fix: external users can be added to groups manually (#1540)

packages/api/src/router/user.ts

@@ -160,16 +160,17 @@ export const userRouter = createTRPCRouter({
     }),
   // Is protected because also used in board access / integration access forms
   selectable: protectedProcedure
-    .input(z.undefined())
+    .input(z.object({ excludeExternalProviders: z.boolean().default(false) }).optional())
     .output(z.array(selectUserSchema.pick({ id: true, name: true, image: true })))
     .meta({ openapi: { method: "GET", path: "/api/users/selectable", tags: ["users"], protect: true } })
-    .query(({ ctx }) => {
+    .query(({ ctx, input }) => {
       return ctx.db.query.users.findMany({
         columns: {
           id: true,
           name: true,
           image: true,
         },
+        where: input?.excludeExternalProviders ? eq(users.provider, "credentials") : undefined,
       });
     }),
   search: permissionRequiredProcedure