Refactor visible project users into query scope

app/Models/User.php

@@ -3,12 +3,14 @@
 namespace App\Models;
 
 // use Illuminate\Contracts\Auth\MustVerifyEmail;
+use App\Actions\Permissions\PermissionService;
 use Database\Factories\UserFactory;
 use Illuminate\Database\Eloquent\Attributes\Fillable;
 use Illuminate\Database\Eloquent\Attributes\Hidden;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Relations\BelongsToMany;
 use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Relations\MorphMany;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
@@ -69,4 +71,17 @@ class User extends Authenticatable
     {
         return $this->hasMany(Ticket::class, 'author_user_id');
     }
+
+    public function scopeVisibleToProject(Builder $query, Project $project): Builder
+    {
+        $permissionService = app(PermissionService::class);
+
+        return $query->where(function (Builder $builder) use ($permissionService, $project): void {
+            foreach (User::query()->select('id')->cursor() as $candidate) {
+                if ($permissionService->allows($candidate, \App\Enums\Permission::ProjectRead, $project)) {
+                    $builder->orWhereKey($candidate->id);
+                }
+            }
+        });
+    }
 }