From bfcb6dcead1315c555ced6746051c438afbf9bad Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Fri, 4 Sep 2026 03:14:28 +0300
Subject: [PATCH 1/8] fix: allow members to upload files

---
 src/Analysim.Web/Controllers/ProjectController.cs | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index 010e350c..7490cca2 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -2258,13 +2258,16 @@ public async Task<IActionResult> UploadFile([FromForm] ProjectFileUploadVM formd
                 var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
-                bool isOwner = await _dbContext.Projects
+                bool hasUploadAccess = await _dbContext.Projects
                      .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                         aup.User.Id == user.Id &&
-                         aup.Project.ProjectID == formdata.ProjectID &&
-                         aup.UserRole == "owner"));
+                         aup.UserID == user.Id &&
+                         aup.ProjectID == formdata.ProjectID &&
+                         (aup.UserRole == "owner" || aup.UserRole == "member")));
 
-                if (!isOwner) return Unauthorized(new { message = "You are not the owner of the project" });
+                if (!hasUploadAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 if (formdata.Directory == null) { formdata.Directory = ""; }

From 6253d77fbd379c3fc249452be738146ae6eb5921 Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Fri, 4 Sep 2026 03:16:12 +0300
Subject: [PATCH 2/8] fix: allow member folder creation

---
 .../Controllers/ProjectController.cs          | 26 ++++++++++++-------
 1 file changed, 16 insertions(+), 10 deletions(-)

diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index 7490cca2..bad7a326 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -2694,13 +2694,16 @@ public async Task<IActionResult> CreateFolder([FromForm] FolderUploadProfileView
                 var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
-                bool isOwner = await _dbContext.Projects
+                bool hasFolderAccess = await _dbContext.Projects
                     .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                        aup.User.Id == user.Id &&
-                        aup.Project.ProjectID == formdata.ProjectID &&
-                        aup.UserRole == "owner"));
+                        aup.UserID == user.Id &&
+                        aup.ProjectID == formdata.ProjectID &&
+                        (aup.UserRole == "owner" || aup.UserRole == "member")));
 
-                if (!isOwner)   return Unauthorized(new { message = "You are not the owner of the project" });
+                if (!hasFolderAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 if (formdata.Directory == null) { formdata.Directory = ""; }
@@ -2766,13 +2769,16 @@ public async Task<IActionResult> CreateNotebookFolder([FromForm] FolderUploadPro
                 var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
-                bool isOwner = await _dbContext.Projects
+                bool hasFolderAccess = await _dbContext.Projects
                     .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                        aup.User.Id == user.Id &&
-                        aup.Project.ProjectID == formdata.ProjectID &&
-                        aup.UserRole == "owner"));
+                        aup.UserID == user.Id &&
+                        aup.ProjectID == formdata.ProjectID &&
+                        (aup.UserRole == "owner" || aup.UserRole == "member")));
 
-                if (!isOwner) return Unauthorized(new { message = "You are not the owner of the project" });
+                if (!hasFolderAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 if (formdata.Directory == null) { formdata.Directory = ""; }

From eba854f3f0ea46cfeee091d29ba7a9d73cf8ac5c Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Fri, 4 Sep 2026 03:50:25 +0300
Subject: [PATCH 3/8] fix: use authenticated user ID when creating folders

---
 src/Analysim.Web/Controllers/ProjectController.cs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index bad7a326..9f0f0598 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -2727,7 +2727,7 @@ public async Task<IActionResult> CreateFolder([FromForm] FolderUploadProfileView
                     Uri = "",
                     DateCreated = DateTimeOffset.UtcNow,
                     LastModified = DateTimeOffset.UtcNow,
-                    UserID = formdata.UserID,
+                    UserID = user.Id,
                     ProjectID = formdata.ProjectID
                 };
 

From f34ff2a2542c6f40a12a0681c600de75e569d789 Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Fri, 4 Sep 2026 04:05:03 +0300
Subject: [PATCH 4/8] fix: project member list display

