snapshot of https://github.com/mattermost/mattermost.git (master, 2026-09-16; blobs > 131072B omitted)

e2e-tests/playwright/specs/functional/channels/mentions/channel_mention_resolution.spec.ts

@@ -0,0 +1,140 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, test} from '@mattermost/playwright-lib';
+
+/**
+ * Coverage for MM-68952 / PR #36815 — per-viewer resolution of `~channel` mentions.
+ *
+ * The server populates `post.props.channel_mentions` for the post creator, then strips it
+ * per-viewer using `HasPermissionToResolveChannelMention`. The webapp only renders a clickable
+ * `a.mention-link` (display name) when the viewer's `channel_mentions` still contains the channel;
+ * otherwise it renders the literal `~slug` text.
+ *
+ * `HasPermissionToResolveChannelMention` resolves PUBLIC channels for any team member (independent
+ * of Compliance Monitoring), but keeps PRIVATE/DM/GM and cross-team channels stripped.
+ */
+test.describe('channel mention resolution', () => {
+    /**
+     * @objective A public channel mention authored on one team renders as the raw `~slug`
+     * (unresolved, non-clickable) for a viewer who does not belong to that channel's team.
+     *
+     * @precondition The viewer shares only a DM with the author and never joins the author's team.
+     *
+     * This is the license-free half of the fix (cross-team disclosure stays prevented) and is the
+     * simplest scenario whose rendering differs from the pre-fix behavior without Compliance Monitoring.
+     */
+    test(
+        'keeps a cross-team public channel mention unresolved for a non-team viewer',
+        {tag: '@mentions'},
+        async ({pw}) => {
+            // # Initialize the author on team A
+            const {adminClient, user: author, userClient, team: teamA} = await pw.initSetup();
+
+            // # Create a public channel on team A with a display name distinct from its slug, so a
+            // resolved mention (display name) is clearly distinguishable from an unresolved one (slug)
+            const channelName = `cross-team-public-${pw.random.id()}`;
+            const channelDisplayName = 'Cross Team Secret';
+            const publicChannel = await adminClient.createChannel({
+                team_id: teamA.id,
+                name: channelName,
+                display_name: channelDisplayName,
+                type: 'O',
+            });
+            await adminClient.addToChannel(author.id, publicChannel.id);
+
+            // # Create a viewer that belongs only to a different team B (never to team A)
+            const viewer = await pw.createNewUserProfile(adminClient);
+            const teamB = await pw.createNewTeam(adminClient);
+            await adminClient.addToTeam(teamB.id, viewer.id);
+
+            // # Open a DM between author and viewer (DMs are the only cross-team-visible channel)
+            const dmChannel = await adminClient.createDirectChannel([author.id, viewer.id]);
+
+            // # Author posts the public channel mention into the DM. current_team_id scopes the
+            // server-side name lookup to team A so the mention resolves for the author at creation time.
+            await userClient.createPost({
+                channel_id: dmChannel.id,
+                message: `Check out ~${channelName}`,
+                user_id: author.id,
+                props: {current_team_id: teamA.id},
+            });
+
+            // # Log in as the viewer and open the DM via team B
+            const {channelsPage} = await pw.testBrowser.login(viewer);
+            await channelsPage.goto(teamB.name, `@${author.username}`);
+            await channelsPage.toBeVisible();
+
+            const lastPost = await channelsPage.getLastPost();
+
+            // * The mention is NOT resolved into a clickable channel link for the cross-team viewer
+            await expect(lastPost.body.locator('a.mention-link[data-channel-mention]')).toHaveCount(0);
+
+            // * The raw `~slug` is rendered as plain text and the display name is never disclosed
+            await expect(lastPost.body).toContainText(`~${channelName}`);
+            await expect(lastPost.body).not.toContainText(channelDisplayName);
+        },
+    );
+
+    /**
+     * @objective With Compliance Monitoring enabled, a public channel mention resolves into a
+     * clickable `a.mention-link` (display name) for a team member who is NOT a member of the channel.
