Fix visibility scope of groups in members filters

app/controllers/members_controller.rb

@@ -166,7 +166,7 @@ def members_table_options(roles)
   end
 
   def members_filter_options(roles)
-    groups = Group.all.sort
+    groups = Group.visible.sort
     shares = WorkPackageRole.all
     status = Members::UserFilterComponent.status_param(params)
 

app/controllers/users_controller.rb

@@ -67,7 +67,7 @@ class UsersController < ApplicationController
   include PaginationHelper
 
   def index
-    @groups = Group.all.sort
+    @groups = Group.visible.sort
     @status = Users::UserFilterComponent.status_param params
     @users = Users::UserFilterComponent.filter params
   end

app/models/queries/work_packages/filter/group_filter.rb

@@ -93,6 +93,6 @@ def user_ids_for_filtering
   end
 
   def all_groups
-    @all_groups ||= ::Group.all
+    @all_groups ||= ::Group.visible
   end
 end

spec/controllers/members_controller_spec.rb

@@ -211,6 +211,26 @@
     end
   end
 
+  describe "#index" do
+    let(:role) { create(:project_role, permissions: [:manage_members]) }
+    let!(:member) { create(:member, project:, user:, roles: [role]) }
+
+    let!(:visible_group) { create(:group, members: [user]) }
+    let!(:hidden_group) { create(:group) }
+
+    before { login_as(user) }
+
+    it "only includes groups the user is a member of in the filter options" do
+      get :index, params: { project_id: project.id }
+
+      expect(response).to be_successful
+
+      groups = assigns(:members_filter_options)[:groups]
+      expect(groups).to include(visible_group)
+      expect(groups).not_to include(hidden_group)
+    end
+  end
+
   describe "#create with reduced visibility" do
     let(:project_permissions) { %i[manage_members invite_members_by_email] }
     let!(:other_project) { create(:project) }

spec/models/queries/work_packages/filter/group_filter_spec.rb

@@ -59,7 +59,7 @@
     describe "#allowed_values" do
       before do
         allow(Group)
-          .to receive(:all)
+          .to receive(:visible)
           .and_return [group]
       end
 
@@ -81,7 +81,7 @@
 
       before do
         allow(Group)
-          .to receive(:all)
+          .to receive(:visible)
           .and_return([group, group2])
 
         instance.values = [group2.id.to_s]

spec/views/users/index.html.erb_spec.rb

@@ -41,7 +41,7 @@
 
     assign(:users, User.where(id: [admin.id, user.id]))
     assign(:status, "all")
-    assign(:groups, Group.all)
+    assign(:groups, Group.visible)
 
     without_partial_double_verification do
       allow(view).to receive_messages(current_user: admin, controller_name: "users", action_name: "index")