emilsteixnerandGitHub 112a807d7d fix(teams): preserve members across list responses (#3486) ...

Fixes incomplete team `members` arrays when a user belongs to multiple
teams included in the same response.
`addMoreInfoToTeams` queried one row per `(team_id, user_id)` membership
but stored those rows in a map keyed only by user ID. When a user was a
member of multiple teams, a later row replaced an earlier one. The
subsequent member assignment loop therefore used only the surviving
membership row.
The fix stores all queried membership rows in a slice, preserving every
team-user relation. It creates a separate `usersByID` map only for
resolving `created_by`, where one row per user is appropriate.
This affects both list paths because both use `addMoreInfoToTeams`:
- `GET /api/v1/teams`
- `GET /api/v1/projects/{projectId}/teams`

2026-08-20 15:32:23 +00:00

..

admin_actions_test.go

…

admin_bypass_test.go

…

admin_bypass.go

…

admin_overview.go

…

admin_project_list.go

…

admin_user_actions.go

…

admin_user_create.go

…

api_routes_test.go

feat(api/v2): add bulk task creation endpoint

2026-08-02 16:21:50 +02:00

api_routes.go

feat(api/v2): add bulk task creation endpoint

2026-08-02 16:21:50 +02:00

api_tokens_expiry_cron_test.go

…

api_tokens_expiry_cron.go

…

api_tokens_expiry_notification_test.go

feat: show relative time in api token expiry notifications

2026-08-18 09:44:49 +02:00

api_tokens_expiry_notification.go

feat: show relative time in api token expiry notifications

2026-08-18 09:44:49 +02:00

api_tokens_permissions.go

fix(api): derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

api_tokens_test.go

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

api_tokens.go

fix(api tokens): guard GetTokenFromTokenString against short token strings

2026-07-28 06:59:04 +00:00

bot_users_permissions.go

fix(security): reject link shares at team, bot and webhook permission checks

2026-08-04 13:40:11 +02:00

bot_users_test.go

…

bot_users.go

fix(security): reject link shares at team, bot and webhook permission checks

2026-08-04 13:40:11 +02:00

bulk_task_create_test.go

feat(tasks): add BulkTaskCreation model

2026-08-02 16:21:50 +02:00

bulk_task_create.go

feat(tasks): add BulkTaskCreation model

2026-08-02 16:21:50 +02:00

bulk_task_test.go

…

bulk_task.go

…

comment_quotes_test.go

…

comment_quotes.go

…

error_test.go

test: assert I18nParams keys against en.json translation placeholders

2026-07-18 13:41:15 +00:00

error.go

refactor(projects): dedupe effective parent lookup, tidy error ordering and comments

2026-08-20 11:58:06 +02:00

events.go

feat(tasks): generalize task creation to batches

2026-08-02 16:21:50 +02:00

export_test.go

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

export.go

fix: load export file meta inside transaction and open storage after commit

2026-08-16 17:57:52 +02:00

favorites.go

…

kanban_permissions.go

fix(projects): tolerate dangling stored parent when updating, keep admin bypass for filter buckets

2026-08-20 11:58:06 +02:00

kanban_task_bucket_test.go

…

kanban_task_bucket.go

feat(tasks): generalize task creation to batches

2026-08-02 16:21:50 +02:00

kanban_test.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

kanban.go

fix(views): seed and maintain kanban buckets when a view's kind changes

2026-08-04 01:09:10 +02:00

label_permissions.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

label_task_permissions.go

…

label_task_test.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

label_task.go

…

label_test.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

label.go

…

link_sharing_permissions.go

…

link_sharing_test.go

test: assert link share attachments are not attributed to a colliding user

2026-08-04 13:40:11 +02:00

link_sharing.go

fix(security): return the negated user id from LinkSharing.GetID

2026-08-04 13:40:11 +02:00

listeners_test.go

feat(tasks): update saved-filter views once per creation batch

2026-08-02 16:21:50 +02:00

listeners.go

fix(notifications): include the project prefix in task identifiers (#3538)

2026-08-18 16:38:00 +00:00

main_test.go

…

mentions_test.go

…

mentions.go

…

message.go

…

metrics_count_test.go

…

models.go

…

notifications_database.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

notifications_permissions_test.go

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

notifications_permissions.go

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

notifications_refresh_test.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

notifications_refresh.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

notifications_task_identifier_test.go

fix(notifications): include the project prefix in task identifiers (#3538)

2026-08-18 16:38:00 +00:00

notifications_test.go

…

notifications.go

fix(notifications): require a persisted notification to declare its project

2026-07-29 07:58:17 +00:00

oauth_codes.go

…

permissions.go

…

project_duplicate_test.go

…

project_duplicate.go

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

project_json_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_permissions_multiple_teams_test.go

…

project_permissions_pseudo_test.go

fix(projects): deny writes to pseudo projects across the permission family

2026-08-19 16:02:39 +02:00

project_permissions.go

fix(projects): reject un-archiving a child while its parent is archived

2026-08-20 11:58:06 +02:00

project_repair_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_repair.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_team_permissions.go

