From e2bc62249fedda36c069bfe2d4b8c5369b00a5b6 Mon Sep 17 00:00:00 2001
From: Anton Josefsson <antonjosefsson@hotmail.se>
Date: Fri, 2 Oct 2026 20:33:25 +0200
Subject: [PATCH] fix(teams): hide team creation when limit_circle_creation
 excludes the user

Expose whether the current user may create teams as initial state on the
Teams page and the dashboard widget, and hide every creation entry point
(home banner, empty states, team switcher, dashboard widget button) when
limit_circle_creation is set and the user has no permission.

Fixes #1940

Assisted-by: ClaudeCode:claude-opus-5-5

Signed-off-by: Anton Josefsson <antonjosefsson@hotmail.se>
---
 lib/Controller/PageController.php             |  10 ++
 lib/Dashboard/TeamDashboardWidget.php         |  25 ++-
 lib/Service/PermissionService.php             |  38 ++++-
 src/teams/App.spec.ts                         |  73 +++++++++
 src/teams/App.vue                             |   6 +-
 src/teams/components/TeamHeader.spec.ts       |  94 +++++++++++
 src/teams/components/TeamHeader.vue           |   3 +-
 src/teams/store.spec.ts                       |  73 ++++++++-
 src/teams/store.ts                            |  14 +-
 src/teams/views/HomeView.spec.ts              |  49 ++++++
 src/teams/views/HomeView.vue                  |  11 +-
 src/views/DashboardTeamsWidget.spec.ts        |  70 ++++++++
 src/views/DashboardTeamsWidget.vue            |   9 +-
 .../lib/Controller/PageControllerTest.php     |  32 +++-
 .../lib/Dashboard/TeamDashboardWidgetTest.php |  99 ++++++++++++
 .../lib/Service/PermissionServiceTest.php     | 153 ++++++++++++++++++
 16 files changed, 740 insertions(+), 19 deletions(-)
 create mode 100644 src/teams/App.spec.ts
 create mode 100644 src/teams/components/TeamHeader.spec.ts
 create mode 100644 src/views/DashboardTeamsWidget.spec.ts
 create mode 100644 tests/unit/lib/Dashboard/TeamDashboardWidgetTest.php
 create mode 100644 tests/unit/lib/Service/PermissionServiceTest.php

diff --git a/lib/Controller/PageController.php b/lib/Controller/PageController.php
index cc12d8b49..b4687bdd0 100644
--- a/lib/Controller/PageController.php
+++ b/lib/Controller/PageController.php
@@ -11,6 +11,7 @@
 
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Service\ConfigService;
+use OCA\Circles\Service\PermissionService;
 use OCA\Circles\Service\TeamFolderPolicy;
 use OCA\Text\Event\LoadEditor;
 use OCP\AppFramework\Controller;
@@ -22,6 +23,7 @@
 use OCP\AppFramework\Services\IInitialState;
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IRequest;
+use OCP\IUserSession;
 use OCP\Teams\ITeamManager;
 use OCP\Util;
 
@@ -36,6 +38,8 @@ public function __construct(
 		private ITeamManager $teamManager,
 		private TeamFolderPolicy $teamFolderPolicy,
 		private IEventDispatcher $eventDispatcher,
+		private IUserSession $userSession,
+		private PermissionService $permissionService,
 	) {
 		parent::__construct(Application::APP_ID, $request);
 	}
@@ -56,6 +60,12 @@ public function index(): TemplateResponse|NotFoundResponse {
 			'teamFolderProvisioningEnabled',
 			$this->teamFolderPolicy->isTeamFolderProvisioningEnabled(),
 		);
+		$this->initialState->provideInitialState(
+			'canCreateTeam',
+			$this->permissionService->canUserCreateCircle(
+				$this->userSession->getUser()?->getUID() ?? ''
+			),
+		);
 
 		Util::addScript(Application::APP_ID, 'teams-main');
 		Util::addStyle(Application::APP_ID, 'teams-main');
diff --git a/lib/Dashboard/TeamDashboardWidget.php b/lib/Dashboard/TeamDashboardWidget.php
index e9857fbc2..c1fa16981 100644
--- a/lib/Dashboard/TeamDashboardWidget.php
+++ b/lib/Dashboard/TeamDashboardWidget.php
@@ -9,12 +9,15 @@
 
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Service\ConfigService;
+use OCA\Circles\Service\PermissionService;
+use OCP\AppFramework\Services\IInitialState;
 use OCP\Dashboard\IButtonWidget;
 use OCP\Dashboard\IConditionalWidget;
 use OCP\Dashboard\IIconWidget;
 use OCP\Dashboard\Model\WidgetButton;
 use OCP\IL10N;
 use OCP\IURLGenerator;
+use OCP\IUserSession;
 use OCP\Util;
 
 class TeamDashboardWidget implements IIconWidget, IButtonWidget, IConditionalWidget {
@@ -22,6 +25,9 @@ public function __construct(
 		private readonly IURLGenerator $urlGenerator,
 		private readonly IL10N $l10n,
 		private readonly ConfigService $configService,
+		private readonly IInitialState $initialState,
+		private readonly IUserSession $userSession,
+		private readonly PermissionService $permissionService,
 	) {
 	}
 
