fix: complete audit security and frontend gaps

backend/internal/tasks/service.go

@@ -50,6 +50,9 @@ func (s *Service) ShareObject(taskID uint, objectType string, objectID uint) err
 		if err := tx.First(&task, taskID).Error; err != nil {
 			return err
 		}
+		if err := ensureSharedObjectInProject(tx, task.ProjectID, objectType, objectID); err != nil {
+			return err
+		}
 		if err := tx.Create(&domain.TaskShare{TaskID: taskID, ObjectType: objectType, ObjectID: objectID}).Error; err != nil {
 			return err
 		}
@@ -82,3 +85,25 @@ func (s *Service) VisibleLinkedObjects(taskID uint, viewerID uint) ([]LinkedObje
 	}
 	return objects, nil
 }
+
+func ensureSharedObjectInProject(tx *gorm.DB, projectID uint, objectType string, objectID uint) error {
+	switch objectType {
+	case "note":
+		var count int64
+		if err := tx.Model(&domain.Note{}).Where("id = ? AND project_id = ?", objectID, projectID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count == 0 {
+			return errors.New("shared object not found in task project")
+		}
+	case "source":
+		var count int64
+		if err := tx.Model(&domain.Source{}).Where("id = ? AND project_id = ?", objectID, projectID).Count(&count).Error; err != nil {
+			return err
+		}
+		if count == 0 {
+			return errors.New("shared object not found in task project")
+		}
+	}
+	return nil
+}

backend/internal/tasks/service_test.go

@@ -40,6 +40,19 @@ func TestShareObjectRejectsUnsupportedType(t *testing.T) {
 	require.ErrorContains(t, err, "unsupported shared object type")
 }
 
+func TestShareObjectRejectsObjectFromAnotherProject(t *testing.T) {
+	database := newTestDB(t)
+	task := domain.Task{ProjectID: 1, CreatedBy: 1, Title: "Review"}
+	note := domain.Note{ProjectID: 2, CreatedBy: 1, Title: "Other project", Markdown: "Private context"}
+	require.NoError(t, database.Create(&task).Error)
+	require.NoError(t, database.Create(&note).Error)
+	service := NewService(database)
+
+	err := service.ShareObject(task.ID, "note", note.ID)
+
+	require.ErrorContains(t, err, "shared object not found in task project")
+}
+
 func TestAssignRecordsProjectEvent(t *testing.T) {
 	database := newTestDB(t)
 	task := domain.Task{ProjectID: 7, CreatedBy: 1, Title: "安排评审"}