Summary

PRIVATE projects are visible to all INTERNAL users regardless of membership, violating PRIVATE visibility semantics.

Steps to Reproduce

1. Create a PRIVATE project (e.g. Demo-Tigase-Helm-Charts, id=1)
2. Add no members to the project
3. Log in as any INTERNAL user who is not the project owner (e.g. rk)
4. Navigate to the project list

Expected Behavior

PRIVATE project should not appear in the project list for INTERNAL users who are not members or the owner. Direct URL access should also be denied.

Actual Behavior

PRIVATE project (Demo-Tigase-Helm-Charts) appears in the project list for rk (INTERNAL), who has no membership and is not the owner (owner: artur).

Evidence

• projects.id=1, visibility=PRIVATE, owner_id=artur
• project_members for project_id=1 returns 0 rows
• rk is visible in project list when logged in as rk

Root Cause (suspected)

ExternalUserPolicy correctly filters external users (SZ-127 fix) but the same membership filter is not applied to INTERNAL users for PRIVATE projects. INTERNAL users appear to see all projects regardless of visibility level.

Affected Components

• ExternalUserPolicy or equivalent authorization filter
• Project list query / repository method (findProjectsByMember or equivalent)

Severity

High severity because PRIVATE project confidentiality is broken for all INTERNAL users