Summary

Keep /api/v1/meta-all scoped to the JWT's active team (one team per partition), but make the matching robust against team.settings.partition drift.

A team now matches the JWT partition claim if either:

• team.name === partition — canonical, set at team creation by deriveTeamName(email, partition)
• team.settings.partition === partition — soft, back-compat for teams that set it explicitly without changing the name

Either alone is sufficient. Same scope semantics as before (single partition's team), just no longer brittle on the soft setting.

Also threads team.name through the findUser GraphQL projection so the match has the canonical field available.

Why

Real-world failure mode caught while debugging Tychi → cube_list end-to-end:

• A team named blue.is had settings.partition left at "bluecar.is" after a copy/migration.
• The user was a member-owner of blue.is. Request-time defineUserScope would have accepted any cube on it.
• But meta-all returned { datasources: [] } because the soft setting didn't agree with the JWT partition "blue.is" — so the catalog was empty, the cube_list MCP tool returned no datasources, and the agent truthfully reported "no cubes" with nothing to query.

Symmetric: any user who can pass runtime auth on their team's cubes should see those cubes in the catalog. The team-name match makes that the case for the typical setup, and the soft-setting match keeps existing explicit configurations working.

What's not changed

• Still single-team-per-JWT scoping (no cross-team aggregation).
• No change to per-cube visibility (cube public, member-role access_list).
• Other routes that share resolvePartitionTeamIds (deleteDataschema, versionDiff, refreshCompiler, discover) are untouched.

Test plan

• Local: [email protected] JWT (partition=blue.is), curl https://dbx.fraios.dev/api/v1/meta-all → returns blue.is's 2 datasources (was empty before).
• Local: a JWT with a partition that matches no team for the user → returns { datasources: [] } as before.
• Local: a JWT for a team whose settings.partition matches but name doesn't → still returns that team's datasources (back-compat).
• Local: end-to-end Tychi cube_list returns the cubes in the active partition.

🤖 Generated with Claude Code