teams endpoints to team membership (#1428) #1429

Merged

fred merged 1 commits from fix/teams-enumeration-scope into next

2026-08-26 22:45:55 +00:00

Author	SHA1	Message	Date
fred	dcb9da14d5	fix(gateway): scope /api/teams endpoints to team membership (#1428 ) ci/woodpecker/pr/ci Pipeline was successful Details Every teams route sat behind AuthGuard only: any authenticated user could enumerate all teams and their full member records (webUI audit A3 F9.2, upgraded to major in cross-review). - GET /api/teams: members see only their teams (new TeamsService.findAllForUser, same two-step pattern as brain/projects.findAllForUser); admins keep the full list. - GET :teamId, :teamId/members: require admin or membership; 404 for a missing team, 403 for no access — the projects-controller convention. - GET :teamId/members/:userId: self-lookup stays open; looking up another user is team-scoped like the rest. No consumers of /api/teams exist in the monorepo, so no caller changes. New controller spec: 9 tests. Gateway suite 818 passed, typecheck clean.	2026-08-26 17:16:07 -05:00

Author

SHA1

Message

Date

fred

dcb9da14d5

fix(gateway): scope /api/teams endpoints to team membership (#1428 )

ci/woodpecker/pr/ci Pipeline was successful

Details

Every teams route sat behind AuthGuard only: any authenticated user
could enumerate all teams and their full member records (webUI audit
A3 F9.2, upgraded to major in cross-review).

- GET /api/teams: members see only their teams (new
  TeamsService.findAllForUser, same two-step pattern as
  brain/projects.findAllForUser); admins keep the full list.
- GET :teamId, :teamId/members: require admin or membership; 404 for a
  missing team, 403 for no access — the projects-controller convention.
- GET :teamId/members/:userId: self-lookup stays open; looking up
  another user is team-scoped like the rest.

No consumers of /api/teams exist in the monorepo, so no caller changes.
New controller spec: 9 tests. Gateway suite 818 passed, typecheck clean.

2026-08-26 17:16:07 -05:00