fix: filter teams by app — getUserTeams and setActiveTenant now reject cross-app teams

src/lib/appwrite/tenant-actions.ts

@@ -2,7 +2,7 @@
 
 import { cookies } from "next/headers";
 import { redirect } from "next/navigation";
-import { AppwriteException, ID, Permission, Role } from "node-appwrite";
+import { AppwriteException, ID, Permission, Role, Query } from "node-appwrite";
 
 import { createAdminClient, createSessionClient } from "./server";
 import { DATABASE_ID, TABLES } from "./schema";
@@ -91,12 +91,22 @@ export async function createWorkspaceAction(
 
 export async function setActiveTenantAction(tenantId: string) {
   try {
-    const { account } = await createSessionClient();
+    const { account, teams, tablesDB } = await createSessionClient();
     const user = await account.get();
 
-    const teams = await (await createSessionClient()).teams.list();
+    const allTeams = await teams.list();
-    const owns = teams.teams.some((t) => t.$id === tenantId);
+    const isMember = allTeams.teams.some((t) => t.$id === tenantId);
-    if (!owns) {
+    if (!isMember) {
+      return { ok: false, error: "Bu çalışma alanına erişiminiz yok." };
+    }
+
+    // Verify this team belongs to this app (not a team from another KovakSoft product)
+    const settingsCheck = await tablesDB.listRows({
+      databaseId: DATABASE_ID,
+      tableId: TABLES.tenantSettings,
+      queries: [Query.equal("tenantId", tenantId), Query.limit(1)],
+    });
+    if (settingsCheck.total === 0) {
       return { ok: false, error: "Bu çalışma alanına erişiminiz yok." };
     }
 

src/lib/appwrite/tenant.ts

@@ -1,14 +1,30 @@
 import "server-only";
 
 import { cookies } from "next/headers";
+import { Query } from "node-appwrite";
 
 import { createSessionClient } from "./server";
 import { ACTIVE_TENANT_COOKIE } from "./tenant-types";
+import { DATABASE_ID, TABLES } from "./schema";
 
 export async function getUserTeams() {
   try {
-    const { teams } = await createSessionClient();
+    const { teams, tablesDB } = await createSessionClient();
-    return await teams.list();
+    const allTeams = await teams.list();
+
+    if (allTeams.teams.length === 0) return allTeams;
+
+    // Filter to only teams that belong to this app (have a tenant_settings row in this database)
+    const teamIds = allTeams.teams.map((t) => t.$id);
+    const settings = await tablesDB.listRows({
+      databaseId: DATABASE_ID,
+      tableId: TABLES.tenantSettings,
+      queries: [Query.equal("tenantId", teamIds), Query.limit(100)],
+    });
+    const validIds = new Set(settings.rows.map((r) => r.tenantId as string));
+
+    const filtered = allTeams.teams.filter((t) => validIds.has(t.$id));
+    return { ...allTeams, teams: filtered, total: filtered.length };
   } catch {
     return null;
   }