---
 .../ClientApp/src/app/application-pipes/custom.pipe.ts      | 6 +++++-
 .../modal-member-list/modal-member-list.component.html      | 2 +-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/Analysim.Web/ClientApp/src/app/application-pipes/custom.pipe.ts b/src/Analysim.Web/ClientApp/src/app/application-pipes/custom.pipe.ts
index ba102a2a..51b6ac69 100644
--- a/src/Analysim.Web/ClientApp/src/app/application-pipes/custom.pipe.ts
+++ b/src/Analysim.Web/ClientApp/src/app/application-pipes/custom.pipe.ts
@@ -113,10 +113,14 @@ export class ProjectMemberPipe implements PipeTransform {
                 return projectUsers.filter(x => {
                     return x.userRole == "member"
                 })
+            case "allMembers":
+                return projectUsers.filter(x => {
+                    return x.userRole == "owner" || x.userRole == "admin" || x.userRole == "member"
+                })
             default:
                 return projectUsers.filter(x => {
                     return x.userRole == "member" || x.userRole == "admin"
                 })
         }
     }
-}
\ No newline at end of file
+}
diff --git a/src/Analysim.Web/ClientApp/src/app/projects/project/modal-member-list/modal-member-list.component.html b/src/Analysim.Web/ClientApp/src/app/projects/project/modal-member-list/modal-member-list.component.html
index d6f25368..3f426608 100644
--- a/src/Analysim.Web/ClientApp/src/app/projects/project/modal-member-list/modal-member-list.component.html
+++ b/src/Analysim.Web/ClientApp/src/app/projects/project/modal-member-list/modal-member-list.component.html
@@ -10,7 +10,7 @@ <h5 class="modal-title">Member List</h5>
     <ul class="project-authors-list">
       <li
         class="project-author"
-        *ngFor="let member of projectUsers | projectMember: 'owner'"
+        *ngFor="let member of projectUsers | projectMember: 'allMembers'"
         [routerLink]="['/profile/' + member.user.userName]"
         (click)="closeModal()"
       >

From 3831d5424a965e4c9b53e80907627ff16c4fbc25 Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Sat, 5 Sep 2026 22:52:37 +0300
Subject: [PATCH 5/8] fix: allow member notebook uploads

---
 .../Controllers/ProjectController.cs          | 39 ++++++++++++-------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index 9f0f0598..a7b9761b 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -2377,13 +2377,16 @@ public async Task<IActionResult> UploadNotebook([FromForm] ProjectNotebookUpload
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
 
-                bool isOwner = await _dbContext.Projects
+                bool hasNotebookUploadAccess = await _dbContext.Projects
                      .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                         aup.User.Id == user.Id &&
-                         aup.Project.ProjectID == noteBookData.ProjectID &&
-                         aup.UserRole == "owner"));
+                         aup.UserID == user.Id &&
+                         aup.ProjectID == noteBookData.ProjectID &&
+                         (aup.UserRole == "owner" || aup.UserRole == "member")));
 
-                if (!isOwner)   return Unauthorized(new { message = "You are not the owner of the project" });
+                if (!hasNotebookUploadAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 // Find Project
@@ -2474,12 +2477,15 @@ public async Task<IActionResult> UploadNotebookNewVersion([FromForm] ProjectNote
                 var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
-                bool isOwner = await _dbContext.Projects
+                bool hasNotebookUploadAccess = await _dbContext.Projects
                      .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                         aup.User.Id == user.Id &&
-                         aup.Project.ProjectID == noteBookData.ProjectID &&
-                         aup.UserRole == "owner"));
-                if (!isOwner) return Unauthorized(new { message = "You are not the owner of the project" });
+                         aup.UserID == user.Id &&
+                         aup.ProjectID == noteBookData.ProjectID &&
+                         (aup.UserRole == "owner" || aup.UserRole == "member")));
+                if (!hasNotebookUploadAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 // Find Project
@@ -2557,13 +2563,16 @@ public async Task<IActionResult> UploadExistingNotebook([FromForm] ExistingProje
                 var user = await _dbContext.Users.SingleOrDefaultAsync(u => u.Id == userId);
                 if (user == null) return NotFound(new { message = "User Not Found" });
 