@@ -66,21 +72,32 @@ public function getUrl(): ?string {
 	public function load(): void {
 		Util::addScript(Application::APP_ID, 'teams-dashboard');
 		Util::addStyle(Application::APP_ID, 'teams-dashboard');
+		$this->initialState->provideInitialState(
+			'canCreateTeam',
+			$this->permissionService->canUserCreateCircle(
+				$this->userSession->getUser()?->getUID() ?? ''
+			),
+		);
 	}
 
 	public function getWidgetButtons(string $userId): array {
-		return [
+		$buttons = [
 			new WidgetButton(
 				WidgetButton::TYPE_MORE,
 				$this->getTeamPage(),
 				$this->l10n->t('Show all teams')
 			),
-			new WidgetButton(
+		];
+
+		if ($this->permissionService->canUserCreateCircle($userId)) {
+			$buttons[] = new WidgetButton(
 				WidgetButton::TYPE_SETUP,
 				$this->getTeamPage(),
 				$this->l10n->t('Create a new team')
-			),
-		];
+			);
+		}
+
+		return $buttons;
 	}
 
 	public function getIconUrl(): string {
diff --git a/lib/Service/PermissionService.php b/lib/Service/PermissionService.php
index c36b06e1e..65af4e995 100644
--- a/lib/Service/PermissionService.php
+++ b/lib/Service/PermissionService.php
@@ -9,6 +9,7 @@
 
 namespace OCA\Circles\Service;
 
+use Exception;
 use OCA\Circles\Db\MemberRequest;
 use OCA\Circles\Db\MembershipRequest;
 use OCA\Circles\Exceptions\InitiatorNotFoundException;
@@ -19,6 +20,7 @@
 use OCA\Circles\Exceptions\MembershipNotFoundException;
 use OCA\Circles\Exceptions\RequestBuilderException;
 use OCA\Circles\Model\Circle;
+use OCA\Circles\Model\FederatedUser;
 use OCA\Circles\Model\Helpers\MemberHelper;
 use OCA\Circles\Model\Member;
 use OCP\IGroupManager;
@@ -51,6 +53,27 @@ public function confirmCircleCreation(): void {
 		}
 	}
 
+	/**
+	 * Non-throwing variant of confirmCircleCreation() for a given local user,
+	 * used to decide whether team creation is offered in the frontend.
+	 */
+	public function canUserCreateCircle(string $userId): bool {
+		$singleId = $this->configService->getAppValue(
+			ConfigService::LIMIT_CIRCLE_CREATION
+		);
+		if ($singleId === '') {
+			return true;
+		}
+
+		try {
+			$federatedUser = $this->federatedUserService
+				->getLocalFederatedUser($userId);
+			return $this->isLinkedTo($federatedUser, $singleId);
+		} catch (Exception) {
+			return false;
+		}
+	}
+
 	/**
 	 * @param string $config
 	 *
@@ -66,10 +89,23 @@ private function confirm(string $config): void {
 
 		$this->federatedUserService->mustHaveCurrentUser();
 		$federatedUser = $this->federatedUserService->getCurrentUser();
+		if (!$this->isLinkedTo($federatedUser, $singleId)) {
+			throw new InsufficientPermissionException();
+		}
+	}
+
+	/**
+	 * @throws RequestBuilderException
+	 */
+	private function isLinkedTo(
+		FederatedUser $federatedUser,
+		string $singleId,
+	): bool {
 		try {
 			$federatedUser->getLink($singleId);
+			return true;
 		} catch (MembershipNotFoundException) {
-			throw new InsufficientPermissionException();
+			return false;
 		}
 	}
 
diff --git a/src/teams/App.spec.ts b/src/teams/App.spec.ts
new file mode 100644
index 000000000..b878559df
--- /dev/null
+++ b/src/teams/App.spec.ts
@@ -0,0 +1,73 @@
+/*!
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { shallowMount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import App from './App.vue'
+import { useTeamsStore } from './store.ts'
+
+type LoadState = (app: string, key: string, fallback?: unknown) => unknown
+
+const loadState = vi.hoisted(() => vi.fn<LoadState>())
+
+vi.mock('@nextcloud/initial-state', () => ({ loadState }))
+vi.mock('./api.ts', () => ({ fetchTeams: vi.fn(async () => []) }))
+vi.mock('./components/TeamNavigation.vue', () => ({
+	default: { name: 'TeamNavigation', template: '<nav />' },
+}))
+vi.mock('./components/TeamCreationWizard.vue', () => ({
+	default: {
+		name: 'TeamCreationWizard',
+		template: '<div class="wizard-stub" />',
+	},
+}))
+
+/**
+ * Mount the app shell with the creation wizard flagged as open.
+ *
+ * @param canCreateTeam - value served for the `canCreateTeam` initial state
+ */
+function mountApp(canCreateTeam: boolean) {
+	loadState.mockImplementation((app, key, fallback) => {
+		if (app === 'circles' && key === 'canCreateTeam') {
+			return canCreateTeam
+		}
+		return fallback
+	})
+	const pinia = createPinia()
+	setActivePinia(pinia)
+	useTeamsStore().createWizardOpen = true
+
+	return shallowMount(App, {
+		global: {
+			plugins: [pinia],
+			stubs: {
+				NcContent: { template: '<div><slot /></div>' },
+				RouterView: true,
+			},
+		},
+	})
+}
+
+describe('App team creation wizard', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it('mounts the creation wizard when allowed', () => {
+		const wrapper = mountApp(true)
+
+		const wizard = wrapper.findComponent({ name: 'TeamCreationWizard' })
+		expect(wizard.exists()).toBe(true)
+	})
+
+	it('never mounts the creation wizard when not allowed', () => {
+		const wrapper = mountApp(false)
+
+		const wizard = wrapper.findComponent({ name: 'TeamCreationWizard' })
+		expect(wizard.exists()).toBe(false)
+	})
+})
diff --git a/src/teams/App.vue b/src/teams/App.vue
index d8b4881a0..9b053eba9 100644
--- a/src/teams/App.vue
+++ b/src/teams/App.vue
@@ -13,7 +13,7 @@ import TeamNavigation from './components/TeamNavigation.vue'
 import { useTeamsStore } from './store.ts'
 
 const store = useTeamsStore()
-const { createWizardOpen } = storeToRefs(store)
+const { createWizardOpen, canCreateTeam } = storeToRefs(store)
 
 onMounted(() => store.loadTeams())
 </script>
@@ -28,7 +28,9 @@ onMounted(() => store.loadTeams())
 			</div>
 		</NcAppContent>
 
