@nextsparkjs/core 0.1.0-beta.185 → 0.1.0-beta.187

package/migrations/027_rls_bypass_developer_and_system_admin_team.sql

@@ -0,0 +1,197 @@
+-- Migration: 027_rls_bypass_developer_and_system_admin_team.sql
+-- Description: Resolve the System Admin Team by a metadata flag instead of a
+--              hardcoded team id, auto-enroll/unenroll developer/superadmin
+--              users via a trigger, and fix 4 RLS policies that hardcoded
+--              their own role check instead of calling can_bypass_rls().
+-- Date: 2026-09-03
+-- Issues: #108, #102
+--
+-- Why both issues in one migration: #102's fix (make a policy call
+-- can_bypass_rls()) only makes 'developer' bypass actually reachable in a
+-- real (non-seeded) deployment once #108's enrollment mechanism exists —
+-- fixing one without the other leaves the combination still broken.
+--
+-- #108 — System Admin Team enrollment:
+--   can_bypass_rls() grants 'developer' a conditional bypass: membership in
+--   the System Admin Team. Nothing ever enrolled anyone into it outside of
+--   090_sample_data.sql's explicit INSERTs, and the team id was a literal
+--   ('team-nextspark-001') duplicated in this function AND in
+--   dual-auth.ts's SYSTEM_ADMIN_TEAM_ID constant. This migration:
+--     1. Resolves the System Admin Team by `teams.metadata.systemAdmin =
+--        true` instead of a literal id — 090_sample_data.sql's team already
+--        carries this flag, so seeded deployments keep working unchanged;
+--        a real deployment flags its own team, no code change needed.
+--     2. Adds a trigger on users(role) that auto-enrolls a user into that
+--        team (as 'owner' for superadmin, 'admin' for developer) when their
+--        role becomes bypass-eligible, and removes the membership when it
+--        stops being eligible. Framework-level (a Postgres trigger fires
+--        regardless of which application code performed the UPDATE) rather
+--        than an app-level hook, because no Server Action in core actually
+--        assigns users.role today — the only code that does lives in
+--        apps/dev, reimplementable by any consumer of this framework.
+--     3. Backfills existing developer/superadmin users into the team, for
+--        deployments that already have such users predating this trigger.
+--   Deliberately NOT included here (separate, larger concern — see #108):
+--   POST /api/v1/users creating a "half" user (no account/team/subscription
+--   row). That depends on patterns from the not-yet-approved #98 MCP work.
+--
+-- #102 (+ 3 more found while auditing the same pattern) — RLS policies that
+-- hardcoded `role IN ('admin','superadmin')` or `role = 'superadmin'`
+-- instead of calling can_bypass_rls() have drifted from it in both
+-- directions. 'admin' is NOT a valid users.role value (see check_users_role
+-- in 002_auth_tables.sql: only 'member' | 'superadmin' | 'developer'), so
+-- that branch never matched any real row — removing it changes nothing for
+-- existing behavior. All four also silently excluded 'developer', who
+-- can_bypass_rls() already grants conditional bypass everywhere else.
+-- Switching to can_bypass_rls() is a pure widening for 'developer' and an
+-- exact match for 'superadmin' — no regression, only fixes a gap:
+--   - users_metas_owner_or_admin_all   (003_user_metas.sql)
+--   - "API key owner or admin can do all" (004_api_key.sql)
+--   - "API logs superadmin can select"     (005_api_audit_log.sql)
+--   - "Plans superadmin write"             (012_billing_plans.sql)
+
+-- ============================================
+-- #108.1 — can_bypass_rls(): resolve System Admin Team by metadata flag
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.can_bypass_rls()
+RETURNS BOOLEAN AS $$
+DECLARE
+  current_user_id TEXT;
+  user_role TEXT;
+  admin_team_id TEXT;
+  is_system_admin_member BOOLEAN;
+BEGIN
+  current_user_id := public.get_auth_user_id();
+
+  SELECT role INTO user_role
+  FROM public."users"
+  WHERE id = current_user_id;
+
+  IF user_role = 'superadmin' THEN
+    RETURN TRUE;
+  END IF;
+
+  IF user_role = 'developer' THEN
+    -- The System Admin Team is whichever team has metadata.systemAdmin =
+    -- true, not a hardcoded id — each deployment can flag its own team.
+    SELECT id INTO admin_team_id
+    FROM public."teams"
+    WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+    LIMIT 1;
+
+    IF admin_team_id IS NULL THEN
+      RETURN FALSE;
+    END IF;
+
+    SELECT EXISTS(
+      SELECT 1 FROM public."team_members"
+      WHERE "userId" = current_user_id
+        AND "teamId" = admin_team_id
+    ) INTO is_system_admin_member;
+
+    RETURN is_system_admin_member;
+  END IF;
+
+  RETURN FALSE;
+END;
+$$ LANGUAGE plpgsql STABLE SECURITY DEFINER SET search_path = public;
+
+-- ============================================
+-- #108.2 — auto-enroll/unenroll on role change
+-- ============================================
+
+CREATE OR REPLACE FUNCTION public.sync_system_admin_team_membership()
+RETURNS TRIGGER
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+  admin_team_id TEXT;
+  new_team_role TEXT;
+BEGIN
+  SELECT id INTO admin_team_id
+  FROM public."teams"
+  WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+  LIMIT 1;
+
+  -- No team flagged as the System Admin Team in this deployment yet —
+  -- nothing to enroll into. Not an error: same as no bypass being possible.
