fix: external users can be added to groups manually (#1540)

apps/nextjs/src/app/[locale]/manage/users/groups/[id]/members/_add-group-member.tsx

@@ -32,6 +32,7 @@ export const AddGroupMember = ({ groupId, presentUserIds }: AddGroupMemberProps)
           await revalidatePathActionAsync(`/manage/users/groups/${groupId}}/members`);
         },
         presentUserIds,
+        excludeExternalProviders: true,
       },
       {
         title: tMembersAdd("label"),

apps/nextjs/src/components/access/user-select-modal.tsx

@@ -12,6 +12,7 @@ import { UserAvatar } from "@homarr/ui";
 
 interface InnerProps {
   presentUserIds: string[];
+  excludeExternalProviders?: boolean;
   onSelect: (props: { id: string; name: string; image: string }) => void | Promise<void>;
   confirmLabel?: string;
 }
@@ -22,7 +23,9 @@ interface UserSelectFormType {
 
 export const UserSelectModal = createModal<InnerProps>(({ actions, innerProps }) => {
   const t = useI18n();
-  const { data: users, isPending } = clientApi.user.selectable.useQuery();
+  const { data: users, isPending } = clientApi.user.selectable.useQuery({
+    excludeExternalProviders: innerProps.excludeExternalProviders,
+  });
   const [loading, setLoading] = useState(false);
   const form = useForm<UserSelectFormType>();
   const handleSubmitAsync = async (values: UserSelectFormType) => {

packages/api/src/router/user.ts

@@ -160,16 +160,17 @@ export const userRouter = createTRPCRouter({
     }),
   // Is protected because also used in board access / integration access forms
   selectable: protectedProcedure
-    .input(z.undefined())
+    .input(z.object({ excludeExternalProviders: z.boolean().default(false) }).optional())
     .output(z.array(selectUserSchema.pick({ id: true, name: true, image: true })))
     .meta({ openapi: { method: "GET", path: "/api/users/selectable", tags: ["users"], protect: true } })
-    .query(({ ctx }) => {
+    .query(({ ctx, input }) => {
       return ctx.db.query.users.findMany({
         columns: {
           id: true,
           name: true,
           image: true,
         },
+        where: input?.excludeExternalProviders ? eq(users.provider, "credentials") : undefined,
       });
     }),
   search: permissionRequiredProcedure