-		<TeamCreationWizard v-if="createWizardOpen" @close="createWizardOpen = false" />
+		<TeamCreationWizard
+			v-if="canCreateTeam && createWizardOpen"
+			@close="createWizardOpen = false" />
 	</NcContent>
 </template>
 
diff --git a/src/teams/components/TeamHeader.spec.ts b/src/teams/components/TeamHeader.spec.ts
new file mode 100644
index 000000000..5265e1ab3
--- /dev/null
+++ b/src/teams/components/TeamHeader.spec.ts
@@ -0,0 +1,94 @@
+/*!
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import type Circle from '../team-page/models/circle.ts'
+
+import { shallowMount } from '@vue/test-utils'
+import { createPinia, setActivePinia } from 'pinia'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import TeamHeader from './TeamHeader.vue'
+import { useTeamsStore } from '../store.ts'
+
+type LoadState = (app: string, key: string, fallback?: unknown) => unknown
+
+const loadState = vi.hoisted(() => vi.fn<LoadState>())
+
+vi.mock('@nextcloud/initial-state', () => ({ loadState }))
+vi.mock('@nextcloud/dialogs', () => ({ showError: vi.fn() }))
+vi.mock('vue-router', () => ({
+	useRouter: () => ({ push: vi.fn() }),
+}))
+vi.mock('vuex', () => ({
+	useStore: () => ({ getters: { getCircle: () => undefined } }),
+}))
+vi.mock('../api.ts', () => ({ fetchTeams: vi.fn(async () => []) }))
+
+/**
+ * Mount the header with the switcher panel rendered inline.
+ *
+ * @param canCreateTeam - value served for the `canCreateTeam` initial state
+ */
+function mountHeader(canCreateTeam: boolean) {
+	loadState.mockImplementation((app, key, fallback) => {
+		if (app === 'circles' && key === 'canCreateTeam') {
+			return canCreateTeam
+		}
+		return fallback
+	})
+	const pinia = createPinia()
+	setActivePinia(pinia)
+
+	const wrapper = shallowMount(TeamHeader, {
+		props: {
+			circle: { id: 'team-1', displayName: 'Marketing' } as Circle,
+		},
+		global: {
+			plugins: [pinia],
+			stubs: {
+				NcPopover: {
+					template: '<div><slot name="trigger" /><slot /></div>',
+				},
+				NcButton: {
+					emits: ['click'],
+					template: '<button class="nc-button-stub" '
+						+ '@click="$emit(\'click\')"><slot /></button>',
+				},
+			},
+		},
+	})
+
+	return { wrapper, store: useTeamsStore() }
+}
+
+/**
+ * Find the switcher's "New team" button, if rendered.
+ *
+ * @param wrapper - The mounted header
+ */
+function findNewTeamButton(wrapper: ReturnType<typeof mountHeader>['wrapper']) {
+	return wrapper.findAll('.nc-button-stub')
+		.find((button) => button.text() === 'New team')
+}
+
+describe('TeamHeader team creation', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it('opens the creation wizard from the switcher when allowed', async () => {
+		const { wrapper, store } = mountHeader(true)
+		const button = findNewTeamButton(wrapper)
+
+		expect(button).toBeDefined()
+		await button!.trigger('click')
+		expect(store.createWizardOpen).toBe(true)
+	})
+
+	it('hides the switcher "New team" button when not allowed', () => {
+		const { wrapper } = mountHeader(false)
+
+		expect(findNewTeamButton(wrapper)).toBeUndefined()
+	})
+})
diff --git a/src/teams/components/TeamHeader.vue b/src/teams/components/TeamHeader.vue
index f654cd408..3909fc6d2 100644
--- a/src/teams/components/TeamHeader.vue
+++ b/src/teams/components/TeamHeader.vue
@@ -170,7 +170,7 @@ async function openHome(): Promise<void> {
 /** Open the team creation wizard from the panel. */
 function onNewTeam(): void {
 	switcherOpen.value = false
-	teamsStore.createWizardOpen = true
+	teamsStore.openCreateTeamWizard()
 }
 
 /** Open the team's members page from the panel. */
@@ -365,6 +365,7 @@ async function onToggleFavorite(): Promise<void> {
 					</NcButton>
 
 					<NcButton
+						v-if="teamsStore.canCreateTeam"
 						class="team-header__switcher-new"
 						variant="secondary"
 						@click="onNewTeam">
diff --git a/src/teams/store.spec.ts b/src/teams/store.spec.ts
index 5246c68f5..0b73f615f 100644
--- a/src/teams/store.spec.ts
+++ b/src/teams/store.spec.ts
@@ -11,12 +11,17 @@ import { beforeEach, describe, expect, it, vi } from 'vitest'
 import * as api from './api.ts'
 import { useTeamsStore } from './store.ts'
 
+type LoadState = (app: string, key: string, fallback?: unknown) => unknown
+
+const loadState = vi.hoisted(() => vi.fn<LoadState>())
+const createTeam = vi.hoisted(() => vi.fn(async () => 'team-1'))
 const fetchTeams = vi.hoisted(() => vi.fn<() => Promise<TeamsOverview>>())
 const joinTeam = vi.hoisted(() => vi.fn<(id: string) => Promise<'joined' | 'requested'>>())
 const setTeamFavorite = vi.hoisted(() => vi.fn<(id: string, isFavorite: boolean) => Promise<string[]>>())
 const reorderFavoriteTeams = vi.hoisted(() => vi.fn<(ids: string[], expectedIds: string[]) => Promise<string[]>>())
 
