feat(activities): let a group show and limit its members

Empty membership stays open to the whole workspace; picking people restricts who can see that activity group.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/activities/activities.controller.ts

@@ -72,14 +72,14 @@ export class ActivitiesController {
 
   @Get('boards')
   listBoards(@CurrentUser() user: Actor) {
-    return this.stagesService.listBoards(user.organizationId);
+    return this.stagesService.listBoards(user.organizationId, user);
   }
 
   @Post('boards')
   @UseGuards(RolesGuard)
   @Roles('owner', 'admin')
   createBoard(@CurrentUser() user: Actor, @Body() dto: CreateActivityBoardDto) {
-    return this.stagesService.createBoard(user.organizationId, dto.name);
+    return this.stagesService.createBoard(user.organizationId, dto.name, dto.memberIds);
   }
 
   @Patch('boards/:id')
@@ -103,7 +103,7 @@ export class ActivitiesController {
 
   @Get('stages')
   listStages(@CurrentUser() user: Actor, @Query() query: ListActivityStagesQueryDto) {
-    return this.stagesService.list(user.organizationId, query.boardId);
+    return this.stagesService.list(user.organizationId, query.boardId, user);
   }
 
   @Post('stages')

apps/api/src/activities/activities.service.ts

@@ -277,6 +277,7 @@ export class ActivitiesService {
     const boardCtx = await this.stages.boardContext(organizationId);
     if (facets?.boardId) {
       const boardId = await this.stages.resolveBoardId(organizationId, facets.boardId);
+      await this.stages.assertCanAccessBoard(organizationId, boardId, actor);
       (where.AND as Prisma.ActivityWhereInput[]).push(
         this.stages.boardWhere(boardId, boardCtx.defaultBoardId),
       );
@@ -320,6 +321,7 @@ export class ActivitiesService {
     facets?: ListFacets,
   ): Promise<ActivityStageCountsDto> {
     const boardId = await this.stages.resolveBoardId(organizationId, facets?.boardId);
+    await this.stages.assertCanAccessBoard(organizationId, boardId, actor);
     const defaultBoard = await this.stages.ensureDefaultBoard(organizationId);
     const rows = await this.stages.rows(organizationId, boardId);
     const defaults = this.stages.defaultsOf(rows);
@@ -451,6 +453,7 @@ export class ActivitiesService {
       : requestedBoardId
         ? await this.stages.resolveBoardId(organizationId, requestedBoardId)
         : null;
+    if (boardId) await this.stages.assertCanAccessBoard(organizationId, boardId, linkActor);
     const resolved = await this.types.resolve(organizationId, {
       typeDefId: dto.typeDefId,
       type: dto.type,
@@ -571,6 +574,7 @@ export class ActivitiesService {
         select: { boardId: true },
       });
       const defaultBoard = await this.stages.ensureDefaultBoard(organizationId);
+      await this.stages.assertCanAccessBoard(organizationId, nextBoardId, actor);
       if (nextBoardId !== (current?.boardId ?? defaultBoard.id)) {
         // ستون قبلی مال گروه دیگر است؛ فعالیت به ستون اولِ هم‌وضعیت گروه جدید می‌رود
         data.boardId = nextBoardId;

apps/api/src/activities/activity-stages.service.ts

@@ -1,4 +1,9 @@
-import { BadRequestException, Injectable, NotFoundException } from '@nestjs/common';
+import {
+  BadRequestException,
+  ForbiddenException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
 import type {
   ActivityBoardDto,
   ActivityStageColor,
@@ -34,8 +39,23 @@ type BoardRow = {
   name: string;
   isDefault: boolean;
   position: number;
+  members: Array<{ userId: string }>;
 };
 
+function toBoardDto(row: BoardRow): ActivityBoardDto {
+  return {
+    id: row.id,
+    name: row.name,
+    isDefault: row.isDefault,
+    position: row.position,
+    memberIds: row.members.map((member) => member.userId),
+  };
+}
+
+function managesAllBoards(role: string) {
+  return role === 'owner' || role === 'admin';
+}
+
 const STAGE_SELECT = {
   id: true,
   boardId: true,
@@ -50,6 +70,7 @@ const BOARD_SELECT = {
   name: true,
   isDefault: true,
   position: true,
+  members: { select: { userId: true } },
 } satisfies Prisma.ActivityBoardSelect;
 
 export type StageDefaults = Record<ActivityStatus, string | null>;
@@ -109,14 +130,36 @@ export class ActivityStagesService {
     });
   }
 
-  async listBoards(organizationId: string): Promise<ActivityBoardDto[]> {
+  async listBoards(
+    organizationId: string,
+    actor?: { userId: string; role: string },
+  ): Promise<ActivityBoardDto[]> {
     await this.ensureDefaultBoard(organizationId);
     const rows = await this.prisma.activityBoard.findMany({
       where: { organizationId },
       orderBy: [{ isDefault: 'desc' }, { position: 'asc' }, { createdAt: 'asc' }],
       select: BOARD_SELECT,
     });
-    return rows.map((b) => ({ ...b }));
+    const boards = rows.map(toBoardDto);
+    if (!actor || managesAllBoards(actor.role)) return boards;
+    return boards.filter(
+      (board) => board.memberIds.length === 0 || board.memberIds.includes(actor.userId),
+    );
+  }
+
+  /** گروه بدون عضو برای همه باز است؛ مالک و مدیر همهٔ گروه‌ها را می‌بینند */
+  async assertCanAccessBoard(
+    organizationId: string,
+    boardId: string,
+    actor: { userId: string; role: string },
+  ) {
+    if (managesAllBoards(actor.role)) return;
+    const members = await this.prisma.activityBoardMember.findMany({
+      where: { boardId, board: { organizationId } },
+      select: { userId: true },
+    });
+    if (!members.length || members.some((member) => member.userId === actor.userId)) return;
+    throw new ForbiddenException('به این گروه فعالیت دسترسی ندارید');
   }
 
