From eaaa5d80d05cd3a547f5145a4907b553e1755c56 Mon Sep 17 00:00:00 2001
From: cryppadotta <34892728+cryppadotta@users.noreply.github.com>
Date: Sat, 12 Sep 2026 15:33:05 +0000
Subject: [PATCH] fix(auth): preserve board key test contract

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../src/security/board-key-owner-authority.ts | 26 +++++++++++++------
 1 file changed, 18 insertions(+), 8 deletions(-)

diff --git a/server/src/security/board-key-owner-authority.ts b/server/src/security/board-key-owner-authority.ts
index 12c1c114ab..fb840778ad 100644
--- a/server/src/security/board-key-owner-authority.ts
+++ b/server/src/security/board-key-owner-authority.ts
@@ -132,20 +132,30 @@ export async function ownerHasRequiredGrant(
     });
   }
   const { permissionKeys } = requirement;
+  const memberships = await db
+    .select({
+      companyId: companyMemberships.companyId,
+      membershipRole: companyMemberships.membershipRole,
+    })
+    .from(companyMemberships)
+    .where(and(
+      eq(companyMemberships.principalType, "user"),
+      eq(companyMemberships.principalId, ownerUserId),
+      eq(companyMemberships.status, "active"),
+      inArray(companyMemberships.companyId, [...companyIds]),
+    ));
+  const membershipRoleByCompany = new Map(
+    memberships.map((membership) => [membership.companyId, membership.membershipRole]),
+  );
+  if (companyIds.some((companyId) => !membershipRoleByCompany.has(companyId))) return false;
+
   const rows = await db
     .select({
       companyId: principalPermissionGrants.companyId,
       permissionKey: principalPermissionGrants.permissionKey,
       grantOrigin: principalPermissionGrants.grantOrigin,
-      membershipRole: companyMemberships.membershipRole,
     })
     .from(principalPermissionGrants)
-    .innerJoin(companyMemberships, and(
-      eq(companyMemberships.companyId, principalPermissionGrants.companyId),
-      eq(companyMemberships.principalType, "user"),
-      eq(companyMemberships.principalId, ownerUserId),
-      eq(companyMemberships.status, "active"),
-    ))
     .where(and(
       inArray(principalPermissionGrants.companyId, [...companyIds]),
       eq(principalPermissionGrants.principalType, "user"),
@@ -156,7 +166,7 @@ export async function ownerHasRequiredGrant(
   for (const row of rows) {
     if (row.grantOrigin === "legacy_unknown") {
       const currentRolePermissionKeys = new Set(
-        grantsForHumanRole(normalizeHumanRole(row.membershipRole))
+        grantsForHumanRole(normalizeHumanRole(membershipRoleByCompany.get(row.companyId)))
           .map((grant) => grant.permissionKey),
       );
       if (!currentRolePermissionKeys.has(row.permissionKey as PermissionKey)) continue;