From 338b16d665f3e82bfe3ec8197db2fec778683baf Mon Sep 17 00:00:00 2001
From: Artyom Savchenko <armisav@gmail.com>
Date: Sat, 25 Apr 2026 18:29:08 +0700
Subject: [PATCH] Do not allow to assign guest as space owner (#10803)

* Exclude guests from space owners

Signed-off-by: Artem Savchenko <armisav@gmail.com>

* Show guest if he is in owners

Signed-off-by: Artem Savchenko <armisav@gmail.com>

---------

Signed-off-by: Artem Savchenko <armisav@gmail.com>
---
 .../src/components/navigator/CreateSpace.svelte  |  5 ++++-
 plugins/contact-resources/src/utils.ts           | 16 ++++++++++++++++
 .../docspace/CreateDocumentsSpace.svelte         |  4 +++-
 .../components/teamspace/CreateTeamspace.svelte  |  4 +++-
 .../src/components/CreateDrive.svelte            |  4 +++-
 .../src/components/CreateFunnel.svelte           |  4 +++-
 .../src/components/product/CreateProduct.svelte  |  4 +++-
 .../src/components/project/CreateProject.svelte  |  4 +++-
 .../src/components/projects/CreateProject.svelte |  9 ++++++++-
 9 files changed, 46 insertions(+), 8 deletions(-)

diff --git a/plugins/card-resources/src/components/navigator/CreateSpace.svelte b/plugins/card-resources/src/components/navigator/CreateSpace.svelte
index c68052a8f9..37a9d8a1f1 100644
--- a/plugins/card-resources/src/components/navigator/CreateSpace.svelte
+++ b/plugins/card-resources/src/components/navigator/CreateSpace.svelte
@@ -13,7 +13,7 @@
 // limitations under the License.
 -->
 <script lang="ts">
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     AccountRole,
     AccountUuid,
@@ -51,6 +51,8 @@
   let roles = client.getModel().findAllSync(card.class.Role, { types: { $in: types } })
   $: roles = client.getModel().findAllSync(card.class.Role, { types: { $in: types } })
 
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
+
   let name: string = space?.name ?? ''
 
   let isPrivate: boolean = space?.private ?? false
@@ -247,6 +249,7 @@
       </div>
       <AccountArrayEditor
         value={owners}
+        excludeItems={readOnlyGuestOwnerExcludeItems}
         label={core.string.Owners}
         onChange={handleOwnersChanged}
         kind={'regular'}
diff --git a/plugins/contact-resources/src/utils.ts b/plugins/contact-resources/src/utils.ts
index cb0eac7232..88eec57a5c 100644
--- a/plugins/contact-resources/src/utils.ts
+++ b/plugins/contact-resources/src/utils.ts
@@ -67,6 +67,7 @@ import core, {
   type Permission,
   type PersonId,
   pickPrimarySocialId,
+  readOnlyGuestAccountUuid,
   type Ref,
   type SocialId,
   SocialIdType,
@@ -373,6 +374,21 @@ export const primarySocialIdByEmployeeRefStore = writable<Map<Ref<Employee>, Per
  */
 export const employeeRefByAccountUuidStore = writable<Map<AccountUuid, Ref<Employee>>>(new Map())
 
+/**
+ * {@link Ref}<{@link Person}>[] for `excludeItems` so the read-only anonymous guest does not appear in the picker
+ * when not already selected. If they are in `selectedAccountUuids`, returns [] so they stay visible among chips.
+ */
+export function getAnonymousRefs (
+  byAccount: Map<AccountUuid, Ref<Employee>>,
+  selectedAccountUuids: readonly AccountUuid[] = []
+): Array<Ref<Person>> {
+  if (selectedAccountUuids.includes(readOnlyGuestAccountUuid)) {
+    return []
+  }
+  const ref = byAccount.get(readOnlyGuestAccountUuid)
+  return ref !== undefined ? [ref as unknown as Ref<Person>] : []
+}
+
 /**
  * [PersonId (social ID) => Employee] mapping
  */
diff --git a/plugins/controlled-documents-resources/src/components/docspace/CreateDocumentsSpace.svelte b/plugins/controlled-documents-resources/src/components/docspace/CreateDocumentsSpace.svelte
index 515c50bb2a..52f47eaef8 100644
--- a/plugins/controlled-documents-resources/src/components/docspace/CreateDocumentsSpace.svelte
+++ b/plugins/controlled-documents-resources/src/components/docspace/CreateDocumentsSpace.svelte
@@ -15,7 +15,7 @@
 <script lang="ts">
   import { deepEqual } from 'fast-equals'
   import { createEventDispatcher } from 'svelte'
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     Data,
     DocumentUpdate,
@@ -58,6 +58,7 @@
 
