security(teams): /teams handlers still read the global users.role_id and resolve the caller by token id

[alex-dembele]

Problem

The seven /teams handlers (backend/internal/handler/team_handler.go, lines 61-67, 109-115, 151-157, 204-210, 259-265, 296-302, 362-368) repeat an in-handler admin check that reads the global users.role_id (currentUser.Role.Name != "admin"). #807 removed the same pattern from /users.

Today that check is never reached. The handlers look the caller up with claims.ID, which is the JWT id, not the user id (claims.Sub). So every /teams call answers 404 "User not found" before the role is read. RequireRole("admin") already guards the routes (cmd/server/main.go, --- Team Management ---). No frontend code calls /teams.

Removing the check would switch on a feature nobody has reviewed for tenant isolation. AddTeamMember in particular takes a userId from the path and does not visibly check that user's membership in the caller's tenant. So the check was left in place in #807, and this issue decides what happens next.

Acceptance criteria

1. Decide whether /teams is kept. If it is not, remove the routes and handlers, and remove them from docs/openapi.yaml if they are listed there.
2. If kept: no handler reads users.role_id. Authorization is the route guard or the membership role, and the caller is resolved from claims.Sub.
3. If kept: AddTeamMember refuses a user who is not an active member of the caller's tenant, and answers 404 for them exactly as it does for an unknown id.
4. CLAUDE.md rule 4 tests: Success, NotFound (foreign or unknown) and Unauthorized (non-admin gets 403).

Definition of Done

grep -n 'Role.Name != "admin"' backend/internal/handler/ returns nothing, and the tests for criteria 3-4 pass.

Found while working #807.

[alex-dembele]

backend — 2026-09-29

Done — PR #844, branch security/830-teams-global-role. The module is kept and fixed, not removed (reasoning in the PR). internal/handler/team_handler.go: the 7 users.role_id checks are removed, and authorization is RequireRole("admin") on the session. AddTeamMember requires an active membership and answers the same 404 for foreign, withdrawn, unknown and malformed ids. DeleteTeam runs in a transaction. Ids are set explicitly. Tests are in internal/handler/team_handler_test.go, and the registry evidence is updated in internal/security/isolation/registry.go.
Verified — go test ./internal/handler/ -run TestTeam -v → Success, NotFound, Unauthorized and TenantIsolationPredicate all PASS. The three new tests FAIL against the old handler. go test ./internal/security/... ./internal/handler/... ./internal/service/... ./cmd/... → all ok.
Criteria — 1 ✅ (kept) · 2 ✅ · 3 ✅ · 4 ✅
Next — Owner review and merge of #844. The DoD grep is empty once #832 is merged as well.
Blocked on — nothing