From 278f42fd0a8ef6dfb0e8d49dfd206999ec19db97 Mon Sep 17 00:00:00 2001
From: actiontech-zihan <yangzhongjiao@actionsky.com>
Date: Thu, 20 Aug 2026 20:25:54 +0800
Subject: [PATCH] fix: reject disabled and deleted users when adding project
 members

Validate membership eligibility before CreateMember so disabled or deleted
users cannot be written via AddMember API.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 internal/dms/biz/member.go |  8 +++-----
 internal/dms/biz/user.go   | 18 ++++++++++++++++++
 2 files changed, 21 insertions(+), 5 deletions(-)

diff --git a/internal/dms/biz/member.go b/internal/dms/biz/member.go
index d9008e284..b7973d269 100644
--- a/internal/dms/biz/member.go
+++ b/internal/dms/biz/member.go
@@ -99,11 +99,9 @@ func (m *MemberUsecase) CreateMember(ctx context.Context, currentUserUid string,
 			return "", fmt.Errorf("create member error: %v", err)
 		}
 
-		// 检查成员用户存在
-		if exist, err := m.userUsecase.CheckUserExist(ctx, []string{memberUserUid}); err != nil {
-			return "", fmt.Errorf("check user exist failed: %v", err)
-		} else if !exist {
-			return "", fmt.Errorf("user not exist")
+		// 检查成员用户可纳入（存在、未删除、状态正常）
+		if err := m.userUsecase.EnsureUserEligibleForProjectMembership(ctx, memberUserUid); err != nil {
+			return "", err
 		}
 
 		if err := m.CheckRoleAndOpRanges(ctx, roleAndOpRanges); err != nil {
diff --git a/internal/dms/biz/user.go b/internal/dms/biz/user.go
index 035750787..49e1abc1d 100644
--- a/internal/dms/biz/user.go
+++ b/internal/dms/biz/user.go
@@ -627,6 +627,24 @@ func (d *UserUsecase) CheckUserExist(ctx context.Context, userUids []string) (ex
 	return d.repo.CheckUserExist(ctx, userUids)
 }
 
+// EnsureUserEligibleForProjectMembership 校验用户可被新纳入项目成员/成员组：存在、未删除、状态正常。
+func (d *UserUsecase) EnsureUserEligibleForProjectMembership(ctx context.Context, userUid string) error {
+	user, err := d.repo.GetUserIncludeDeleted(ctx, userUid)
+	if err != nil {
+		if errors.Is(err, pkgErr.ErrStorageNoData) {
+			return fmt.Errorf("user not exist")
+		}
+		return fmt.Errorf("get user failed: %v", err)
+	}
+	if user.Deleted {
+		return fmt.Errorf("user has been deleted")
+	}
+	if user.Stat != UserStatOK {
+		return fmt.Errorf("user is disabled")
+	}
+	return nil
+}
+
 // InsureUserToUserGroups 确保用户属于指定的多个用户组
 func (d *UserUsecase) InsureUserToUserGroups(ctx context.Context, userGroupUids []string, userUid string) (err error) {
 	// check