fix: shared filter returns all when user has no team

When user.team_id is None, `WHERE team_id == None` matches all
personal templates. Return empty set instead when user has no team.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
chihlasm
2026-03-27 19:58:04 +00:00
parent c3f0370964
commit 1425b843a9

View File

@@ -5,7 +5,7 @@ import re
from fastapi import APIRouter, Depends, HTTPException, Query, status
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy import select, func, or_
from sqlalchemy import select, func, or_, literal
from app.core.database import get_db
from app.api.deps import get_current_active_user
@@ -122,7 +122,10 @@ async def list_templates(
query = query.where(ScriptTemplate.created_by == current_user.id)
if shared:
query = query.where(ScriptTemplate.team_id == current_user.team_id)
if current_user.team_id is None:
query = query.where(literal(False))
else:
query = query.where(ScriptTemplate.team_id == current_user.team_id)
result = await db.execute(query.order_by(ScriptTemplate.name))
templates = result.scalars().all()