+  IF admin_team_id IS NULL THEN
+    RETURN NEW;
+  END IF;
+
+  IF NEW.role IN ('developer', 'superadmin') THEN
+    new_team_role := CASE WHEN NEW.role = 'superadmin' THEN 'owner' ELSE 'admin' END;
+
+    INSERT INTO public."team_members" ("teamId", "userId", role)
+    VALUES (admin_team_id, NEW.id, new_team_role)
+    ON CONFLICT ("teamId", "userId") DO UPDATE SET role = EXCLUDED.role;
+
+  ELSIF TG_OP = 'UPDATE' AND OLD.role IN ('developer', 'superadmin') THEN
+    -- Role changed away from a bypass-eligible tier: revoke membership.
+    DELETE FROM public."team_members"
+    WHERE "teamId" = admin_team_id AND "userId" = NEW.id;
+  END IF;
+
+  RETURN NEW;
+END;
+$$;
+
+DROP TRIGGER IF EXISTS trg_sync_system_admin_team_membership ON public."users";
+CREATE TRIGGER trg_sync_system_admin_team_membership
+AFTER INSERT OR UPDATE OF role ON public."users"
+FOR EACH ROW
+EXECUTE FUNCTION public.sync_system_admin_team_membership();
+
+-- ============================================
+-- #108.3 — backfill existing developer/superadmin users
+-- ============================================
+
+DO $$
+DECLARE
+  admin_team_id TEXT;
+BEGIN
+  SELECT id INTO admin_team_id
+  FROM public."teams"
+  WHERE (metadata->>'systemAdmin')::boolean IS TRUE
+  LIMIT 1;
+
+  IF admin_team_id IS NOT NULL THEN
+    INSERT INTO public."team_members" ("teamId", "userId", role)
+    SELECT admin_team_id, u.id, CASE WHEN u.role = 'superadmin' THEN 'owner' ELSE 'admin' END
+    FROM public."users" u
+    WHERE u.role IN ('developer', 'superadmin')
+    ON CONFLICT ("teamId", "userId") DO UPDATE SET role = EXCLUDED.role;
+  END IF;
+END $$;
+
+-- ============================================
+-- #102 + siblings — switch drifted policies to can_bypass_rls()
+-- ============================================
+
+DROP POLICY IF EXISTS "users_metas_owner_or_admin_all" ON "users_metas";
+CREATE POLICY "users_metas_owner_or_admin_all" ON "users_metas"
+  FOR ALL
+  TO authenticated
+  USING ("userId" = public.get_auth_user_id() OR public.can_bypass_rls())
+  WITH CHECK ("userId" = public.get_auth_user_id() OR public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "API key owner or admin can do all" ON "api_key";
+CREATE POLICY "API key owner or admin can do all" ON "api_key"
+  FOR ALL TO authenticated
+  USING ("userId" = public.get_auth_user_id() OR public.can_bypass_rls())
+  WITH CHECK ("userId" = public.get_auth_user_id() OR public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "API logs superadmin can select" ON "api_audit_log";
+CREATE POLICY "API logs superadmin can select" ON "api_audit_log"
+  FOR SELECT TO authenticated
+  USING (public.can_bypass_rls());
+
+DROP POLICY IF EXISTS "Plans superadmin write" ON public."plans";
+CREATE POLICY "Plans superadmin write"
+ON public."plans"
+FOR ALL TO authenticated
+USING (public.can_bypass_rls())
+WITH CHECK (public.can_bypass_rls());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextsparkjs/core",
-  "version": "0.1.0-beta.185",
+  "version": "0.1.0-beta.187",
   "description": "NextSpark - The complete SaaS framework for Next.js",
   "license": "MIT",
   "author": "NextSpark <hello@nextspark.dev>",
@@ -50,10 +50,6 @@
     },
     "./globals.css": "./globals.css",
     "./theme-styles.css": "./theme-styles.css",
-    "./styles/ui.css": {
-      "style": "./dist/styles/ui.css",
-      "default": "./dist/styles/ui.css"
-    },
     "./styles/utilities.css": "./styles/utilities.css",
     "./styles/docs.css": "./styles/docs.css",
     "./lib/middleware": {
@@ -112,6 +108,14 @@
       "types": "./dist/lib/scheduled-actions/index.d.ts",
       "import": "./dist/lib/scheduled-actions/index.js"
     },
+    "./lib/scheduled-actions/handlers": {
+      "types": "./dist/lib/scheduled-actions/handlers/index.d.ts",
+      "import": "./dist/lib/scheduled-actions/handlers/index.js"
+    },
+    "./lib/auth/security-notifications": {
+      "types": "./dist/lib/auth/security-notifications/index.d.ts",
+      "import": "./dist/lib/auth/security-notifications/index.js"
+    },
     "./lib/permissions": {
       "types": "./dist/lib/permissions/index.d.ts",
       "import": "./dist/lib/permissions/index.js"
@@ -405,7 +409,7 @@
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
-    "@hookform/resolvers": "^5.2.1",
+    "@hookform/resolvers": "^5.9.1",
     "@inquirer/prompts": "^7.2.0",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@nextsparkjs/ui": "^0.1.0-beta.2",
@@ -468,21 +472,20 @@
     "remark-gfm": "^4.0.1",
     "remark-rehype": "^11.1.2",
     "resend": "^5.0.0",
-    "sharp": "^0.33.5",
+    "sharp": "^0.34.3 || ^0.35.3",
     "shiki": "^3.20.0",
     "sonner": "^2.0.7",
     "stripe": "^18.5.0",
     "tailwind-merge": "^3.3.1",
     "uuid": "^13.0.0",
-    "zod": "^4.1.5",
-    "@nextsparkjs/testing": "0.1.0-beta.185"
+    "zod": "^4.3.6",
+    "@nextsparkjs/testing": "0.1.0-beta.187"
   },
   "scripts": {
     "postinstall": "node scripts/postinstall.mjs || true",
-    "build": "tsup && pnpm build:dts && pnpm build:ui-css",
+    "build": "tsup && pnpm build:dts",
     "build:js": "tsup",
     "build:dts": "tsc -p tsconfig.dts.json || echo '⚠️  DTS generation completed with some type errors (partial coverage)'",
-    "build:ui-css": "node scripts/build/build-ui-css.mjs",
     "dev": "tsup --watch",
     "test": "jest",
     "test:watch": "jest --watch",

