fix: prevent ghost memberships from soft-deleted users

2026-06-10 05:30:24 +00:00
parent 05589ce442
commit a6d74d9316
4 changed files with 61 additions and 15 deletions
@@ -68,11 +68,18 @@ class Organization(BaseModel):
    def is_member(self, user_id: str) -> bool:
        """Check if a user is a member of the organization."""
        from gatehouse_app.models.organization.organization_member import OrganizationMember
+        from gatehouse_app.models.user.user import User

        return (
-            OrganizationMember.query.filter_by(
-                user_id=user_id, organization_id=self.id, deleted_at=None
-            ).first()
+            db.session.query(OrganizationMember)
+            .join(User, OrganizationMember.user_id == User.id)
+            .filter(
+                OrganizationMember.user_id == user_id,
+                OrganizationMember.organization_id == self.id,
+                OrganizationMember.deleted_at.is_(None),
+                User.deleted_at.is_(None),
+            )
+            .first()
            is not None
        )
    def get_active_members(self):