fix(api): validate token team context

2026-08-09 14:21:51 +00:00 · 2026-06-01 15:17:55 +02:00
parent 4d0be415c8
commit a511bd9b67
14 changed files with 277 additions and 23 deletions
@@ -28,8 +28,14 @@ trait ResolvesTeam

    protected function resolveTeamId(Request $request): ?int
    {
-        $token = $request->user()?->currentAccessToken();
+        $user = $request->user();
+        $token = $user?->currentAccessToken();
+        $teamId = $token?->team_id;

-        return $token?->team_id;
+        if (! $user || is_null($teamId) || ! $user->teams()->where('teams.id', $teamId)->exists()) {
+            return null;
+        }
+
+        return (int) $teamId;
    }
 }