Scope project user payloads to visible users

2026-04-20 23:54:37 +00:00
parent 8b25421e7c
commit 740a20899c
3 changed files with 68 additions and 0 deletions
@@ -59,9 +59,24 @@ class BuildProjectBacklogPayload
            )->resolve(),
            'users' => UserResource::collection(
                User::query()
+                    ->whereIn('id', $this->visibleUserIds($project))
                    ->orderBy('name')
                    ->get(),
            )->resolve(),
        ];
    }
+
+    /**
+     * @return array<int, int>
+     */
+    private function visibleUserIds(Project $project): array
+    {
+        return User::query()
+            ->get()
+            ->filter(fn (User $candidate): bool => $this->permissionService->allows($candidate, Permission::ProjectRead, $project))
+            ->pluck('id')
+            ->map(fn (mixed $userId): int => (int) $userId)
+            ->values()
+            ->all();
+    }
 }