From df9f1555b30a0eb5b118dcad80a7c4564a473686 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 28 Sep 2026 11:02:19 +0200
Subject: [PATCH] fix(auth): keep the current team only in the session

Login, registration and OAuth set a currentTeam attribute on the user model
that is not a database column, so a save of the user in the same request
would fail. Keep the team in the session and read it with currentTeam().

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/Actions/Fortify/CreateNewUser.php    | 2 +-
 app/Providers/FortifyServiceProvider.php | 8 ++++----
 app/Services/Auth/OauthLoginService.php  | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/app/Actions/Fortify/CreateNewUser.php b/app/Actions/Fortify/CreateNewUser.php
index c69863c572..f24b9699f2 100644
--- a/app/Actions/Fortify/CreateNewUser.php
+++ b/app/Actions/Fortify/CreateNewUser.php
@@ -81,7 +81,7 @@ class CreateNewUser implements CreatesNewUsers
             }
         }
         // Set session variable
-        session(['currentTeam' => $user->currentTeam = $team]);
+        session(['currentTeam' => $team]);
 
         return $user;
     }
diff --git a/app/Providers/FortifyServiceProvider.php b/app/Providers/FortifyServiceProvider.php
index 6426860187..50df845f7b 100644
--- a/app/Providers/FortifyServiceProvider.php
+++ b/app/Providers/FortifyServiceProvider.php
@@ -27,7 +27,7 @@ class FortifyServiceProvider extends ServiceProvider
             public function toResponse($request)
             {
                 // First user (root) will be redirected to /settings instead of / on registration.
-                if ($request->user()->currentTeam->id === 0) {
+                if ($request->user()->currentTeam()?->id === 0) {
                     return redirect()->route('settings.index');
                 }
 
@@ -88,9 +88,9 @@ class FortifyServiceProvider extends ServiceProvider
                     if (! $user->teams()->where('team_id', $invitation->team->id)->exists()) {
                         $user->teams()->attach($invitation->team->id, ['role' => $invitation->role]);
                     }
-                    $user->currentTeam = $invitation->team;
+                    $team = $invitation->team;
                     $invitation->delete();
-                    session(['currentTeam' => $user->currentTeam]);
+                    session(['currentTeam' => $team]);
                 } else {
                     // Restore the last active team; only fall back when unambiguous.
                     $team = $user->resolveStoredTeam();
@@ -98,7 +98,7 @@ class FortifyServiceProvider extends ServiceProvider
                         $team = $user->recreate_personal_team();
                     }
                     if ($team) {
-                        session(['currentTeam' => $user->currentTeam = $team]);
+                        session(['currentTeam' => $team]);
                     }
                     // Otherwise (multiple teams, no stored choice) leave the session
                     // team unset so the user is sent to the team-selection screen.
diff --git a/app/Services/Auth/OauthLoginService.php b/app/Services/Auth/OauthLoginService.php
index 761b6a8ccb..5915b0cd8a 100644
--- a/app/Services/Auth/OauthLoginService.php
+++ b/app/Services/Auth/OauthLoginService.php
@@ -29,7 +29,7 @@ class OauthLoginService
             : $this->resolveOauthUser($oauthUser, $oauthSetting, $email);
 
         $team = $user->currentTeam() ?? $user->teams()->first() ?? $user->recreate_personal_team();
-        session(['currentTeam' => $user->currentTeam = $team]);
+        session(['currentTeam' => $team]);
 
         if ($this->requiresTwoFactorChallenge($user)) {
             Auth::logout();