-                bool isOwner = await _dbContext.Projects
+                bool hasNotebookUploadAccess = await _dbContext.Projects
                      .AnyAsync(p => p.ProjectUsers.Any(aup =>
-                         aup.User.Id == user.Id &&
-                         aup.Project.ProjectID == noteBookData.ProjectID &&
-                         aup.UserRole == "owner"));
+                         aup.UserID == user.Id &&
+                         aup.ProjectID == noteBookData.ProjectID &&
+                         (aup.UserRole == "owner" || aup.UserRole == "member")));
 
-                if (!isOwner)   return Unauthorized(new { message = "You are not the owner of the project" });
+                if (!hasNotebookUploadAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
                 
 
                 var project = await _dbContext.Projects.FindAsync(noteBookData.ProjectID);

From 83d5778c98e44ef377b62364224799063f5c293f Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Mon, 7 Sep 2026 01:10:06 +0300
Subject: [PATCH 6/8] fix: require project membership to create logs

---
 src/Analysim.Web/Controllers/ProjectController.cs | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index a7b9761b..e38b53d7 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -898,6 +898,17 @@ public async Task<IActionResult> AddProjectLog([FromForm] CreateProjectLogVM for
                 var project = await _dbContext.Projects.FindAsync(formdata.ProjectID);
                 if (project == null) return NotFound(new { message = "Project Not Found." });
 
+                bool hasProjectLogAccess = await _dbContext.ProjectUsers
+                    .AnyAsync(aup =>
+                        aup.UserID == user.Id &&
+                        aup.ProjectID == project.ProjectID &&
+                        (aup.UserRole == "owner" || aup.UserRole == "member"));
+
+                if (!hasProjectLogAccess)
+                {
+                    return StatusCode(StatusCodes.Status403Forbidden, new { message = "You must be an owner or member of the project" });
+                }
+
                 // Validate Content
                 if (string.IsNullOrWhiteSpace(formdata.Content))
                 {

From a8e71ce8be7559d95c8a604d36715e1cef478e5a Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Mon, 14 Sep 2026 01:17:10 +0300
Subject: [PATCH 7/8] feat: highlight notification bell for unread alerts

---
 .../ClientApp/src/app/navbar/navbar.component.html            | 1 +
 .../ClientApp/src/app/navbar/navbar.component.scss            | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.html b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.html
index a14d0960..331d71ea 100644
--- a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.html
+++ b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.html
@@ -73,6 +73,7 @@
       <li class="nav-item dropdown notification-nav-item">
         <a
           class="nav-link nav-interactive notification-trigger"
+          [class.has-unread-notifications]="((unreadCount$ | async) || 0) > 0"
           href="#"
           id="navbarNotificationMenuLink"
           aria-haspopup="true"
diff --git a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
index 0fa4b4bd..61483bb6 100644
--- a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
+++ b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
@@ -98,6 +98,10 @@
   border-radius: var(--nav-link-radius);
 }
 
+.navbar.bg-shell .notification-trigger.has-unread-notifications {
+  color: #d94a38;
+}
+
 .notification-badge {
   position: absolute;
   top: 3px;

From 3e02aac538e987d977f1693e3aeaac4556aeb7d5 Mon Sep 17 00:00:00 2001
From: Mohab <mohab_sobhy@outlook.com>
Date: Mon, 14 Sep 2026 01:22:27 +0300
Subject: [PATCH 8/8] fix: route join request notifications to project edit

---
 .../src/app/navbar/navbar.component.scss      | 12 ++++--
 .../Controllers/ProjectController.cs          | 37 ++++++++-----------
 .../Services/NotificationService.cs           |  6 +--
 3 files changed, 26 insertions(+), 29 deletions(-)

diff --git a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
index 61483bb6..ded21c37 100644
--- a/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
+++ b/src/Analysim.Web/ClientApp/src/app/navbar/navbar.component.scss
@@ -98,8 +98,12 @@
   border-radius: var(--nav-link-radius);
 }
 