package/scripts/build/registry/__tests__/scope-registry.test.mjs

@@ -86,3 +86,21 @@ test('is a pure function of its output shape — always emits both SCOPE_CONFIG
   assert.match(out, /export const SCOPE_CONFIG: ScopeConfig = \{/)
   assert.match(out, /export const API_CONFIG: ApiConfig = \{/)
 })
+
+// Regression for the npm-mode bug: this generator hardcoded the two `@/core/*`
+// type-only imports instead of routing them through convertCorePath() like
+// every sibling generator does, so a scaffolded (non-monorepo) app's tsconfig
+// — which maps `@/*` to its own `./*`, not to core — failed `tsc --noEmit`
+// with TS2307 on both. See https://github.com/NextSpark-js/nextspark/issues/133
+test('monorepo mode (isNpmMode: false or unset): @/core/* type imports are left as-is', () => {
+  const out = generateScopeRegistry([], { isNpmMode: false })
+  assert.match(out, /import type \{ Permission \} from '@\/core\/lib\/permissions\/types'/)
+  assert.match(out, /import type \{ EntityConfig \} from '@\/core\/lib\/entities\/types'/)
+})
+
+test('npm mode: @/core/* type imports are converted to @nextsparkjs/core/*, like every sibling generator', () => {
+  const out = generateScopeRegistry([], { isNpmMode: true, outputDir: '/project/.nextspark/registries' })
+  assert.match(out, /import type \{ Permission \} from '@nextsparkjs\/core\/lib\/permissions\/types'/)
+  assert.match(out, /import type \{ EntityConfig \} from '@nextsparkjs\/core\/lib\/entities\/types'/)
+  assert.doesNotMatch(out, /from '@\/core\//)
+})

