fix: use check_db_only=True in _assert_can_manage_team_mcp_server

Cached team objects may have stale object_permission data. Bypassing
cache ensures the server-in-team check uses fresh data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
yuneng-jiang 2026-03-19 23:00:38 -07:00
parent 6c06e6dc80
commit dfc4401e1c

View file

@ -179,7 +179,7 @@ if MCP_AVAILABLE:
team_id=resolved_team_id,
prisma_client=prisma_client,
user_api_key_cache=user_api_key_cache,
check_db_only=False,
check_db_only=True, # bypass cache to get fresh object_permission
)
if not _is_user_team_mcp_manager(user_api_key_dict, team_obj):