fix: resolve implicit project for single-project OAuth tokens

An OAuth token narrowed to a single project (tg.prj) carries that project
the same way a PAK does, so implicit-project endpoints (no {projectId} in
the path, used by the in-context SDK) can now resolve it instead of failing
with project_not_selected. All-projects and multi-project tokens still throw,
since the client must target a project explicitly.

Author: bdshadow

backend/data/src/main/kotlin/io/tolgee/security/RequestContextService.kt

@@ -67,11 +67,17 @@ class RequestContextService(
 
   private fun getTargetProjectImplicit(): ProjectDto? {
     // This method is the source of complexity for the global handling, but is itself quite simple. Oh, the irony!
-    if (!authenticationFacade.isProjectApiKeyAuth) {
-      throw ProjectNotSelectedException()
+    if (authenticationFacade.isProjectApiKeyAuth) {
+      return projectService.findDto(authenticationFacade.projectApiKey.projectId)
     }
 
-    return projectService.findDto(authenticationFacade.projectApiKey.projectId)
+    // An OAuth token narrowed to a single project carries that project the same way a PAK does, so implicit endpoints
+    // (no {projectId} in the path) can resolve it. All-projects or multi-project tokens can't be resolved implicitly.
+    authenticationFacade.oauthTokenCredentials?.projectIds?.singleOrNull()?.let {
+      return projectService.findDto(it)
+    }
+
+    throw ProjectNotSelectedException()
   }
 
   /**

backend/data/src/test/kotlin/io/tolgee/security/RequestContextServiceTest.kt

@@ -21,6 +21,7 @@ import io.tolgee.dtos.cacheable.OrganizationDto
 import io.tolgee.dtos.cacheable.ProjectDto
 import io.tolgee.exceptions.InvalidPathException
 import io.tolgee.security.authentication.AuthenticationFacade
+import io.tolgee.security.oauth2.OAuth2TokenCredentials
 import io.tolgee.service.organization.OrganizationService
 import io.tolgee.service.project.ProjectService
 import org.assertj.core.api.Assertions.assertThat
@@ -83,6 +84,12 @@ class RequestContextServiceTest {
     Mockito.`when`(authenticationFacade.projectApiKey).thenReturn(apiKey)
   }
 
+  private fun setupOAuthToken(projectIds: Set<Long>?) {
+    Mockito.`when`(authenticationFacade.isApiAuthentication).thenReturn(true)
+    Mockito.`when`(authenticationFacade.oauthTokenCredentials)
+      .thenReturn(OAuth2TokenCredentials(scopes = emptySet(), projectIds = projectIds))
+  }
+
   private fun makeRequest(
     path: String,
     id: String = "",
@@ -141,6 +148,33 @@ class RequestContextServiceTest {
     assertThrows<ProjectNotSelectedException> { requestContextService.getTargetProject(reqOldRepo) }
   }
 
+  @Test
+  fun `it resolves the implicit project from a single-project OAuth token`() {
+    setupOAuthToken(setOf(TEST_PROJECT_ID))
+
+    val project = requestContextService.getTargetProject(makeRequest("/v2/projects/keys"))
+
+    assertThat(project?.id).isEqualTo(TEST_PROJECT_ID)
+  }
+
+  @Test
+  fun `it throws in implicit scenarios for an all-projects OAuth token`() {
+    setupOAuthToken(null)
+
+    assertThrows<ProjectNotSelectedException> {
+      requestContextService.getTargetProject(makeRequest("/v2/projects/keys"))
+    }
+  }
+
+  @Test
+  fun `it throws in implicit scenarios for a multi-project OAuth token`() {
+    setupOAuthToken(setOf(TEST_PROJECT_ID, TEST_PROJECT_ID + 1))
+
+    assertThrows<ProjectNotSelectedException> {
+      requestContextService.getTargetProject(makeRequest("/v2/projects/keys"))
+    }
+  }
+
   @Test
   fun `it correctly detects the current organization`() {
     val req = makeRequest("/v2/organizations/{id}/projects", TEST_ORGANIZATION_ID.toString())