fix: update get_user_list method to include user_id for workspace validation

[shaohuzhang1]

fix: update get_user_list method to include user_id for workspace validation

[shaohuzhang1]

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

[Copilot]

Pull request overview

This PR updates the workspace-scoped user listing endpoint to pass the current user’s ID into the serializer, enabling validation that the requesting user belongs to the target workspace before returning users.

Changes:

• Updated WorkspaceUserListView to pass request.user.id into get_user_list.
• Changed UserManageSerializer.get_user_list signature and added workspace-membership validation logic.
• Minor refactors/formatting in apps/users/serializers/user.py (imports and a resource-mapping helper).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
apps/users/views/user.py	Passes current user ID into the workspace user-list serializer call.
apps/users/serializers/user.py	Adds user_id parameter to get_user_list and implements workspace membership validation logic.

Suppressed comments (2)

apps/users/serializers/user.py:566

• get_user_list is currently granting admin-like access based on a hard-coded UUID and, in the EE/workspace-mapping branch, will return an empty list for users that are authorized by @has_permissions (e.g., RoleConstants.ADMIN) but not explicitly mapped to the workspace. Derive an is_admin flag from the actual user record/role and use it consistently to bypass the workspace-membership check, instead of relying on a literal UUID comparison inside the query logic.

    def get_user_list(self, user_id,workspace_id, nick_name):
        """
        获取用户列表
        :param workspace_id: 工作空间ID
        :return: 用户列表

apps/users/serializers/user.py:829

• defaultdict is already imported at module scope, so re-importing it inside _get_resource_maps is redundant. Remove the local import to keep imports centralized and avoid unnecessary per-call work.

    from collections import defaultdict

    from application.models import Application, ApplicationFolder

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.