-vi.mock('./api.ts', () => ({ fetchTeams, joinTeam, setTeamFavorite, reorderFavoriteTeams }))
+vi.mock('@nextcloud/initial-state', () => ({ loadState }))
+vi.mock('./api.ts', () => ({ createTeam, fetchTeams, joinTeam, setTeamFavorite, reorderFavoriteTeams }))
 vi.mock('../logger.ts', () => ({ logger: { error: vi.fn(), warn: vi.fn() } }))
 
 function team(id: string, position: number | null): Team {
@@ -181,3 +186,69 @@ describe('teams store: discoverable teams', () => {
 		expect(fetchTeams).not.toHaveBeenCalled()
 	})
 })
+
+/**
+ * Create a fresh store whose `canCreateTeam` initial state is `allowed`.
+ *
+ * @param allowed - value served for the `canCreateTeam` initial state
+ */
+function setupStore(allowed: boolean) {
+	loadState.mockImplementation((app, key, fallback) => {
+		if (app === 'circles' && key === 'canCreateTeam') {
+			return allowed
+		}
+		return fallback
+	})
+	setActivePinia(createPinia())
+	return useTeamsStore()
+}
+
+describe('teams store team creation permission', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+		fetchTeams.mockResolvedValue({ teams: [], discoverableTeams: [] })
+	})
+
+	it('reads canCreateTeam from the initial state', () => {
+		expect(setupStore(true).canCreateTeam).toBe(true)
+		expect(setupStore(false).canCreateTeam).toBe(false)
+	})
+
+	it('defaults to not allowed when the initial state is missing', () => {
+		loadState.mockImplementation((app, key, fallback) => fallback)
+		setActivePinia(createPinia())
+
+		expect(useTeamsStore().canCreateTeam).toBe(false)
+	})
+
+	it('opens the creation wizard when allowed', () => {
+		const store = setupStore(true)
+
+		store.openCreateTeamWizard()
+
+		expect(store.createWizardOpen).toBe(true)
+	})
+
+	it('keeps the creation wizard closed when not allowed', () => {
+		const store = setupStore(false)
+
+		store.openCreateTeamWizard()
+
+		expect(store.createWizardOpen).toBe(false)
+	})
+
+	it('creates a team when allowed', async () => {
+		const store = setupStore(true)
+
+		await store.createTeam('Marketing')
+
+		expect(createTeam).toHaveBeenCalledWith('Marketing', true)
+	})
+
+	it('does not call the API to create a team when not allowed', async () => {
+		const store = setupStore(false)
+
+		await expect(store.createTeam('Marketing')).rejects.toThrow()
+		expect(createTeam).not.toHaveBeenCalled()
+	})
+})
diff --git a/src/teams/store.ts b/src/teams/store.ts
index 58db10e41..4e08c0dc1 100644
--- a/src/teams/store.ts
+++ b/src/teams/store.ts
@@ -5,6 +5,7 @@
 
 import type { DiscoverableTeam, Member, MemberCandidate, Team } from './types.ts'
 
+import { loadState } from '@nextcloud/initial-state'
 import { defineStore } from 'pinia'
 import { logger } from '../logger.ts'
 import * as api from './api.ts'
@@ -21,6 +22,8 @@ interface TeamsState {
 	/** Whether the "create a new team" wizard is open (shared across the app). */
 	createWizardOpen: boolean
 	favoritesUpdating: boolean
+	/** Whether the current user may create teams (`limit_circle_creation`). */
+	canCreateTeam: boolean
 }
 
 /**
@@ -36,6 +39,7 @@ export const useTeamsStore = defineStore('teams', {
 		loadError: false,
 		createWizardOpen: false,
 		favoritesUpdating: false,
+		canCreateTeam: Boolean(loadState('circles', 'canCreateTeam', false)),
 	}),
 
 	getters: {
@@ -66,8 +70,13 @@ export const useTeamsStore = defineStore('teams', {
 	},
 
 	actions: {
-		/** Open the "create a new team" wizard. */
+		/**
+		 * Open the "create a new team" wizard, if the user may create teams.
+		 */
 		openCreateTeamWizard(): void {
+			if (!this.canCreateTeam) {
+				return
+			}
 			this.createWizardOpen = true
 		},
 
@@ -171,6 +180,9 @@ export const useTeamsStore = defineStore('teams', {
 		 * @param description - An optional description
 		 */
 		async createTeam(displayName: string, createTeamFolder = true, description = ''): Promise<Team | undefined> {
+			if (!this.canCreateTeam) {
+				throw new Error('Not allowed to create teams')
+			}
 			const id = await api.createTeam(displayName.trim(), createTeamFolder)
 			const trimmedDescription = description.trim()
 			if (trimmedDescription) {
diff --git a/src/teams/views/HomeView.spec.ts b/src/teams/views/HomeView.spec.ts
index faaaf921e..b953a204f 100644
--- a/src/teams/views/HomeView.spec.ts
+++ b/src/teams/views/HomeView.spec.ts
@@ -17,6 +17,9 @@ import HomeView from './HomeView.vue'
 import * as api from '../api.ts'
 import { useTeamsStore } from '../store.ts'
 
+type LoadState = (app: string, key: string, fallback?: unknown) => unknown
+
+const loadState = vi.hoisted(() => vi.fn<LoadState>())
 const fetchTeams = vi.hoisted(() => vi.fn<() => Promise<TeamsOverview>>())
 const joinTeam = vi.hoisted(() => vi.fn<(teamId: string) => Promise<'joined' | 'requested'>>())
 const setTeamFavorite = vi.hoisted(() => vi.fn<(teamId: string, isFavorite: boolean) => Promise<string[]>>())
@@ -26,6 +29,7 @@ const showSuccess = vi.hoisted(() => vi.fn())
 const showError = vi.hoisted(() => vi.fn())
 const loggerError = vi.hoisted(() => vi.fn())
 