-.navbar.bg-shell .notification-trigger.has-unread-notifications {
-  color: #d94a38;
+.notification-trigger.has-unread-notifications {
+  background: var(--c-danger-background);
+}
+
+.notification-trigger.has-unread-notifications .fa-bell {
+  color: color-mix(in srgb, var(--color-danger) 65%, var(--c-text-inverse));
 }
 
 .notification-badge {
@@ -110,9 +114,9 @@
   height: 17px;
   padding: 0 4px;
   border-radius: 999px;
-  background: #d94a38;
+  background: var(--color-danger);
   color: #fff;
-  border: 1px solid var(--background-color-tertiary);
+  border: 1px solid var(--background-color-secondary);
   font-size: 10px;
   font-weight: 700;
   line-height: 15px;
diff --git a/src/Analysim.Web/Controllers/ProjectController.cs b/src/Analysim.Web/Controllers/ProjectController.cs
index c527175e..502041f6 100644
--- a/src/Analysim.Web/Controllers/ProjectController.cs
+++ b/src/Analysim.Web/Controllers/ProjectController.cs
@@ -2076,17 +2076,6 @@ public async Task<IActionResult> FollowProject([FromRoute] int projectID)
                 _dbContext.Entry(projectUser).State = EntityState.Modified;
                 await _dbContext.SaveChangesAsync();
 
-                try
-                {
-                    await _notificationService.PublishAsync(new NotificationEvent
-                    {
-                        Type = NotificationTypes.ProjectJoined,
-                        ActorUserID = user.Id,
-                        ProjectID = project.ProjectID
-                    });
-                }
-                catch (Exception) { }
-
                 return Ok(new
                 {
                     result = projectUser,
@@ -2108,17 +2097,6 @@ await _notificationService.PublishAsync(new NotificationEvent
             _dbContext.Entry(projectUser).Reference(pu => pu.User).Load();
             _dbContext.Entry(projectUser).Reference(pu => pu.Project).Load();
 
-            try
-            {
-                await _notificationService.PublishAsync(new NotificationEvent
-                {
-                    Type = NotificationTypes.ProjectJoined,
-                    ActorUserID = user.Id,
-                    ProjectID = project.ProjectID
-                });
-            }
-            catch (Exception) { }
-
             return Ok(new
             {
                 result = projectUser,
@@ -2343,6 +2321,21 @@ public async Task<IActionResult> RequestJoinProject([FromRoute] int projectID)
             joinRequest = await ProjectMembershipRequestsWithUsers()
                 .SingleAsync(pmr => pmr.ProjectMembershipRequestID == joinRequest.ProjectMembershipRequestID);
 
+            try
+            {
+                await _notificationService.PublishAsync(new NotificationEvent
+                {
+                    Type = NotificationTypes.ProjectJoined,
+                    ActorUserID = user.Id,
+                    ProjectID = project.ProjectID,
+                    Data = new Dictionary<string, string>
+                    {
+                        ["membershipRequestID"] = joinRequest.ProjectMembershipRequestID.ToString()
+                    }
+                });
+            }
+            catch (Exception) { }
+
             return Ok(new
             {
                 result = joinRequest,
diff --git a/src/Analysim.Web/Services/NotificationService.cs b/src/Analysim.Web/Services/NotificationService.cs
index 98b943c1..55842a5e 100644
--- a/src/Analysim.Web/Services/NotificationService.cs
+++ b/src/Analysim.Web/Services/NotificationService.cs
@@ -202,9 +202,9 @@ private async Task PublishProjectJoinedAsync(NotificationEvent notificationEvent
 
             var actorName = await GetUserDisplayNameAsync(notificationEvent.ActorUserID, "Someone");
             var projectName = GetProjectName(project);
-            var link = BuildProjectLink(project, null);
-            var title = "Someone joined your project";
-            var body = $"{actorName} joined {projectName}.";
+            var link = BuildProjectLink(project, "edit");
+            var title = "Someone requested to join your project";
+            var body = $"{actorName} requested to join {projectName}.";
 
             await CreateAndSendAsync(
                 notificationEvent,