FIX: Filter readers avatars correctly when the post is a whisper

app/controllers/post_readers_controller.rb

@@ -15,10 +15,7 @@ class PostReadersController < ApplicationController
       .where.not(topic_users: { last_read_post_number: nil })
       .where('topic_users.topic_id = ? AND topic_users.last_read_post_number >= ?', post.topic_id, post.post_number)
 
-    if post.whisper?
-      non_group_members = post.topic.topic_allowed_users.map(&:user_id)
-      readers = readers.where.not(id: non_group_members)
-    end
+    readers = readers.where('admin = true OR moderator = true') if post.whisper?
 
     readers = readers.map do |r|
       {

spec/requests/post_readers_controller_spec.rb

@@ -77,11 +77,10 @@ describe PostReadersController do
         expect(readers).to be_empty
       end
 
-      it "doesn't include non-members when the post is a whisper" do
+      it "doesn't include non-staff users when the post is a whisper" do
         @post.update(post_type: Post.types[:whisper])
-        non_member_reader = Fabricate(:user)
-        @group_message.allowed_users << non_member_reader
-        TopicUser.create!(user: non_member_reader, topic: @group_message, last_read_post_number: 4)
+        non_staff_user = Fabricate(:user)
+        TopicUser.create!(user: non_staff_user, topic: @group_message, last_read_post_number: 4)
 
         get '/post_readers.json', params: { id: @post.id }
         readers = JSON.parse(response.body)['post_readers']
@@ -89,6 +88,17 @@ describe PostReadersController do
         expect(readers).to be_empty
       end
 
+      it "includes staff users when the post is a whisper" do
+        @post.update(post_type: Post.types[:whisper])
+        admin = Fabricate(:admin)
+        TopicUser.create!(user: admin, topic: @group_message, last_read_post_number: 4)
+
+        get '/post_readers.json', params: { id: @post.id }
+        reader_data = JSON.parse(response.body)['post_readers'].first
+
+        assert_reader_is_correctly_serialized(reader_data, admin, @post)
+      end
+
       it "doesn't include bots" do
         TopicUser.create!(user: Discourse.system_user, topic: @group_message, last_read_post_number: 4)