+vi.mock('@nextcloud/initial-state', () => ({ loadState }))
 vi.mock('../api.ts', () => ({ fetchTeams, joinTeam, setTeamFavorite, reorderFavoriteTeams }))
 vi.mock('../../logger.ts', () => ({ logger: { error: loggerError, warn: vi.fn() } }))
 vi.mock('vue-router', () => ({ useRouter: () => ({ push: routerPush }) }))
@@ -320,3 +324,48 @@ describe('HomeView team joining', () => {
 		expect(joinTeam).toHaveBeenCalledTimes(1)
 	})
 })
+
+const EMPTY_DESCRIPTION = 'Create your first team to start collaborating.'
+
+/**
+ * Mount the home view without teams, so the empty state is shown.
+ *
+ * @param canCreateTeam - value served for the `canCreateTeam` initial state
+ */
+function mountView(canCreateTeam: boolean) {
+	loadState.mockImplementation((app, key, fallback) => {
+		if (app === 'circles' && key === 'canCreateTeam') {
+			return canCreateTeam
+		}
+		return fallback
+	})
+	const pinia = createPinia()
+	setActivePinia(pinia)
+
+	return mount(HomeView, { global: { plugins: [pinia] } })
+}
+
+describe('HomeView team creation', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it('offers creating teams when allowed', () => {
+		const wrapper = mountView(true)
+		const buttons = wrapper.findAll('button').map((button) => button.text())
+
+		expect(buttons).toContain('New team')
+		expect(buttons).toContain('Create your first team')
+		expect(wrapper.text()).toContain(EMPTY_DESCRIPTION)
+	})
+
+	it('hides every creation entry point when not allowed', () => {
+		const wrapper = mountView(false)
+		const buttons = wrapper.findAll('button').map((button) => button.text())
+
+		expect(buttons).not.toContain('New team')
+		expect(buttons).not.toContain('Create your first team')
+		expect(wrapper.text()).not.toContain(EMPTY_DESCRIPTION)
+		expect(wrapper.text()).toContain('No teams yet')
+	})
+})
diff --git a/src/teams/views/HomeView.vue b/src/teams/views/HomeView.vue
index 2a7cdeb5d..61b0fcff0 100644
--- a/src/teams/views/HomeView.vue
+++ b/src/teams/views/HomeView.vue
@@ -25,7 +25,7 @@ import { logger } from '../../logger.ts'
 import { useTeamsStore } from '../store.ts'
 
 const store = useTeamsStore()
-const { teams, loading, loadError, favoritesUpdating } = storeToRefs(store)
+const { teams, loading, loadError, favoritesUpdating, canCreateTeam } = storeToRefs(store)
 const { loadTeams, openCreateTeamWizard } = store
 const router = useRouter()
 
@@ -181,6 +181,9 @@ async function moveFavorite(teamId: string, direction: -1 | 1) {
 
 const filteredDiscoverableTeams = computed(() => store.searchDiscoverableTeams(query.value))
 const joiningTeamId = ref<string | null>(null)
+const emptyDescription = computed(() => canCreateTeam.value
+	? t('circles', 'Create your first team to start collaborating.')
+	: '')
 
 const illustrationSrc = imagePath('circles', 'teams-illustration.svg')
 const isDarkTheme = useIsDarkTheme()
@@ -226,7 +229,7 @@ async function onJoin(team: DiscoverableTeam): Promise<void> {
 				<p :class="$style.homeViewSubtitle">
 					{{ t('circles', 'and everything shared with them across Nextcloud.') }}
 				</p>
-				<div :class="$style.homeViewBannerAction">
+				<div v-if="canCreateTeam" :class="$style.homeViewBannerAction">
 					<NcButton variant="primary" @click="openCreateTeamWizard()">
 						<template #icon>
 							<NcIconSvgWrapper :path="mdiPlus" :size="20" />
@@ -273,11 +276,11 @@ async function onJoin(team: DiscoverableTeam): Promise<void> {
 			<NcEmptyContent
 				v-else-if="teams.length === 0"
 				:name="t('circles', 'No teams yet')"
-				:description="t('circles', 'Create your first team to start collaborating.')">
+				:description="emptyDescription">
 				<template #icon>
 					<NcIconSvgWrapper :path="mdiAccountGroupOutline" />
 				</template>
-				<template #action>
+				<template v-if="canCreateTeam" #action>
 					<NcButton variant="primary" @click="openCreateTeamWizard()">
 						{{ t('circles', 'Create your first team') }}
 					</NcButton>
diff --git a/src/views/DashboardTeamsWidget.spec.ts b/src/views/DashboardTeamsWidget.spec.ts
new file mode 100644
index 000000000..19b7393c4
--- /dev/null
+++ b/src/views/DashboardTeamsWidget.spec.ts
@@ -0,0 +1,70 @@
+/*!
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+import { flushPromises, shallowMount } from '@vue/test-utils'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import DashboardTeamsWidget from './DashboardTeamsWidget.vue'
+
+type LoadState = (app: string, key: string, fallback?: unknown) => unknown
+
+const loadState = vi.hoisted(() => vi.fn<LoadState>())
+
+vi.mock('@nextcloud/initial-state', () => ({ loadState }))
+vi.mock('@nextcloud/dialogs', () => ({ showError: vi.fn() }))
+vi.mock('@nextcloud/axios', () => ({
+	default: {
+		get: vi.fn(async () => ({ data: { ocs: { data: [] } } })),
+	},
+}))
+
+const EMPTY_DESCRIPTION = 'Join or create teams to see them here.'
+
+/**
+ * Mount the widget with an empty teams list, so the empty state is shown.
+ *
+ * @param canCreateTeam - value served for the `canCreateTeam` initial state
+ */
+async function mountWidget(canCreateTeam: boolean) {
+	loadState.mockImplementation((app, key, fallback) => {
+		if (app === 'circles' && key === 'canCreateTeam') {
+			return canCreateTeam
+		}
+		return fallback
+	})
+
+	const wrapper = shallowMount(DashboardTeamsWidget, {
+		global: {
+			stubs: {
+				NcButton: false,
+				NcEmptyContent: false,
+			},
+		},
+	})
+	await flushPromises()
+
+	return wrapper
+}
+
+describe('DashboardTeamsWidget team creation', () => {
+	beforeEach(() => {
+		vi.clearAllMocks()
+	})
+
+	it('offers creating teams when allowed', async () => {
+		const wrapper = await mountWidget(true)
+
+		expect(wrapper.text()).toContain(EMPTY_DESCRIPTION)
+		expect(wrapper.text()).toContain('Create your first team')
+	})
+
+	it('only shows the empty state title when not allowed', async () => {
+		const wrapper = await mountWidget(false)
+
+		expect(wrapper.text()).toContain('No teams found')
+		expect(wrapper.text()).not.toContain(EMPTY_DESCRIPTION)
+		expect(wrapper.text()).not.toContain('Create your first team')
+		expect(wrapper.find('.empty-content__action').exists()).toBe(false)
+	})
+})
diff --git a/src/views/DashboardTeamsWidget.vue b/src/views/DashboardTeamsWidget.vue
index a76da26ff..78a3a30c6 100644
--- a/src/views/DashboardTeamsWidget.vue
+++ b/src/views/DashboardTeamsWidget.vue
@@ -10,6 +10,7 @@ import type { ITeam } from '../types.ts'
 import { mdiAccountGroupOutline, mdiAlertCircleOutline } from '@mdi/js'
 import axios from '@nextcloud/axios'
 import { showError } from '@nextcloud/dialogs'
+import { loadState } from '@nextcloud/initial-state'
 import { t } from '@nextcloud/l10n'
 import { generateOcsUrl, generateUrl } from '@nextcloud/router'
 import { nextTick, onMounted, ref, useTemplateRef } from 'vue'
@@ -22,6 +23,10 @@ import { logger } from '../logger.ts'
 
