fix: validate activity, deal and lead assignees by active membership in the current environment

apps/api/src/leads/leads.service.ts

@@ -596,7 +596,11 @@ export class LeadsService {
       throw new BadRequestException('فقط مدیر می‌تواند تخصیص دهد');
     }
     const user = await this.prisma.user.findFirst({
-      where: { id: assigneeId, organizationId: actor.organizationId },
+      where: {
+        id: assigneeId,
+        isActive: true,
+        memberships: { some: { organizationId: actor.organizationId, isActive: true } },
+      },
     });
     if (!user) throw new NotFoundException('کارشناس پیدا نشد');
 
@@ -669,15 +673,14 @@ export class LeadsService {
     let assignees = opts.assigneeIds?.length
       ? await this.prisma.user.findMany({
           where: {
-            organizationId: actor.organizationId,
             id: { in: opts.assigneeIds },
             isActive: true,
+            memberships: { some: { organizationId: actor.organizationId, isActive: true } },
           },
           select: { id: true, fullName: true },
         })
       : await this.prisma.user.findMany({
           where: {
-            organizationId: actor.organizationId,
             isActive: true,
             memberships: {
               some: {