fix: validate activity, deal and lead assignees by active membership in the current environment

apps/api/src/activities/activities.service.ts

@@ -976,7 +976,11 @@ export class ActivitiesService {
     ];
     if (!ids.length) return [];
     const count = await this.prisma.user.count({
-      where: { organizationId, id: { in: ids }, isActive: true },
+      where: {
+        id: { in: ids },
+        isActive: true,
+        memberships: { some: { organizationId, isActive: true } },
+      },
     });
     if (count !== ids.length) {
       throw new BadRequestException('یکی از مسئولان انتخاب‌شده معتبر نیست');

apps/api/src/leads/leads.service.ts

@@ -596,7 +596,11 @@ export class LeadsService {
       throw new BadRequestException('فقط مدیر می‌تواند تخصیص دهد');
     }
     const user = await this.prisma.user.findFirst({
-      where: { id: assigneeId, organizationId: actor.organizationId },
+      where: {
+        id: assigneeId,
+        isActive: true,
+        memberships: { some: { organizationId: actor.organizationId, isActive: true } },
+      },
     });
     if (!user) throw new NotFoundException('کارشناس پیدا نشد');
 
@@ -669,15 +673,14 @@ export class LeadsService {
     let assignees = opts.assigneeIds?.length
       ? await this.prisma.user.findMany({
           where: {
-            organizationId: actor.organizationId,
             id: { in: opts.assigneeIds },
             isActive: true,
+            memberships: { some: { organizationId: actor.organizationId, isActive: true } },
           },
           select: { id: true, fullName: true },
         })
       : await this.prisma.user.findMany({
           where: {
-            organizationId: actor.organizationId,
             isActive: true,
             memberships: {
               some: {

apps/api/src/pipelines/deals.service.ts

@@ -519,7 +519,11 @@ export class DealsService {
     ];
     if (!ids.length) return [];
     const count = await this.prisma.user.count({
-      where: { organizationId, id: { in: ids }, isActive: true },
+      where: {
+        id: { in: ids },
+        isActive: true,
+        memberships: { some: { organizationId, isActive: true } },
+      },
     });
     if (count !== ids.length) {
       throw new BadRequestException('یکی از مسئولان انتخاب‌شده معتبر نیست');