 const LOADING_LIMIT = 3
 const createTeamHref = generateUrl('/apps/circles/teams')
+const canCreateTeam = Boolean(loadState('circles', 'canCreateTeam', false))
+const emptyDescription = canCreateTeam
+	? t('circles', 'Join or create teams to see them here.')
+	: ''
 
 const teamsList = useTemplateRef('teamsListKey')
 
@@ -124,11 +129,11 @@ async function loadMoreTeams() {
 		<NcEmptyContent
 			v-else-if="shownTeams.length === 0"
 			:name="t('circles', 'No teams found')"
-			:description="t('circles', 'Join or create teams to see them here.')">
+			:description="emptyDescription">
 			<template #icon>
 				<NcIconSvgWrapper :path="mdiAccountGroupOutline" />
 			</template>
-			<template #action>
+			<template v-if="canCreateTeam" #action>
 				<NcButton :href="createTeamHref">
 					{{ t('circles', 'Create your first team') }}
 				</NcButton>
diff --git a/tests/unit/lib/Controller/PageControllerTest.php b/tests/unit/lib/Controller/PageControllerTest.php
index 0309d89a9..e2434402d 100644
--- a/tests/unit/lib/Controller/PageControllerTest.php
+++ b/tests/unit/lib/Controller/PageControllerTest.php
@@ -11,12 +11,15 @@
 use OCA\Circles\AppInfo\Application;
 use OCA\Circles\Controller\PageController;
 use OCA\Circles\Service\ConfigService;
+use OCA\Circles\Service\PermissionService;
 use OCA\Circles\Service\TeamFolderPolicy;
 use OCP\AppFramework\Http\NotFoundResponse;
 use OCP\AppFramework\Http\TemplateResponse;
 use OCP\AppFramework\Services\IInitialState;
 use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IRequest;
+use OCP\IUser;
+use OCP\IUserSession;
 use OCP\Teams\ITeamFolderProvider;
 use OCP\Teams\ITeamManager;
 use PHPUnit\Framework\MockObject\MockObject;
@@ -29,6 +32,8 @@ final class PageControllerTest extends TestCase {
 	private ITeamManager&MockObject $teamManager;
 	private TeamFolderPolicy&MockObject $teamFolderPolicy;
 	private IEventDispatcher&MockObject $eventDispatcher;
+	private IUserSession&MockObject $userSession;
+	private PermissionService&MockObject $permissionService;
 	private PageController $pageController;
 
 	#[\Override]
@@ -41,6 +46,12 @@ protected function setUp(): void {
 		$this->teamManager = $this->createMock(ITeamManager::class);
 		$this->teamFolderPolicy = $this->createMock(TeamFolderPolicy::class);
 		$this->eventDispatcher = $this->createMock(IEventDispatcher::class);
+		$this->permissionService = $this->createMock(PermissionService::class);
+
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('alice');
+		$this->userSession = $this->createMock(IUserSession::class);
+		$this->userSession->method('getUser')->willReturn($user);
 
 		$this->pageController = new PageController(
 			$this->request,
@@ -49,6 +60,8 @@ protected function setUp(): void {
 			$this->teamManager,
 			$this->teamFolderPolicy,
 			$this->eventDispatcher,
+			$this->userSession,
+			$this->permissionService,
 		);
 	}
 
@@ -70,9 +83,13 @@ public function testIndexProvidesTeamFolderStateWithProvider(): void {
 		$this->teamFolderPolicy->expects($this->once())
 			->method('isTeamFolderProvisioningEnabled')
 			->willReturn(true);
+		$this->permissionService->expects($this->once())
+			->method('canUserCreateCircle')
+			->with('alice')
+			->willReturn(true);
 