package/scripts/build/registry/generators/scope-registry.mjs

@@ -2,6 +2,12 @@
  * Scope Registry Generator
  *
  * Generates scope-registry.ts
+ */
+
+import { join } from 'path'
+import { convertCorePath } from '../config.mjs'
+
+/**
  *
  * IMPORTANT: unlike most registry generators, the role→scope computation does
  * NOT happen here at generation time. It happens at IMPORT TIME inside the
@@ -58,6 +64,7 @@ const SCOPE_RESTRICTIONS = {
  * @returns {string} Generated TypeScript content
  */
 export function generateScopeRegistry(entities, config) {
+  const outputFilePath = config.outputDir ? join(config.outputDir, 'scope-registry.ts') : 'scope-registry.ts'
   return `/**
  * Auto-generated API Scope Registry
  *
@@ -76,8 +83,8 @@ export function generateScopeRegistry(entities, config) {
 
 import { ENTITY_REGISTRY } from './entity-registry'
 import { AVAILABLE_ROLES, PERMISSIONS_BY_ROLE } from './permissions-registry'
-import type { Permission } from '@/core/lib/permissions/types'
-import type { EntityConfig } from '@/core/lib/entities/types'
+import type { Permission } from '${convertCorePath('@/core/lib/permissions/types', outputFilePath, config)}'
+import type { EntityConfig } from '${convertCorePath('@/core/lib/entities/types', outputFilePath, config)}'
 
 export interface ScopeConfig {
   base: string[]

package/templates/app/(auth)/signup/page.tsx

@@ -4,6 +4,7 @@ import { redirect } from 'next/navigation'
 import { SignupForm } from '@nextsparkjs/core/components/auth/forms/SignupForm'
 import { getTemplateOrDefault, getMetadataOrDefault } from '@nextsparkjs/core/lib/template-resolver'
 import { AUTH_CONFIG } from '@nextsparkjs/core/lib/config'
+import { resolveAuthMethods } from '@nextsparkjs/core/lib/auth/auth-methods'
 import { TeamService } from '@nextsparkjs/core/lib/services'
 
 // This page reads DB state (TeamService.hasGlobal) and redirect()s during render,
@@ -23,6 +24,13 @@ export const metadata: Metadata = getMetadataOrDefault(
 async function SignupPageContent() {
   const registrationMode = AUTH_CONFIG?.registration?.mode ?? 'open'
 
+  // Passwordless preset (no 'email-password' in auth.methods): the account is
+  // created by the first one-time-code sign-in, so there is no password signup
+  // form to show — send people to /login instead.
+  if (!resolveAuthMethods(AUTH_CONFIG).includes('email-password')) {
+    redirect('/login')
+  }
+
   // In invitation-only mode, allow the first user to register
   // (when no global team exists yet). Subsequent users need invitations.
   if (registrationMode === 'invitation-only') {

package/templates/app/(public)/[...slug]/page.tsx

@@ -13,7 +13,6 @@
  * 2. Falls back to default PageRenderer if no template
  */
 
-import { Suspense } from 'react'
 import { notFound } from 'next/navigation'
 import { query } from '@nextsparkjs/core/lib/db'
 import { PageRenderer } from '@nextsparkjs/core/components/public/pageBuilder'
@@ -249,9 +248,16 @@ export async function generateMetadata({
 }
 
