From e6507746297182e66a8c54a615810bf4e39fa471 Mon Sep 17 00:00:00 2001
From: Owen <owen@txv.io>
Date: Wed, 28 Oct 2026 10:07:52 -0400
Subject: [PATCH] Fix api key lockout on getting users

---
 server/routers/user/getOrgUser.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/server/routers/user/getOrgUser.ts b/server/routers/user/getOrgUser.ts
index 34732b8d8..974f77fc6 100644
--- a/server/routers/user/getOrgUser.ts
+++ b/server/routers/user/getOrgUser.ts
@@ -117,7 +117,9 @@ export async function getOrgUser(
 
         const { orgId, userId } = parsedParams.data;
 
-        if (!req.userOrg) {
+        // API keys never have a userOrg; their org access and action are
+        // already checked by verifyApiKeyOrgAccess / verifyApiKeyHasAction
+        if (req.user && !req.userOrg) {
             return next(
                 createHttpError(
                     HttpCode.FORBIDDEN,
@@ -150,7 +152,7 @@ export async function getOrgUser(
             );
         }
 
-        if (req.user && user.userId !== req.userOrg.userId) {
+        if (req.user && user.userId !== req.user.userId) {
             const hasPermission = await checkUserActionPermission(
                 ActionsEnum.getOrgUser,
                 req