 		$provided = [];
-		$this->initialState->expects($this->exactly(2))
+		$this->initialState->expects($this->exactly(3))
 			->method('provideInitialState')
 			->willReturnCallback(function (string $key, mixed $value) use (&$provided): void {
 				$provided[$key] = $value;
@@ -85,12 +102,14 @@ public function testIndexProvidesTeamFolderStateWithProvider(): void {
 		$this->assertSame('main', $result->getTemplateName());
 		$this->assertTrue($provided['teamFolderProviderAvailable']);
 		$this->assertTrue($provided['teamFolderProvisioningEnabled']);
+		$this->assertTrue($provided['canCreateTeam']);
 	}
 
 	/**
 	 * No folder provider registered (groupfolders disabled or uninstalled):
 	 * `teamFolderProviderAvailable` must be false, but the page still renders
-	 * so the SPA can fall back to the regular "Folder" button.
+	 * so the SPA can fall back to the regular "Folder" button. The user is
+	 * also not allowed to create teams, so `canCreateTeam` is false.
 	 */
 	public function testIndexProvidesProviderUnavailable(): void {
 		$this->configService->expects($this->once())
@@ -104,9 +123,13 @@ public function testIndexProvidesProviderUnavailable(): void {
 		$this->teamFolderPolicy->expects($this->once())
 			->method('isTeamFolderProvisioningEnabled')
 			->willReturn(false);
+		$this->permissionService->expects($this->once())
+			->method('canUserCreateCircle')
+			->with('alice')
+			->willReturn(false);
 
 		$provided = [];
-		$this->initialState->expects($this->exactly(2))
+		$this->initialState->expects($this->exactly(3))
 			->method('provideInitialState')
 			->willReturnCallback(function (string $key, mixed $value) use (&$provided): void {
 				$provided[$key] = $value;
@@ -117,6 +140,7 @@ public function testIndexProvidesProviderUnavailable(): void {
 		$this->assertInstanceOf(TemplateResponse::class, $result);
 		$this->assertFalse($provided['teamFolderProviderAvailable']);
 		$this->assertFalse($provided['teamFolderProvisioningEnabled']);
+		$this->assertFalse($provided['canCreateTeam']);
 	}
 
 	/**
@@ -135,6 +159,8 @@ public function testIndexReturnsNotFoundWhenFrontendDisabled(): void {
 			->method('getTeamFolderProvider');
 		$this->teamFolderPolicy->expects($this->never())
 			->method('isTeamFolderProvisioningEnabled');
+		$this->permissionService->expects($this->never())
+			->method('canUserCreateCircle');
 
 		$result = $this->pageController->index();
 
