do not consider shared with users members

app/models/members/scopes/of.rb

@@ -31,9 +31,10 @@ module Of
     extend ActiveSupport::Concern
 
     class_methods do
-      # Find all members of a project
+      # Find all members of a project.
+      # Members on entities like WorkPackage are excluded.
       def of(project)
-        where(project_id: project)
+        where(project_id: project, entity: nil)
       end
     end
   end

app/models/queries/principals/filters/member_filter.rb

@@ -59,6 +59,8 @@ def visible_scope
   end
 
   def member_included_scope
-    visible_scope.includes(:members)
+    visible_scope
+      .includes(:members)
+      .where(members: { entity: nil })
   end
 end

spec/features/members/membership_spec.rb

@@ -171,4 +171,21 @@
     expect(members_page).not_to have_alert_dialog
     expect(members_page).to have_search_result "<script>alert('h4x');</script>"
   end
+
+  context 'with work packages shared' do
+    let(:work_package) { create(:work_package, project:) }
+    let(:view_work_package_role) { create(:view_work_package_role) }
+    let(:member) { create(:member, entity: work_package, principal: peter, project:, roles: [view_work_package_role]) }
+
+    let!(:existing_members) { [member] }
+
+    it 'still allows adding the user the work package is shared with' do
+      members_page.open_new_member!
+
+      SeleniumHubWaiter.wait
+
+      members_page.search_principal! peter.firstname
+      expect(members_page).to have_search_result peter.name
+    end
+  end
 end

spec/models/members/scopes/of_spec.rb

@@ -0,0 +1,88 @@
+# -- copyright
+# OpenProject is an open source project management software.
+# Copyright (C) 2010-2023 the OpenProject GmbH
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License version 3.
+#
+# OpenProject is a fork of ChiliProject, which is a fork of Redmine. The copyright follows:
+# Copyright (C) 2006-2013 Jean-Philippe Lang
+# Copyright (C) 2010-2013 the ChiliProject Team
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
+#
+# See COPYRIGHT and LICENSE files for more details.
+# ++
+
+require 'spec_helper'
+
+RSpec.describe Members::Scopes::Of do
+  let(:project) { create(:project) }
+  let(:other_project) { create(:project) }
+  let(:role) { create(:project_role) }
+
+  let!(:invited_user_member) do
+    create(:member,
+           project:,
+           roles: [role],
+           principal: create(:user, status: Principal.statuses[:invited]))
+  end
+  let!(:registered_user_member) do
+    create(:member,
+           project:,
+           roles: [role],
+           principal: create(:user, status: Principal.statuses[:registered]))
+  end
+  let!(:locked_user_member) do
+    create(:member,
+           project:,
+           roles: [role],
+           principal: create(:user, status: Principal.statuses[:locked]))
+  end
+  let!(:active_user_member) do
+    create(:member,
+           project:,
+           roles: [role],
+           principal: create(:user, status: Principal.statuses[:active]))
+  end
+  let!(:active_user_member_in_other_project) do
+    create(:member,
+           project: other_project,
+           roles: [role],
+           principal: create(:user, status: Principal.statuses[:active]))
+  end
+  let!(:group_member) do
+    create(:member,
+           project:,
+           roles: [role],
+           principal: create(:group))
+  end
+  let!(:active_user_shared_member) do
+    create(:member,
+           project:,
+           roles: [create(:view_work_package_role)],
+           entity: create(:work_package, project:),
+           principal: create(:user, status: Principal.statuses[:active]))
+  end
+
+  describe '.of' do
+    subject { Member.of(project) }
+
+    it 'returns all members but not those of entities in the project' do
+      expect(subject)
+        .to contain_exactly(active_user_member, invited_user_member, registered_user_member, group_member, locked_user_member)
+    end
+  end
+end

spec/models/principals/scopes/possible_member_spec.rb

@@ -55,6 +55,26 @@
   let!(:member_group) do
     create(:group, member_with_roles: { project => role })
   end
+  let(:view_work_package_role) { create(:view_work_package_role) }
+  let(:work_package) { create(:work_package, project:, author: active_user) }
+  let!(:shared_work_package_with_user) do
+    create(:user) do |user|
+      create(:work_package_member,
+             project:,
+             entity: work_package,
+             user:,
+             roles: [view_work_package_role])
+    end
+  end
+  let!(:shared_work_package_with_group) do
+    create(:group) do |group|
+      create(:work_package_member,
+             project:,
+             entity: work_package,
+             user: group,
+             roles: [view_work_package_role])
+    end
+  end
 
   describe '.possible_member' do
     subject { Principal.possible_member(project) }
@@ -72,7 +92,9 @@
 
       it 'returns non locked users, groups and placeholder users not part of the project yet' do
         expect(subject).to contain_exactly(admin_user, global_manager, active_user, registered_user, invited_user,
-                                           placeholder_user, group, member_in_public_project)
+                                           placeholder_user, group, member_in_public_project,
+                                           shared_work_package_with_user,
+                                           shared_work_package_with_group)
       end
     end
 
@@ -81,7 +103,9 @@
 
       it 'returns non locked users, groups and placeholder users not part of the project yet' do
         expect(subject).to contain_exactly(admin_user, global_manager, active_user, registered_user, invited_user,
-                                           placeholder_user, group, member_in_public_project)
+                                           placeholder_user, group, member_in_public_project,
+                                           shared_work_package_with_user,
+                                           shared_work_package_with_group)
       end
     end
   end