   /** شناسهٔ گروه معتبر؛ خالی = گروه پیش‌فرض */
@@ -131,7 +174,11 @@ export class ActivityStagesService {
     return board.id;
   }
 
-  async createBoard(organizationId: string, name: string): Promise<ActivityBoardDto> {
+  async createBoard(
+    organizationId: string,
+    name: string,
+    memberIds?: string[],
+  ): Promise<ActivityBoardDto> {
     await this.ensureDefaultBoard(organizationId);
     const max = await this.prisma.activityBoard.aggregate({
       where: { organizationId },
@@ -147,7 +194,8 @@ export class ActivityStagesService {
         select: BOARD_SELECT,
       });
       await this.ensureBoardStages(organizationId, board.id);
-      return { ...board };
+      if (memberIds !== undefined) await this.replaceMembers(organizationId, board.id, memberIds);
+      return this.getBoardDto(organizationId, board.id);
     } catch (e) {
       throw this.mapBoardError(e);
     }
@@ -156,21 +204,51 @@ export class ActivityStagesService {
   async updateBoard(
     organizationId: string,
     id: string,
-    dto: { name?: string },
+    dto: { name?: string; memberIds?: string[] },
   ): Promise<ActivityBoardDto> {
     await this.getBoard(organizationId, id);
     try {
-      const board = await this.prisma.activityBoard.update({
-        where: { id },
-        data: dto.name != null ? { name: this.cleanBoardName(dto.name) } : {},
-        select: BOARD_SELECT,
-      });
-      return { ...board };
+      if (dto.name != null) {
+        await this.prisma.activityBoard.update({
+          where: { id },
+          data: { name: this.cleanBoardName(dto.name) },
+        });
+      }
+      if (dto.memberIds !== undefined) await this.replaceMembers(organizationId, id, dto.memberIds);
+      return this.getBoardDto(organizationId, id);
     } catch (e) {
       throw this.mapBoardError(e);
     }
   }
 
+  private async replaceMembers(organizationId: string, boardId: string, memberIds: string[]) {
+    const ids = [...new Set(memberIds.map((id) => id.trim()).filter(Boolean))];
+    if (ids.length) {
+      const found = await this.prisma.membership.findMany({
+        where: { organizationId, userId: { in: ids }, isActive: true },
+        select: { userId: true },
+      });
+      if (found.length !== ids.length) {
+        throw new BadRequestException('بعضی از اعضا در این محیط نیستند');
+      }
+    }
+    await this.prisma.activityBoardMember.deleteMany({ where: { boardId } });
+    if (ids.length) {
+      await this.prisma.activityBoardMember.createMany({
+        data: ids.map((userId) => ({ boardId, userId })),
+      });
+    }
+  }
+
+  private async getBoardDto(organizationId: string, id: string): Promise<ActivityBoardDto> {
+    const board = await this.prisma.activityBoard.findFirst({
+      where: { id, organizationId },
+      select: BOARD_SELECT,
+    });
+    if (!board) throw new NotFoundException('گروه فعالیت پیدا نشد');
+    return toBoardDto(board);
+  }
+
   /** فعالیت‌های گروه حذف‌شده به گروه پیش‌فرض (ستون اولِ هم‌وضعیت) منتقل می‌شوند */
   async removeBoard(organizationId: string, id: string): Promise<void> {
     const board = await this.getBoard(organizationId, id);
@@ -213,8 +291,14 @@ export class ActivityStagesService {
     });
   }
 
-  async list(organizationId: string, boardId?: string | null): Promise<ActivityStageDto[]> {
-    return (await this.rows(organizationId, boardId)).map((r) => this.toDto(r));
+  async list(
+    organizationId: string,
+    boardId?: string | null,
+    actor?: { userId: string; role: string },
+  ): Promise<ActivityStageDto[]> {
+    const resolved = await this.resolveBoardId(organizationId, boardId);
+    if (actor) await this.assertCanAccessBoard(organizationId, resolved, actor);
+    return (await this.rows(organizationId, resolved)).map((r) => this.toDto(r));
   }
 
   /** اولین مرحلهٔ هر نوع = مقصد فعالیت‌های بدون مرحله یا با مرحلهٔ ناهم‌نوع */

apps/api/src/activities/dto.ts

@@ -131,6 +131,11 @@ export class CreateActivityBoardDto {
   @MinLength(2)
   @MaxLength(80)
   name!: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  memberIds?: string[];
 }
 
 export class UpdateActivityBoardDto {
@@ -139,6 +144,11 @@ export class UpdateActivityBoardDto {
   @MinLength(2)
   @MaxLength(80)
   name?: string;
+
+  @IsOptional()
+  @IsArray()
+  @IsString({ each: true })
+  memberIds?: string[];
 }
 
 export class ListActivityStagesQueryDto {