feat(service): expand service layer with new domain operations

- Add IM service modules: audit, channel roles, custom emojis, forum
  tags, integrations, invitations, repo links, slash commands, stages,
  voice, webhooks
- Add PR service modules: review requests, templates
- Add repo service modules: contributors, release assets, git extras
  (archive, branch rename, commit extras, diff/merge, tag, tree)
- Add user service: social (follow/block)
- Add internal auth service
- Update existing service modules with expanded functionality
- Remove deleted IM modules: articles, delivery trace, drafts,
  follows, messages, polls, presence, reactions, threads

service/issues/assignees.rs

@@ -5,7 +5,7 @@ use crate::models::issues::IssueAssignee;
 use crate::service::IssueService;
 use crate::session::Session;
 
-use super::util::{clamp_limit_offset, ensure_affected};
+use super::util::{clamp_limit_offset, ensure_affected, set_local_user_id};
 
 impl IssueService {
     pub async fn issue_assignees(
@@ -44,6 +44,24 @@ impl IssueService {
         let issue = self.resolve_issue(wk_name, number).await?;
         let issue_id = issue.id;
         self.ensure_issue_editable(user_uid, &issue).await?;
+
+        // Verify assignee is a workspace member
+        let is_member: bool = sqlx::query_scalar(
+            "SELECT EXISTS(SELECT 1 FROM workspace_member \
+             WHERE workspace_id = $1 AND user_id = $2 AND status = 'active')",
+        )
+        .bind(issue.workspace_id)
+        .bind(assignee_id)
+        .fetch_one(self.ctx.db.reader())
+        .await
+        .map_err(AppError::Database)?;
+
+        if !is_member {
+            return Err(AppError::BadRequest(
+                "user is not a member of this workspace".into(),
+            ));
+        }
+
         let now = chrono::Utc::now();
         let mut txn = self
             .ctx
@@ -52,8 +70,7 @@ impl IssueService {
             .begin()
             .await
             .map_err(|_| AppError::TxnError)?;
-        sqlx::query("SET LOCAL app.current_user_id = $1")
-            .bind(user_uid)
+        sqlx::query(set_local_user_id(user_uid))
             .execute(&mut *txn)
             .await
             .map_err(AppError::Database)?;
@@ -102,8 +119,7 @@ impl IssueService {
             .begin()
             .await
             .map_err(|_| AppError::TxnError)?;
-        sqlx::query("SET LOCAL app.current_user_id = $1")
-            .bind(user_uid)
+        sqlx::query(set_local_user_id(user_uid))
             .execute(&mut *txn)
             .await
             .map_err(AppError::Database)?;