From 9631d0a64b0d2d11f32b3cff8737ef40129d1ec2 Mon Sep 17 00:00:00 2001
From: Morgan <33722304+ThyMinimalDev@users.noreply.github.com>
Date: Mon, 8 Dec 2025 05:48:15 +0200
Subject: [PATCH] chore: update add members to team (#25685)

---
 .../ee/teams/repositories/TeamRepository.ts      | 11 +++++++++++
 .../server/routers/viewer/organizations/utils.ts | 16 ++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/packages/features/ee/teams/repositories/TeamRepository.ts b/packages/features/ee/teams/repositories/TeamRepository.ts
index a949d0fa3f..3d9a320e04 100644
--- a/packages/features/ee/teams/repositories/TeamRepository.ts
+++ b/packages/features/ee/teams/repositories/TeamRepository.ts
@@ -588,4 +588,15 @@ export class TeamRepository {
     const action = permission.substring(lastDotIndex + 1);
     return { resource, action };
   }
+
+  async findTeamsNotBelongingToOrgByIds({ teamIds, orgId }: { teamIds: number[]; orgId: number }) {
+    return await this.prismaClient.team.findMany({
+      where: {
+        id: { in: teamIds },
+        NOT: {
+          parentId: orgId, // Finds any team whose orgId is NOT the target ID
+        },
+      },
+    });
+  }
 }
diff --git a/packages/trpc/server/routers/viewer/organizations/utils.ts b/packages/trpc/server/routers/viewer/organizations/utils.ts
index ef3cbfd2f3..2c36d0376c 100644
--- a/packages/trpc/server/routers/viewer/organizations/utils.ts
+++ b/packages/trpc/server/routers/viewer/organizations/utils.ts
@@ -1,3 +1,4 @@
+import { TeamRepository } from "@calcom/ee/teams/repositories/TeamRepository";
 import { updateNewTeamMemberEventTypes } from "@calcom/features/ee/teams/lib/queries";
 import { PermissionCheckService } from "@calcom/features/pbac/services/permission-check.service";
 import { prisma } from "@calcom/prisma";
@@ -17,6 +18,21 @@ interface AddBulkToTeamProps {
 export const addMembersToTeams = async ({ user, input }: AddBulkToTeamProps) => {
   if (!user.organizationId) throw new TRPCError({ code: "UNAUTHORIZED" });
 
+  const teamRepository = new TeamRepository(prisma);
+  const teamsNotBelongingToOrg = await teamRepository.findTeamsNotBelongingToOrgByIds({
+    teamIds: input.teamIds,
+    orgId: user.organizationId,
+  });
+
+  if (teamsNotBelongingToOrg.length > 0) {
+    throw new TRPCError({
+      code: "BAD_REQUEST",
+      message: `One or more teams do not belong to your organization: ${teamsNotBelongingToOrg
+        .map((team) => team.id)
+        .join(", ")}`,
+    });
+  }
+
   // Check if user has permission to invite team members in the organization
   const permissionCheckService = new PermissionCheckService();
   const hasPermission = await permissionCheckService.checkPermission({