fix(teams): preserve user direct access when deleting a team [BE-13303] (#3356)

api/http/handler/teams/team_delete.go

@@ -57,7 +57,7 @@ func (handler *Handler) teamDelete(w http.ResponseWriter, r *http.Request) *http
 	}
 
 	if err := handler.DataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
-		return handler.removeTeamAccessPolicies(tx, portainer.TeamID(teamID), memberships)
+		return handler.removeTeamAccessPolicies(tx, portainer.TeamID(teamID))
 	}); err != nil {
 		return httperror.InternalServerError("Unable to clean-up team access policies", err)
 	}
@@ -70,7 +70,7 @@ func (handler *Handler) teamDelete(w http.ResponseWriter, r *http.Request) *http
 	return response.Empty(w)
 }
 
-func (handler *Handler) removeTeamAccessPolicies(tx dataservices.DataStoreTx, teamID portainer.TeamID, memberships []portainer.TeamMembership) error {
+func (handler *Handler) removeTeamAccessPolicies(tx dataservices.DataStoreTx, teamID portainer.TeamID) error {
 	endpoints, err := tx.Endpoint().Endpoints()
 	if err != nil {
 		return err
@@ -82,22 +82,6 @@ func (handler *Handler) removeTeamAccessPolicies(tx dataservices.DataStoreTx, te
 		}
 
 		delete(ep.TeamAccessPolicies, teamID)
-		for _, m := range memberships {
-			otherMemberships, err := tx.TeamMembership().TeamMembershipsByUserID(m.UserID)
-			if err != nil {
-				return err
-			}
-			hasOtherTeamAccess := false
-			for _, om := range otherMemberships {
-				if _, ok := ep.TeamAccessPolicies[om.TeamID]; ok {
-					hasOtherTeamAccess = true
-					break
-				}
-			}
-			if !hasOtherTeamAccess {
-				delete(ep.UserAccessPolicies, m.UserID)
-			}
-		}
 		if err := tx.Endpoint().UpdateEndpoint(ep.ID, ep); err != nil {
 			return err
 		}

api/http/handler/teams/team_delete_test.go

@@ -60,7 +60,7 @@ func TestTeamDelete_removesTeamFromEndpointAccessPolicies(t *testing.T) {
 		assert.False(t, stillPresent, "deleted team must be removed from endpoint TeamAccessPolicies")
 	})
 
-	t.Run("team with member has both team and user policies removed", func(t *testing.T) {
+	t.Run("team member's direct user access policy survives team deletion", func(t *testing.T) {
 		t.Parallel()
 
 		_, store := datastore.MustNewTestStore(t, true, true)
@@ -102,7 +102,7 @@ func TestTeamDelete_removesTeamFromEndpointAccessPolicies(t *testing.T) {
 		assert.False(t, teamStillPresent, "deleted team must be removed from endpoint TeamAccessPolicies")
 
 		_, userStillPresent := updated.UserAccessPolicies[user.ID]
-		assert.False(t, userStillPresent, "team member must be removed from endpoint UserAccessPolicies")
+		assert.True(t, userStillPresent, "team member's own direct access policy must survive team deletion")
 	})
 
 	t.Run("team member in another team retains user access policy", func(t *testing.T) {