diff --git a/tests/unit/lib/Dashboard/TeamDashboardWidgetTest.php b/tests/unit/lib/Dashboard/TeamDashboardWidgetTest.php
new file mode 100644
index 000000000..950278f5e
--- /dev/null
+++ b/tests/unit/lib/Dashboard/TeamDashboardWidgetTest.php
@@ -0,0 +1,99 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Tests\Unit\Dashboard;
+
+use OCA\Circles\Dashboard\TeamDashboardWidget;
+use OCA\Circles\Service\ConfigService;
+use OCA\Circles\Service\PermissionService;
+use OCP\AppFramework\Services\IInitialState;
+use OCP\Dashboard\Model\WidgetButton;
+use OCP\IL10N;
+use OCP\IURLGenerator;
+use OCP\IUser;
+use OCP\IUserSession;
+use PHPUnit\Framework\MockObject\MockObject;
+use Test\TestCase;
+
+final class TeamDashboardWidgetTest extends TestCase {
+	private IInitialState&MockObject $initialState;
+	private PermissionService&MockObject $permissionService;
+	private TeamDashboardWidget $widget;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+
+		$urlGenerator = $this->createMock(IURLGenerator::class);
+		$urlGenerator->method('linkToRoute')->willReturn('/apps/circles/teams');
+		$urlGenerator->method('getAbsoluteURL')->willReturnArgument(0);
+		$l10n = $this->createMock(IL10N::class);
+		$l10n->method('t')->willReturnArgument(0);
+
+		$user = $this->createMock(IUser::class);
+		$user->method('getUID')->willReturn('alice');
+		$userSession = $this->createMock(IUserSession::class);
+		$userSession->method('getUser')->willReturn($user);
+
+		$this->initialState = $this->createMock(IInitialState::class);
+		$this->permissionService = $this->createMock(PermissionService::class);
+
+		$this->widget = new TeamDashboardWidget(
+			$urlGenerator,
+			$l10n,
+			$this->createMock(ConfigService::class),
+			$this->initialState,
+			$userSession,
+			$this->permissionService,
+		);
+	}
+
+	/**
+	 * @return list<string>
+	 */
+	private function getButtonTypes(): array {
+		return array_map(
+			static fn (WidgetButton $button): string => $button->getType(),
+			$this->widget->getWidgetButtons('alice'),
+		);
+	}
+
+	public function testWidgetButtonsOfferCreationWhenAllowed(): void {
+		$this->permissionService->expects($this->once())
+			->method('canUserCreateCircle')
+			->with('alice')
+			->willReturn(true);
+
+		$this->assertSame(
+			[WidgetButton::TYPE_MORE, WidgetButton::TYPE_SETUP],
+			$this->getButtonTypes(),
+		);
+	}
+
+	public function testWidgetButtonsHideCreationWhenNotAllowed(): void {
+		$this->permissionService->expects($this->once())
+			->method('canUserCreateCircle')
+			->with('alice')
+			->willReturn(false);
+
+		$this->assertSame([WidgetButton::TYPE_MORE], $this->getButtonTypes());
+	}
+
+	public function testLoadProvidesCanCreateTeam(): void {
+		$this->permissionService->expects($this->once())
+			->method('canUserCreateCircle')
+			->with('alice')
+			->willReturn(false);
+		$this->initialState->expects($this->once())
+			->method('provideInitialState')
+			->with('canCreateTeam', false);
+
+		$this->widget->load();
+	}
+}
diff --git a/tests/unit/lib/Service/PermissionServiceTest.php b/tests/unit/lib/Service/PermissionServiceTest.php
new file mode 100644
index 000000000..ab57c71b8
--- /dev/null
+++ b/tests/unit/lib/Service/PermissionServiceTest.php
@@ -0,0 +1,153 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Circles\Tests\Unit\Service;
+
+use OCA\Circles\Db\MemberRequest;
+use OCA\Circles\Db\MembershipRequest;
+use OCA\Circles\Exceptions\FederatedUserNotFoundException;
+use OCA\Circles\Exceptions\InsufficientPermissionException;
+use OCA\Circles\Exceptions\MembershipNotFoundException;
+use OCA\Circles\Model\FederatedUser;
+use OCA\Circles\Model\Membership;
+use OCA\Circles\Service\ConfigService;
+use OCA\Circles\Service\FederatedUserService;
+use OCA\Circles\Service\PermissionService;
+use OCP\IGroupManager;
+use OCP\IL10N;
+use PHPUnit\Framework\MockObject\MockObject;
+use Test\TestCase;
+
+final class PermissionServiceTest extends TestCase {
+	private const LIMIT_SINGLE_ID = 'creators-single-id';
+
+	private FederatedUserService&MockObject $federatedUserService;
+	private ConfigService&MockObject $configService;
+	private PermissionService $service;
+
+	#[\Override]
+	protected function setUp(): void {
+		parent::setUp();
+
+		$l10n = $this->createMock(IL10N::class);
+		$l10n->method('t')->willReturnArgument(0);
+		$this->federatedUserService = $this->createMock(
+			FederatedUserService::class
+		);
+		$this->configService = $this->createMock(ConfigService::class);
+
+		$this->service = new PermissionService(
+			$l10n,
+			$this->federatedUserService,
+			$this->configService,
+			$this->createMock(MemberRequest::class),
+			$this->createMock(MembershipRequest::class),
+			$this->createMock(IGroupManager::class),
+		);
+	}
+
+	private function setCreationLimit(string $singleId): void {
+		$this->configService->method('getAppValue')
+			->with(ConfigService::LIMIT_CIRCLE_CREATION)
+			->willReturn($singleId);
+	}
+
+	/**
+	 * Federated user whose membership lookup for the limit entity either
+	 * succeeds or throws MembershipNotFoundException.
+	 */
+	private function createFederatedUser(
+		bool $isLinked,
+	): FederatedUser&MockObject {
+		$federatedUser = $this->createMock(FederatedUser::class);
+		$getLink = $federatedUser->expects($this->once())
+			->method('getLink')
+			->with(self::LIMIT_SINGLE_ID);
+		if ($isLinked) {
+			$getLink->willReturn($this->createMock(Membership::class));
+		} else {
+			$getLink->willThrowException(new MembershipNotFoundException());
+		}
+
+		return $federatedUser;
+	}
+
+	public function testCanUserCreateCircleWithoutLimit(): void {
+		$this->setCreationLimit('');
+		$this->federatedUserService->expects($this->never())
+			->method('getLocalFederatedUser');
+
+		$this->assertTrue($this->service->canUserCreateCircle('alice'));
+	}
+
+	public function testCanUserCreateCircleWhenLinkedToLimit(): void {
+		$this->setCreationLimit(self::LIMIT_SINGLE_ID);
+		$this->federatedUserService->expects($this->once())
+			->method('getLocalFederatedUser')
+			->with('alice')
+			->willReturn($this->createFederatedUser(true));
+
+		$this->assertTrue($this->service->canUserCreateCircle('alice'));
+	}
+
+	public function testCanUserCreateCircleWhenNotLinkedToLimit(): void {
+		$this->setCreationLimit(self::LIMIT_SINGLE_ID);
+		$this->federatedUserService->expects($this->once())
+			->method('getLocalFederatedUser')
+			->with('alice')
+			->willReturn($this->createFederatedUser(false));
+
+		$this->assertFalse($this->service->canUserCreateCircle('alice'));
+	}
+
+	public function testCanUserCreateCircleWhenUserCannotBeResolved(): void {
+		$this->setCreationLimit(self::LIMIT_SINGLE_ID);
+		$this->federatedUserService->expects($this->once())
+			->method('getLocalFederatedUser')
+			->with('')
+			->willThrowException(new FederatedUserNotFoundException());
+
+		$this->assertFalse($this->service->canUserCreateCircle(''));
+	}
+
+	public function testConfirmCircleCreationWithoutLimit(): void {
+		$this->setCreationLimit('');
+		$this->federatedUserService->expects($this->never())
+			->method('getCurrentUser');
+
+		$this->service->confirmCircleCreation();
+	}
+
+	public function testConfirmCircleCreationWhenLinkedToLimit(): void {
+		$this->setCreationLimit(self::LIMIT_SINGLE_ID);
+		$this->federatedUserService->expects($this->once())
+			->method('mustHaveCurrentUser');
+		$this->federatedUserService->expects($this->once())
+			->method('getCurrentUser')
+			->willReturn($this->createFederatedUser(true));
+
+		$this->service->confirmCircleCreation();
+	}
+
+	public function testConfirmCircleCreationWhenNotLinkedToLimit(): void {
+		$this->setCreationLimit(self::LIMIT_SINGLE_ID);
+		$this->federatedUserService->expects($this->once())
+			->method('mustHaveCurrentUser');
+		$this->federatedUserService->expects($this->once())
+			->method('getCurrentUser')
+			->willReturn($this->createFederatedUser(false));
+
+		$this->expectException(InsufficientPermissionException::class);
+		$this->expectExceptionMessage(
+			'You have no permission to create a new team'
+		);
+
+		$this->service->confirmCircleCreation();
+	}
+}