From a14f7138a121f933f55f803c5081d7860983eca9 Mon Sep 17 00:00:00 2001
From: Mike Cao <mike@umami.is>
Date: Sun, 13 Sep 2026 12:08:01 -0700
Subject: [PATCH] Exclude deleted teams from access and invalidate join codes

---
 src/app/api/teams/join/route.ts | 1 +
 src/permissions/website.ts      | 1 +
 src/queries/prisma/team.ts      | 1 +
 src/queries/prisma/teamUser.ts  | 1 +
 4 files changed, 4 insertions(+)

diff --git a/src/app/api/teams/join/route.ts b/src/app/api/teams/join/route.ts
index 3ce0913f7..b74f4fb23 100644
--- a/src/app/api/teams/join/route.ts
+++ b/src/app/api/teams/join/route.ts
@@ -20,6 +20,7 @@ export async function POST(request: Request) {
   const team = await findTeam({
     where: {
       accessCode,
+      deletedAt: null,
     },
   });
 
diff --git a/src/permissions/website.ts b/src/permissions/website.ts
index c01c3d70d..3a35f354a 100644
--- a/src/permissions/website.ts
+++ b/src/permissions/website.ts
@@ -94,6 +94,7 @@ export async function canViewBatchWebsites({ user, shareToken }: Auth, websiteId
           teamId: {
             in: teamIds,
           },
+          team: { deletedAt: null },
         },
         select: {
           teamId: true,
diff --git a/src/queries/prisma/team.ts b/src/queries/prisma/team.ts
index 00c16718a..f35e73955 100644
--- a/src/queries/prisma/team.ts
+++ b/src/queries/prisma/team.ts
@@ -193,6 +193,7 @@ export async function deleteTeam(teamId: string) {
       client.team.update({
         data: {
           deletedAt: new Date(),
+          accessCode: null,
         },
         where: {
           id: teamId,
diff --git a/src/queries/prisma/teamUser.ts b/src/queries/prisma/teamUser.ts
index 4f4027d67..87718374b 100644
--- a/src/queries/prisma/teamUser.ts
+++ b/src/queries/prisma/teamUser.ts
@@ -21,6 +21,7 @@ export async function getTeamUser(teamId: string, userId: string) {
     where: {
       teamId,
       userId,
+      team: { deletedAt: null },
     },
   });
 }