   $: isNew = docSpace === undefined
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
 
   let typeId: Ref<DocumentSpaceType> | undefined = docSpace?.type ?? documents.spaceType.DocumentSpaceType
   let spaceType: WithLookup<DocumentSpaceType> | undefined
@@ -283,6 +284,7 @@
     </div>
     <AccountArrayEditor
       value={owners}
+      excludeItems={readOnlyGuestOwnerExcludeItems}
       label={core.string.Owners}
       onChange={handleOwnersChanged}
       kind={'regular'}
diff --git a/plugins/document-resources/src/components/teamspace/CreateTeamspace.svelte b/plugins/document-resources/src/components/teamspace/CreateTeamspace.svelte
index 29f4f990b3..528c97077a 100644
--- a/plugins/document-resources/src/components/teamspace/CreateTeamspace.svelte
+++ b/plugins/document-resources/src/components/teamspace/CreateTeamspace.svelte
@@ -14,7 +14,7 @@
 -->
 <script lang="ts">
   import { deepEqual } from 'fast-equals'
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     Data,
     DocumentUpdate,
@@ -71,6 +71,7 @@
 
   $: isNew = teamspace === undefined
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
 
   let typeId: Ref<SpaceType> | undefined = teamspace?.type ?? document.spaceType.DefaultTeamspaceType
   let spaceType: WithLookup<SpaceType> | undefined
@@ -377,6 +378,7 @@
       </div>
       <AccountArrayEditor
         value={owners}
+        excludeItems={readOnlyGuestOwnerExcludeItems}
         label={core.string.Owners}
         onChange={handleOwnersChanged}
         kind={'regular'}
diff --git a/plugins/drive-resources/src/components/CreateDrive.svelte b/plugins/drive-resources/src/components/CreateDrive.svelte
index 4f10b1117f..46d5a5d71b 100644
--- a/plugins/drive-resources/src/components/CreateDrive.svelte
+++ b/plugins/drive-resources/src/components/CreateDrive.svelte
@@ -15,7 +15,7 @@
 <script lang="ts">
   import { deepEqual } from 'fast-equals'
   import { createEventDispatcher } from 'svelte'
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     Data,
     RolesAssignment,
@@ -58,6 +58,7 @@
   let spaceType: WithLookup<SpaceType> | undefined
 
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
   $: void loadSpaceType(typeId)
   const loadSpaceType = reduceCalls(async (id: typeof typeId): Promise<void> => {
     spaceType =
@@ -248,6 +249,7 @@
       </div>
       <AccountArrayEditor
         value={owners}
+        excludeItems={readOnlyGuestOwnerExcludeItems}
         label={core.string.Owners}
         onChange={handleOwnersChanged}
         kind={'regular'}
diff --git a/plugins/lead-resources/src/components/CreateFunnel.svelte b/plugins/lead-resources/src/components/CreateFunnel.svelte
index 42665e863d..f498685ac4 100644
--- a/plugins/lead-resources/src/components/CreateFunnel.svelte
+++ b/plugins/lead-resources/src/components/CreateFunnel.svelte
@@ -14,7 +14,7 @@
 // limitations under the License.
 -->
 <script lang="ts">
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     getCurrentAccount,
     Ref,
@@ -56,6 +56,7 @@
   let owners: AccountUuid[] = funnel?.owners !== undefined ? hierarchy.clone(funnel.owners) : [getCurrentAccount().uuid]
 
