feat: validate sender before creating campaign (#10934)

app/models/campaign.rb

@@ -37,6 +37,8 @@ class Campaign < ApplicationRecord
   validate :validate_campaign_inbox
   validate :validate_url
   validate :prevent_completed_campaign_from_update, on: :update
+  validate :sender_must_belong_to_account
+
   belongs_to :account
   belongs_to :inbox
   belongs_to :sender, class_name: 'User', optional: true
@@ -90,6 +92,14 @@ class Campaign < ApplicationRecord
     errors.add(:url, 'invalid') if inbox.inbox_type == 'Website' && !use_http_protocol
   end
 
+  def sender_must_belong_to_account
+    return unless sender
+
+    return if account.users.exists?(id: sender.id)
+
+    errors.add(:sender_id, 'must belong to the same account as the campaign')
+  end
+
   def prevent_completed_campaign_from_update
     errors.add :status, 'The campaign is already completed' if !campaign_status_changed? && completed?
   end