fix: getTeamIdsWithPermission return sub teams

[sean-brydon]

What does this PR do?

Pr fixes the issue where getTeamIdsWithPermissions would only return the direct teamId queried permission if it exist and did not count the org Id if they had the permission granted in the parent TeamId

[sean-brydon]

ParentID

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (all 1 issues)

Understand the root cause of the following 1 issues and fix them.


<file name="packages/features/pbac/infrastructure/repositories/PermissionRepository.ts">

<violation number="1" location="packages/features/pbac/infrastructure/repositories/PermissionRepository.ts:326">
PBAC-disabled fallback filtering is applied to the parent org instead of the child team, so PBAC-enabled child teams can be unlocked via fallback roles. Ensure the NOT EXISTS check inspects the child team’s feature flag.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[github-actions]

E2E results are ready!

• Workflow #90137.1 latest results

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
cal-companion	Error			Dec 1, 2025 4:01pm

2 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
cal	Ignored			Dec 1, 2025 4:01pm
cal-eu	Ignored			Dec 1, 2025 4:01pm

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (all 2 issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/features/pbac/services/__tests__/permission-check.service.test.ts">

<violation number="1" location="packages/features/pbac/services/__tests__/permission-check.service.test.ts:558">
The new “PBAC permissions” test is a duplicate of the fallback-role test, so it does not verify PBAC behavior and will never fail if PBAC support breaks. Please rewrite it to exercise PBAC-specific logic (or drop it) instead of duplicating the previous test.</violation>
</file>

<file name="packages/features/pbac/infrastructure/repositories/PermissionRepository.ts">

<violation number="1" location="packages/features/pbac/infrastructure/repositories/PermissionRepository.ts:326">
Child fallback role query only checks the parent org’s PBAC flag, so PBAC-enabled child teams become accessible via fallback roles, bypassing PBAC safeguards.</violation>
</file>

_{Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR}

[cubic-dev-ai]

The new “PBAC permissions” test is a duplicate of the fallback-role test, so it does not verify PBAC behavior and will never fail if PBAC support breaks. Please rewrite it to exercise PBAC-specific logic (or drop it) instead of duplicating the previous test.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/features/pbac/services/__tests__/permission-check.service.test.ts, line 558:

<comment>The new “PBAC permissions” test is a duplicate of the fallback-role test, so it does not verify PBAC behavior and will never fail if PBAC support breaks. Please rewrite it to exercise PBAC-specific logic (or drop it) instead of duplicating the previous test.</comment>

<file context>
@@ -534,6 +534,46 @@ describe(&quot;PermissionCheckService&quot;, () =&gt; {
+      });
+    });
+
+    it(&quot;should include child teams where user has org-level PBAC permissions&quot;, async () =&gt; {
+      // User has PBAC permission in org (teamId: 100) but not in child team (teamId: 1)
+      // Should get access to child team via org-level PBAC permission
</file context>

✅ Addressed in 381c1b8