fix

apps/api/internal/httpapi/middleware.go

@@ -66,8 +66,9 @@ func requireCompanyAdmin(w http.ResponseWriter, r *http.Request) bool {
 	return false
 }
 
-// allowCompanyAdminOrPlatform allows company admins, API keys, or platform admins.
+// allowCompanyAdminOrPlatform allows company admins, API keys, company owners, or platform admins.
 // Platform admins can manage team after migration when all memberships are still "member".
+// Company owners (owner_user_id) keep team powers even when membership role is member.
 func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Request) bool {
 	if CompanyAdminAllowed(r.Context()) {
 		return true
@@ -85,6 +86,14 @@ func (s *Server) allowCompanyAdminOrPlatform(w http.ResponseWriter, r *http.Requ
 	if isAdmin {
 		return true
 	}
+	isOwner, err := s.checkCompanyOwner(r.Context(), uid)
+	if err != nil {
+		Error(w, http.StatusInternalServerError, "authorization check failed")
+		return false
+	}
+	if isOwner {
+		return true
+	}
 	Error(w, http.StatusForbidden, "admin required")
 	return false
 }
@@ -424,6 +433,18 @@ func (s *Server) checkPlatformAdmin(ctx context.Context, userID uuid.UUID) (bool
 	return s.Auth.IsPlatformAdmin(ctx, userID)
 }
 
+// checkCompanyOwner prefers an optional test hook, otherwise Auth.IsCompanyOwner.
+func (s *Server) checkCompanyOwner(ctx context.Context, userID uuid.UUID) (bool, error) {
+	if s != nil && s.testCompanyOwner != nil {
+		return s.testCompanyOwner(ctx, userID)
+	}
+	cid, ok := CompanyIDFromContext(ctx)
+	if !ok || s == nil || s.Auth == nil || s.Auth.Pool == nil {
+		return false, nil
+	}
+	return s.Auth.IsCompanyOwner(ctx, cid, userID)
+}
+
 // checkStaffAccess prefers test hooks, otherwise Auth.GetStaffAccess.
 func (s *Server) checkStaffAccess(ctx context.Context, userID uuid.UUID) (auth.StaffAccess, error) {
 	if s != nil && s.testStaffAccess != nil {