Backport: Verify users belong to workspace before removing them

lib/Space/SpaceManager.php

@@ -430,11 +430,20 @@ public function removeUsersFromWorkspace(int $id, array $uids): void {
 			throw new OCSBadRequestException('uids params must contain an array of strings');
 		}
 
+		$userGid = UserGroup::get($id);
+		$userGroup = $this->groupManager->get($userGid);
+
 		$usersNotExist = [];
+		$usersAreNotPresentInWorkspace = [];
 		foreach ($uids as $uid) {
 			$user = $this->userManager->get($uid);
 			if (is_null($user)) {
 				$usersNotExist[] = $uid;
+				continue;
+			}
+
+			if (!$userGroup->inGroup($user)) {
+				$usersAreNotPresentInWorkspace[] = $uid;
 			}
 		}
 
@@ -444,6 +453,12 @@ public function removeUsersFromWorkspace(int $id, array $uids): void {
 			throw new OCSBadRequestException('These users not exist on your Nextcloud instance : ' . PHP_EOL . $formattedUsers);
 		}
 
+		if (!empty($usersAreNotPresentInWorkspace)) {
+			$formattedUsers = implode(array_map(fn ($user) => "- {$user}\n", $usersAreNotPresentInWorkspace));
+			throw new NotFoundException("These users were not found in the workspace {$space['name']}: {$formattedUsers}");
+
+		}
+
 		$managerGid = WorkspaceManagerGroup::get($id);
 		$managerGroup = $this->groupManager->get($managerGid);
 

tests/Unit/Space/SpaceManagerTest.php

@@ -1160,6 +1160,15 @@ public function testRemoveUsersFromWorkspace(): void {
 			})
 		;
 
+		$userGroup
+			->expects($this->any())
+			->method('inGroup')
+			->with(
+				$this->logicalOr($user1, $user2)
+			)
+			->willReturnOnConsecutiveCalls(true, true)
+		;
+
 		$userGroup
 			->expects($this->any())
 			->method('removeUser')