discourse/app/controllers/composer_controller.rb

# frozen_string_literal: true

class ComposerController < ApplicationController
  requires_login

  def mentions
    @names = params.require(:names)
    raise Discourse::InvalidParameters.new(:names) if !@names.kind_of?(Array) || @names.size > 20

    if params[:topic_id].present?
      @topic = Topic.find_by(id: params[:topic_id])
      guardian.ensure_can_see!(@topic)
    end

    # allowed_names is necessary just for new private messages.
    @allowed_names =
      if params[:allowed_names].present?
        raise Discourse.InvalidParameters(:allowed_names) if !params[:allowed_names].is_a?(Array)
        params[:allowed_names] << current_user.username
      else
        []
      end

    user_reasons = {}
    group_reasons = {}
    @names.each do |name|
      if user = users[name]
        reason = user_reason(user)
        user_reasons[name] = reason if reason.present?
      elsif group = groups[name]
        reason = group_reason(group)
        group_reasons[name] = reason if reason.present?
      end
    end

    if @topic && @names.include?(SiteSetting.here_mention) && guardian.can_mention_here?
      here_count =
        PostAlerter.new.expand_here_mention(@topic.first_post, exclude_ids: [current_user.id]).size
    end

    serialized_groups =
      groups
        .values
        .reduce({}) do |hash, group|
          serialized_group = { user_count: group.user_count }

          if group_reasons[group.name] == :not_allowed &&
               members_visible_group_ids.include?(group.id) &&
               (@topic&.private_message? || @allowed_names.present?)
            # Find users that are notified already because they have been invited
            # directly or via a group
            notified_count =
              GroupUser
                # invited directly
                .where(user_id: topic_allowed_user_ids)
                .or(
                  # invited via a group
                  GroupUser.where(
                    user_id: GroupUser.where(group_id: topic_allowed_group_ids).select(:user_id),
                  ),
                )
                .where(group_id: group.id)
                .select(:user_id)
                .distinct
                .count

            if notified_count > 0
              group_reasons[group.name] = :some_not_allowed
              serialized_group[:notified_count] = notified_count
            end
          end

          hash[group.name] = serialized_group
          hash
        end

    render json: {
             users: users.keys,
             user_reasons: user_reasons,
             groups: serialized_groups,
             group_reasons: group_reasons,
             here_count: here_count,
             max_users_notified_per_group_mention: SiteSetting.max_users_notified_per_group_mention,
           }
  end

  private

  def user_reason(user)
    reason =
      if @topic && !user.guardian.can_see?(@topic)
        @topic.private_message? ? :private : :category
      elsif @allowed_names.present? &&
            !is_user_allowed?(user, topic_allowed_user_ids, topic_allowed_group_ids)
        # This would normally be handled by the previous if, but that does not work for new private messages.
        :private
      elsif topic_muted_by.include?(user.id)
        :muted_topic
      elsif @topic&.private_message? &&
            !is_user_allowed?(user, topic_allowed_user_ids, topic_allowed_group_ids)
        # Admins can see the topic, but they will not be mentioned if they were not invited.
        :not_allowed
      end

    # Regular users can see only basic information why the users cannot see the topic.
    reason = nil if !guardian.is_staff? && reason != :private && reason != :category

    reason
  end

  def group_reason(group)
    if !mentionable_group_ids.include?(group.id)
      :not_mentionable
    elsif (@topic&.private_message? || @allowed_names.present?) &&
          !topic_allowed_group_ids.include?(group.id)
      :not_allowed
    end
  end

  def is_user_allowed?(user, user_ids, group_ids)
    user_ids.include?(user.id) || user.group_ids.any? { |group_id| group_ids.include?(group_id) }
  end

  def users
    @users ||=
      User.not_staged.where(username_lower: @names.map(&:downcase)).index_by(&:username_lower)
  end

  def groups
    @groups ||=
      Group
        .visible_groups(current_user)
        .where("lower(name) IN (?)", @names.map(&:downcase))
        .index_by(&:name)
  end

  def mentionable_group_ids
    @mentionable_group_ids ||=
      Group.mentionable(current_user, include_public: false).where(name: @names).pluck(:id).to_set
  end

  def members_visible_group_ids
    @members_visible_group_ids ||=
      Group.members_visible_groups(current_user).where(name: @names).pluck(:id).to_set
  end

  def topic_muted_by
    @topic_muted_by ||=
      if @topic.present?
        TopicUser
          .where(topic: @topic)
          .where(user_id: users.values.map(&:id))
          .where(notification_level: TopicUser.notification_levels[:muted])
          .pluck(:user_id)
          .to_set
      else
        Set.new
      end
  end

  def topic_allowed_user_ids
    @topic_allowed_user_ids ||=
      if @allowed_names.present?
        User.where(username_lower: @allowed_names.map(&:downcase)).pluck(:id).to_set
      elsif @topic&.private_message?
        TopicAllowedUser.where(topic: @topic).pluck(:user_id).to_set
      end
  end

  def topic_allowed_group_ids
    @topic_allowed_group_ids ||=
      if @allowed_names.present?
        Group.messageable(current_user).where(name: @allowed_names).pluck(:id).to_set
      elsif @topic&.private_message?
        TopicAllowedGroup.where(topic: @topic).pluck(:group_id).to_set
      end
  end
end