 /**
- * Main catch-all page content (async, wrapped in Suspense by parent)
+ * Main catch-all page component
+ *
+ * Not wrapped in Suspense: this route's entire content depends on whether the
+ * slug resolves to a published item, so notFound() must be able to run before
+ * any part of the response commits to a 200. A Suspense boundary here would
+ * let Next.js flush the (null) fallback with a 200 status ahead of the
+ * DB-backed lookup, so a later notFound() inside the boundary could no longer
+ * change the status code — see #129.
  */
-async function DynamicPublicPageContent({
+export default async function DynamicPublicPage({
   params,
   searchParams,
 }: PageProps) {
@@ -378,14 +384,3 @@ async function DynamicPublicPageContent({
   // No match found
   notFound()
 }
-
-/**
- * Main catch-all page component — wraps async content in Suspense for PPR compatibility
- */
-export default function DynamicPublicPage(props: PageProps) {
-  return (
-    <Suspense fallback={null}>
-      <DynamicPublicPageContent {...props} />
-    </Suspense>
-  )
-}

package/templates/app/api/auth/[...all]/route.ts

@@ -9,6 +9,7 @@ import { TeamService } from "@nextsparkjs/core/lib/services";
 import { wrapAuthHandlerWithCors, handleCorsPreflightRequest, addCorsHeaders } from "@nextsparkjs/core/lib/api/helpers";
 import { checkDistributedRateLimit } from "@nextsparkjs/core/lib/api/rate-limit";
 import { withSignupContext } from "@nextsparkjs/core/lib/auth-context";
+import { dispatchSecurityNotificationsForRequest } from "@nextsparkjs/core/lib/auth/security-notifications";
 
 const handlers = toNextJsHandler(auth);
 
@@ -181,11 +182,32 @@ export async function POST(req: NextRequest) {
       ? (req.cookies.get('signup-intent')?.value || undefined)
       : undefined;
 
+  // Clone the request BEFORE the handler consumes its body. The
+  // security-notifications dispatcher (below) needs the original request's
+  // headers (UA/IP) and, for change-email, its body (newEmail) — but
+  // handlers.POST(req) reads req's body exactly once.
+  const securityReq = req.clone() as NextRequest;
+
   // Wrap with CORS headers for cross-origin requests (mobile apps, etc.)
-  return wrapAuthHandlerWithCors(
+  const response = await wrapAuthHandlerWithCors(
     signupIntent
       ? () => withSignupContext({ signupIntent }, () => handlers.POST(req))
       : () => handlers.POST(req),
     req
   );
+
+  // Built-in security email notifications (issue #75): after a successful
+  // sign-in / change-password / change-email, queue the matching security
+  // email. Guarded by AUTH_CONFIG.securityNotifications.enabled and wrapped in
+  // try/catch — a notification failure must NEVER change the auth response
+  // status (the dispatcher is itself best-effort, this is defense in depth).
+  if (AUTH_CONFIG.securityNotifications?.enabled) {
+    try {
+      await dispatchSecurityNotificationsForRequest(securityReq, response);
+    } catch (error) {
+      console.error("[auth] security-notifications dispatch error:", error);
+    }
+  }
+
+  return response;
 }

package/templates/app/api/health/route.ts

@@ -24,8 +24,10 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     timestamp: new Date().toISOString(),
   };
 
-  // Check if caller is authenticated for detailed info
-  const authResult = await authenticateRequest(request);
+  // Check if caller is authenticated for detailed info. Public endpoint: any
+  // valid API key (whatever its scopes) may see the detailed status, so the
+  // scope-agnostic opt-out is explicit here (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true });
   const isAuthenticated = authResult.success && authResult.user;
 
   if (!isAuthenticated) {

package/templates/app/api/internal/user-metadata/route.ts

@@ -1,14 +1,16 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { MetaService } from '@nextsparkjs/core/lib/services/meta.service'
 import { withRateLimitTier } from '@nextsparkjs/core/lib/api/rate-limit'
-import { authenticateRequest } from '@nextsparkjs/core/lib/api/auth/dual-auth'
+import { authenticateRequest, createAuthFailureResponse } from '@nextsparkjs/core/lib/api/auth/dual-auth'
 
 // Endpoint interno para crear metadata default después del signup
 export const POST = withRateLimitTier(async (req: NextRequest) => {
   try {
-    const authResult = await authenticateRequest(req)
+    // The API-key scope is declared at the entry point, which fails closed
+    // for keys that lack it (#93).
+    const authResult = await authenticateRequest(req, { requiredScope: 'users:write' })
     if (!authResult.success || !authResult.user) {
-      return NextResponse.json({ error: 'Authentication required' }, { status: 401 })
+      return createAuthFailureResponse(authResult)
     }
 
     const body = await req.json()

package/templates/app/api/mcp/route.ts

@@ -106,7 +106,10 @@ async function handleMcpPost(request: NextRequest): Promise<NextResponse> {
     return jsonRpcError(403, -32000, 'Origin not allowed')
   }
 