…

project_team_test.go

…

project_team.go

fix(models): use ILIKE for the team search count query

2026-07-29 22:53:46 +02:00

project_test.go

fix(projects): tolerate dangling stored parent when updating, keep admin bypass for filter buckets

2026-08-20 11:58:06 +02:00

project_users_permissions_test.go

…

project_users_permissions.go

…

project_users_test.go

…

project_users.go

…

project_view_permissions.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

project_view_test.go

fix(views): seed and maintain kanban buckets when a view's kind changes

2026-08-04 01:09:10 +02:00

project_view.go

fix(views): seed and maintain kanban buckets when a view's kind changes

2026-08-04 01:09:10 +02:00

project.go

fix(projects): tolerate dangling stored parent when updating, keep admin bypass for filter buckets

2026-08-20 11:58:06 +02:00

reaction_permissions.go

…

reaction_test.go

…

reaction.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

saved_filter_positions_test.go

feat(tasks): calculate top-of-view positions per batch

2026-08-02 16:21:50 +02:00

saved_filters_permissions.go

fix: report the real link share id in saved filter errors

2026-08-04 13:40:11 +02:00

saved_filters_test.go

…

saved_filters.go

fix: report the real link share id in saved filter errors

2026-08-04 13:40:11 +02:00

sessions_permissions.go

…

sessions.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

setup_tests.go

…

subscription_permissions.go

…

subscription_test.go

fix(notifications): don't notify subscribers who lost access to the entity

2026-07-29 07:33:35 +00:00

subscription.go

fix(subscriptions): marshal unknown subscription entity type as null

2026-07-29 22:28:31 +02:00

task_assignees_permissions.go

…

task_assignees_test.go

…

task_assignees.go

…

task_attachment_permissions.go

…

task_attachment_test.go

fix: use caller's session in LoadFileMetaByID to prevent connection pool deadlock

2026-08-16 17:57:52 +02:00

task_attachment.go

fix: release db connection before reading attachment files from storage

2026-08-16 17:57:52 +02:00

task_collection_filter_test.go

fix(filter): don't rewrite in/not in/like inside quoted values

2026-07-28 23:41:49 +02:00

task_collection_filter.go

fix(filter): don't rewrite in/not in/like inside quoted values

2026-07-28 23:41:49 +02:00

task_collection_sort_test.go

…

task_collection_sort.go

…

task_collection_test.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

task_collection.go

fix(kanban): pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)

2026-07-19 18:59:34 +02:00

task_comment_permissions.go

refactor: drop redundant link share branch in comment permissions

2026-08-04 13:40:11 +02:00

task_comments_test.go

…

task_comments.go

…

task_delete_cron_test.go

…

task_delete_cron.go

…

task_duplicate_test.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

task_duplicate.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

task_overdue_reminder_test.go

…

task_overdue_reminder.go

…

task_position_test.go

…

task_position.go

feat(tasks): calculate top-of-view positions per batch

2026-08-02 16:21:50 +02:00

task_relation_authz_test.go

…

task_relation_permissions.go

…

task_relation_test.go

…

task_relation.go

…

task_reminder_test.go

fix(notifications): include the project prefix in task identifiers (#3538)

2026-08-18 16:38:00 +00:00

task_reminder.go

fix(notifications): include the project prefix in task identifiers (#3538)

2026-08-18 16:38:00 +00:00

task_search_bench_test.go

…

task_search_test.go

…

task_search.go

fix(search): mirror ParadeDB BM25 matching into the subtask parent search condition

2026-07-19 14:16:07 +00:00

task_unread_statuses.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

tasks_permissions.go

…

tasks_test.go

fix(tasks): don't wrap reminders into the past when repeating from current date

2026-08-18 19:01:05 +02:00

tasks.go

fix(tasks): don't wrap reminders into the past when repeating from current date

2026-08-18 19:01:05 +02:00

team_members_permissions.go

fix(security): reject link shares at team, bot and webhook permission checks

2026-08-04 13:40:11 +02:00

team_members_test.go

…

team_members.go

…

team_sync.go

…

teams_permissions_test.go

…

teams_permissions.go

fix(security): reject link shares at team, bot and webhook permission checks

2026-08-04 13:40:11 +02:00

teams_test.go

fix(teams): preserve members across list responses (#3486)

2026-08-20 15:32:23 +00:00

teams.go

fix(teams): preserve members across list responses (#3486)

2026-08-20 15:32:23 +00:00

time_tracking_filter.go

…

time_tracking_test.go

…

time_tracking.go

…

unsplash.go

…

user_delete_test.go

test(models): restore notification faking after user delete tests

2026-07-29 07:33:35 +00:00

user_delete.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

user_list_test.go

…

user_project_test.go

…

user_project.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

user_settings.go

…

users.go

…

webhooks_permissions.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

webhooks_test.go

fix(webhooks): bound the error response body read

2026-07-28 17:25:57 +02:00

webhooks.go

fix(security): reject link shares in Webhook.ReadAll

2026-08-04 13:40:11 +02:00