fix: a group filter value that is not a group id lists nobody (D-23)

User.FilterScope handed the filter value to the database as it came. A
value such as abc failed the query, so the Users list answered 500.

- groupFilterID reads a positive whole number, as a number or its text
- any other value narrows the list to nothing
- TestAdminUsersGroupFilterValue fails with a 500 without the change

models/user.go

@@ -1,6 +1,9 @@
 package models
 
 import (
+	"fmt"
+	"strconv"
+	"strings"
 	"time"
 
 	"git.golem15.com/golem15/summercms/modules/lagoon/attach"
@@ -99,7 +102,7 @@ const FilterByGroup = "filterByGroup"
 func (User) FilterScopes() []string { return []string{FilterByGroup} }
 
 // FilterScope narrows db to the members of the group whose id is value. Any
-// other scope name matches nothing.
+// other scope name, and a value that is not a group id, match nothing.
 func (User) FilterScope(name string, db *gorm.DB, value any) *gorm.DB {
 	if db == nil {
 		return db
@@ -107,7 +110,26 @@ func (User) FilterScope(name string, db *gorm.DB, value any) *gorm.DB {
 	if name != FilterByGroup {
 		return db.Where("1 = 0")
 	}
-	return db.Where("users.id IN (SELECT user_id FROM users_groups WHERE user_group_id = ?)", value)
+	id, ok := groupFilterID(value)
+	if !ok {
+		return db.Where("1 = 0")
+	}
+	return db.Where("users.id IN (SELECT user_id FROM users_groups WHERE user_group_id = ?)", id)
+}
+
+// groupFilterID reads the value of the group filter: a positive whole number,
+// as a number or as its decimal text. Anything else is not a group id, and
+// handing it to the database would fail the whole list.
+func groupFilterID(value any) (uint64, bool) {
+	text := strings.TrimSpace(fmt.Sprint(value))
+	if value == nil || text == "" {
+		return 0, false
+	}
+	id, err := strconv.ParseUint(text, 10, 32)
+	if err != nil || id == 0 {
+		return 0, false
+	}
+	return id, true
 }
 
 func init() {