-  const authResult = await authenticateRequest(request)
+  // Transport-level auth only: per-tool scopes (`<entity>:read/write/delete`)
+  // are enforced by the generic entity handlers the executor invokes for each
+  // tool call, so this entry point accepts any valid key explicitly (#93).
+  const authResult = await authenticateRequest(request, { allowAnyScope: true })
   if (!authResult.success || authResult.type !== 'api-key' || !authResult.user) {
     return jsonRpcError(401, -32001, API_KEY_HELP)
   }

package/templates/app/api/superadmin/subscriptions/route.ts

@@ -230,6 +230,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
     const totalPages = Math.ceil(total / limit);
 
     // Format subscriptions
+    const billingGateway = await getBillingGateway()
     const subscriptions = subscriptionsResult.map(sub => ({
       id: sub.id,
       team: {
@@ -257,7 +258,7 @@ export const GET = withRateLimitTier(async (request: NextRequest) => {
       cancelAtPeriodEnd: sub.cancelAtPeriodEnd,
       externalSubscriptionId: sub.externalSubscriptionId,
       paymentProvider: sub.paymentProvider,
-      providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(sub.externalSubscriptionId),
+      providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(sub.externalSubscriptionId),
       createdAt: sub.createdAt
     }));
 

package/templates/app/api/superadmin/teams/[teamId]/route.ts

@@ -204,6 +204,7 @@ export const GET = withRateLimitTier(async (
     const subscription = subscriptionResult[0] || null;
 
     // Prepare response data
+    const billingGateway = subscription ? await getBillingGateway() : null
     const responseData = {
       team: {
         id: team.id,
@@ -225,7 +226,7 @@ export const GET = withRateLimitTier(async (
         role: member.role,
         joinedAt: member.joinedAt
       })),
-      subscription: subscription ? {
+      subscription: subscription && billingGateway ? {
         id: subscription.id,
         plan: {
           id: subscription.planId,
@@ -246,8 +247,8 @@ export const GET = withRateLimitTier(async (
         externalSubscriptionId: subscription.externalSubscriptionId,
         externalCustomerId: subscription.externalCustomerId,
         paymentProvider: subscription.paymentProvider,
-        providerName: getBillingGateway().getProviderName(),
-        providerDashboardUrl: getBillingGateway().getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
+        providerName: billingGateway.getProviderName(),
+        providerDashboardUrl: billingGateway.getSubscriptionDashboardUrl(subscription.externalSubscriptionId),
         createdAt: subscription.createdAt
       } : null,
       billingHistory: billingEventsResult.map((event) => ({

package/templates/app/api/superadmin/users/[userId]/route.ts

@@ -129,11 +129,18 @@ export const GET = withRateLimitTier(async (request: NextRequest, { params }: Ro
       ORDER BY "metaKey"
     `;
 
-    // Execute all queries in parallel
+    // Execute all queries in parallel.
+    //
+    // The team_members queries run on the service (RLS-bypass) pool: team_members
+    // has no superadmin/developer bypass policy, so with the acting admin's own
+    // id as RLS context the SELECT policy silently ANDs "teams the actor belongs
+    // to" on top of WHERE "userId" = $1 and under-reports multi-team users.
+    // Authorization is already enforced above (superadmin/developer role check)
+    // and the WHERE clause scopes the rows to the subject user.
     const [userResults, teamsResults, countsResults, metasResults] = await Promise.all([
       queryWithRLS(userQuery, [userId], session.user.id) as Promise<UserResult[]>,
-      queryWithRLS(teamsQuery, [userId], session.user.id) as Promise<TeamMembershipResult[]>,
-      queryWithRLS(countsQuery, [userId], session.user.id) as Promise<{
+      queryWithRLS(teamsQuery, [userId], session.user.id, { service: true }) as Promise<TeamMembershipResult[]>,
+      queryWithRLS(countsQuery, [userId], session.user.id, { service: true }) as Promise<{
         totalTeams: number;
         ownedTeams: number;
       }[]>,