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
   $: void loadSpaceType(typeId)
   async function loadSpaceType (id: typeof typeId): Promise<void> {
     spaceType =
@@ -230,6 +231,7 @@
     </div>
     <AccountArrayEditor
       value={owners}
+      excludeItems={readOnlyGuestOwnerExcludeItems}
       label={core.string.Owners}
       onChange={handleOwnersChanged}
       kind={'regular'}
diff --git a/plugins/products-resources/src/components/product/CreateProduct.svelte b/plugins/products-resources/src/components/product/CreateProduct.svelte
index 272ea9113d..c9c803b7a8 100644
--- a/plugins/products-resources/src/components/product/CreateProduct.svelte
+++ b/plugins/products-resources/src/components/product/CreateProduct.svelte
@@ -23,7 +23,7 @@
   import { type Product, ProductVersionState } from '@hcengineering/products'
   import { type Attachment } from '@hcengineering/attachment'
   import { AttachmentPresenter, AttachmentStyledBox } from '@hcengineering/attachment-resources'
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import core, {
     AccountUuid,
     Data,
@@ -72,6 +72,7 @@
   let spaceType: WithLookup<SpaceType> | undefined
 
   $: membersPersons = object.members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, object.owners ?? [])
 
   let roles: Role[] = []
   const rolesQuery = createQuery()
@@ -327,6 +328,7 @@
 
     <AccountArrayEditor
       value={object.owners ?? []}
+      excludeItems={readOnlyGuestOwnerExcludeItems}
       label={core.string.Owners}
       emptyLabel={core.string.Owners}
       onChange={handleOwnersChanged}
diff --git a/plugins/test-management-resources/src/components/project/CreateProject.svelte b/plugins/test-management-resources/src/components/project/CreateProject.svelte
index 3220f9c969..099a8395ce 100644
--- a/plugins/test-management-resources/src/components/project/CreateProject.svelte
+++ b/plugins/test-management-resources/src/components/project/CreateProject.svelte
@@ -15,7 +15,7 @@
 <script lang="ts">
   import { deepEqual } from 'fast-equals'
   import { createEventDispatcher } from 'svelte'
-  import { AccountArrayEditor, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import { AccountArrayEditor, employeeRefByAccountUuidStore, getAnonymousRefs } from '@hcengineering/contact-resources'
   import { Asset } from '@hcengineering/platform'
   import core, {
     Data,
@@ -64,6 +64,7 @@
   let members: AccountUuid[] =
     project?.members !== undefined ? hierarchy.clone(project.members) : [getCurrentAccount().uuid]
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
   let owners: AccountUuid[] =
     project?.owners !== undefined ? hierarchy.clone(project.owners) : [getCurrentAccount().uuid]
   let rolesAssignment: RolesAssignment = {}
@@ -343,6 +344,7 @@
         </div>
         <AccountArrayEditor
           value={owners}
+          excludeItems={readOnlyGuestOwnerExcludeItems}
           label={core.string.Owners}
           onChange={handleOwnersChanged}
           kind={'regular'}
diff --git a/plugins/tracker-resources/src/components/projects/CreateProject.svelte b/plugins/tracker-resources/src/components/projects/CreateProject.svelte
index 7b80f18729..c444974158 100644
--- a/plugins/tracker-resources/src/components/projects/CreateProject.svelte
+++ b/plugins/tracker-resources/src/components/projects/CreateProject.svelte
@@ -15,7 +15,12 @@
 <script lang="ts">
   import { Analytics } from '@hcengineering/analytics'
   import { Employee } from '@hcengineering/contact'
-  import { AccountArrayEditor, AssigneeBox, employeeRefByAccountUuidStore } from '@hcengineering/contact-resources'
+  import {
+    AccountArrayEditor,
+    AssigneeBox,
+    employeeRefByAccountUuidStore,
+    getAnonymousRefs
+  } from '@hcengineering/contact-resources'
   import core, {
     AccountRole,
     AccountUuid,
@@ -83,6 +88,7 @@
   let typeId: Ref<ProjectType> | undefined = project?.type
   $: typeType = typeId !== undefined ? $typeStore.get(typeId) : undefined
   $: membersPersons = members.map((m) => $employeeRefByAccountUuidStore.get(m)).filter(notEmpty)
+  $: readOnlyGuestOwnerExcludeItems = getAnonymousRefs($employeeRefByAccountUuidStore, owners)
   let autoJoin = project?.autoJoin ?? typeType?.autoJoin ?? false
   let autoJoinForRoles: AccountRole[] =
     project?.autoJoinForRoles != null ? hierarchy.clone(project.autoJoinForRoles) : []
@@ -512,6 +518,7 @@
       </div>
       <AccountArrayEditor
         value={owners}
+        excludeItems={readOnlyGuestOwnerExcludeItems}
         label={core.string.Owners}
         allowGuests
         onChange={handleOwnersChanged}