From c9a3a7f58d2b5651c4bc55eaa75e3ff6332aa5c1 Mon Sep 17 00:00:00 2001
From: Twyco <twyco@icloud.com>
Date: Wed, 22 Apr 2026 10:39:59 +0200
Subject: [PATCH] fixed scope

---
 app/Models/User.php | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/app/Models/User.php b/app/Models/User.php
index b84a873..22fdb24 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -4,13 +4,14 @@ namespace App\Models;
 
 // use Illuminate\Contracts\Auth\MustVerifyEmail;
 use App\Actions\Permissions\PermissionService;
+use App\Enums\Permission;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
-use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
@@ -76,12 +77,17 @@ class User extends Authenticatable
     {
         $permissionService = app(PermissionService::class);
 
-        return $query->where(function (Builder $builder) use ($permissionService, $project): void {
-            foreach (User::query()->select('id')->cursor() as $candidate) {
-                if ($permissionService->allows($candidate, \App\Enums\Permission::ProjectRead, $project)) {
-                    $builder->orWhereKey($candidate->id);
-                }
-            }
-        });
+        $allowedUserIds = User::query()
+            ->select('id')
+            ->cursor()
+            ->filter(fn (User $candidate) => $permissionService->allows(
+                $candidate,
+                Permission::ProjectRead,
+                $project
+            ))
+            ->pluck('id')
+            ->all();
+
+        return $query->whereKey($allowedUserIds);
     }
 }