload = [];
+                try {
+                    $payload = $jwt->decode($userJwt);
+                } catch (JWTException $error) {}
+
+                $userId = $payload['userId'] ?? '';
+                $isExecutionAllowed = \in_array("user:{$userId}", $permissions);
+            }
+
+            if (!$isExecutionAllowed) {
                 $exception = new AppwriteException(AppwriteException::FUNCTION_EXECUTE_PERMISSION_MISSING, view: $errorView);
                 $exception->addCTA('View settings', $url . '/console/project-' . $project->getAttribute('region', 'default') . '-' . $project->getId() . '/functions/function-' . $resource->getId() . '/settings');
                 throw $exception;