In `@src/Appwrite/Platform/Modules/Projects/Http/Projects/Create.php`:
- Around line 135-151: After filtering database pool entries for the requested
$region (the block using System::getEnv('_APP_DATABASE_KEYS') and array_filter
on $keys into $databases) add a guard that verifies $databases is not empty
before attempting array_search/array_rand; if empty, return or throw a clear
error response (instead of allowing array_rand to run) indicating no databases
are configured for that region. Ensure this check sits just after the
array_filter block and before the existing array_search($databaseOverride,
$databases) logic so $databaseOverride/$dsn selection only runs when $databases
contains entries.

In `@src/Appwrite/Platform/Modules/Projects/Http/Projects/Team/Update.php`:
- Around line 60-105: The find() calls that update permissions for
'installations', 'repositories', and 'vcsComments' in the action() method are
not paginated and may only update a subset; change each
$dbForPlatform->find(...) call to use Query::limit(100) and iterate in a loop
fetching batches until no results remain, applying the same
setAttribute('$permissions', $permissions) + updateDocument(...) for each item
in every batch; update the three blocks that reference $installations,
$repositories, and $vcsComments in action() to this paginated pattern so all
documents for projectInternalId are processed.

In `@tests/e2e/Services/Projects/ProjectsBase.php`:
- Around line 80-83: The test currently uses tokens from
extractQueryParamsFromEmailLink($lastEmail['html']) without asserting the keys
exist, causing undefined-index errors; update the test around getLastEmail() /
extractQueryParamsFromEmailLink to assert that $tokens is an array and that keys
'userId' and 'secret' (and any other expected keys used later) are present
before assigning $userId and $secret, and add the same assertions for the other
occurrence around lines where $tokens are used (the block referenced at 121-123)
so parsing failures surface as explicit test failures.
- Around line 10-32: The setupProject helper can pass a null $teamId when called
with $newTeam = false, causing confusing failures; update setupProject to
validate inputs: inside setupProject (function name) add a guard that if
$newTeam === false and $teamId === null throw an InvalidArgumentException (or
return a clear error) stating a non-null teamId is required when not creating a
new team, and then continue to use $teamId when building the project payload
(the array passed to the POST /projects call) so you never send a null 'teamId'
value.

In `@app/controllers/shared/api.php`:
- Around line 299-307: The authorization status is enabled before checking
project permissions and never restored if $authorization->isValid($input)
throws, leaving authorization enabled for the rest of the request; wrap the
enable/validation logic in a try/finally so that
$authorization->setStatus($initialStatus) always runs: capture $initialStatus =
$authorization->getStatus(), call $authorization->enable(), perform the
$authorization->isValid($input) check in the try block (throwing the same
Exception on failure), and call $authorization->setStatus($initialStatus) in the
finally block to guarantee restoration (references: $project->getId(),
APP_MODE_ADMIN, Input, Database::PERMISSION_READ, $authorization->getStatus(),
$authorization->enable(), $authorization->isValid(),
$authorization->setStatus()).
- Around line 266-273: The loop handling $adminRoles assumes after stripping
'project-' the base role exists in $roles and directly accesses
$roles[$role]['scopes'], which can cause an undefined index; update the loop in
this controller to first check isset($roles[$role]) (or array_key_exists) after
computing $role and if the role is missing fail fast (throw an Exception or
return a 4xx response) instead of indexing into $roles, then only merge scopes
into $scopes and call $authorization->addRole($role) for known roles.