egecankomur
95e30a74c7
Session client (getUserTeams) can return null when the session token is expired or stale. The old guard 'if (teams && teams.total > 0) redirect' was bypassed when teams was null, allowing users to create duplicate workspaces. New guard uses admin client (API key, never session-dependent): - lists user memberships via users.listMemberships(userId) - checks for a tenant_settings row in this app - redirects to /dashboard if found; shows form only for genuinely new users