+     *
+     * @precondition Enterprise license + Compliance Monitoring. This is the exact regression from
+     * MM-68952: before the fix the per-viewer permission check (HasPermissionToReadChannel) failed
+     * under Compliance for non-members, so the mention was stripped to the raw `~slug`.
+     */
+    test(
+        'resolves a public channel mention for a non-member team member when Compliance Monitoring is on',
+        {tag: '@mentions'},
+        async ({pw}) => {
+            // Requires an enterprise license; skipped on unlicensed servers (e.g. local dev).
+            await pw.skipIfNoLicense();
+
+            const {adminClient, user: author, userClient, team} = await pw.initSetup();
+
+            // NOTE: ComplianceSettings is a global, server-wide setting. Toggling it can affect other
+            // tests running in parallel; we restore it in a finally block to limit the blast radius.
+            await adminClient.patchConfig({ComplianceSettings: {Enable: true}});
+
+            try {
+                // # Create a public channel; the author is a member, the viewer will not be
+                const channelName = `compliance-public-${pw.random.id()}`;
+                const channelDisplayName = 'Compliance Public Channel';
+                const publicChannel = await adminClient.createChannel({
+                    team_id: team.id,
+                    name: channelName,
+                    display_name: channelDisplayName,
+                    type: 'O',
+                });
+                await adminClient.addToChannel(author.id, publicChannel.id);
+
+                // # Create a viewer who is a team member but NOT a member of the public channel
+                const viewer = await pw.createNewUserProfile(adminClient);
+                await adminClient.addToTeam(team.id, viewer.id);
+
+                // # Author posts the mention in town-square (both users are members)
+                const townSquare = await adminClient.getChannelByName(team.id, 'town-square');
+                await userClient.createPost({
+                    channel_id: townSquare.id,
+                    message: `Please see ~${channelName}`,
+                    user_id: author.id,
+                });
+
+                // # Log in as the viewer and open town-square
+                const {channelsPage} = await pw.testBrowser.login(viewer);
+                await channelsPage.goto(team.name, 'town-square');
+                await channelsPage.toBeVisible();
+
+                const lastPost = await channelsPage.getLastPost();
+
+                // * The mention resolves to a clickable channel link showing the display name
+                const mentionLink = lastPost.body.locator(`a.mention-link[data-channel-mention="${channelName}"]`);
+                await expect(mentionLink).toBeVisible();
+                await expect(mentionLink).toContainText(channelDisplayName);
+            } finally {
+                await adminClient.patchConfig({ComplianceSettings: {Enable: false}});
+            }
+        },
+    );
+});

e2e-tests/playwright/specs/functional/channels/mentions/multiple_mentions.spec.ts

@@ -0,0 +1,68 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, test} from '@mattermost/playwright-lib';
+
+/**
+ * @objective Verify that multiple user mentions are displayed properly in the Recent Mentions section.
+ *
+ * @precondition
+ * Two users must be members of the same team
+ */
+test('displays multiple mentions correctly in Recent Mentions panel', {tag: ['@smoke', '@mentions']}, async ({pw}) => {
+    // # Define the number of mentions to create
+    const MENTION_COUNT = 20;
+
+    // # Initialize the first user who will create the mentions
+    const {team, user: mentioningUser, userClient} = await pw.initSetup({userOptions: {prefix: 'mentioner'}});
+
+    // # Create a second user to be mentioned
+    const {adminClient} = await pw.getAdminClient();
+    const mentionedUser = await pw.random.user('mentioned');
+    const {id: mentionedUserID} = await adminClient.createUser(mentionedUser, '', '');
+
+    // # Add the mentioned user to the team
+    await adminClient.addToTeam(team.id, mentionedUserID);
+
+    // # Get the town-square channel data
+    const channels = await userClient.getMyChannels(team.id);
+    const townSquare = channels.find((channel) => channel.name === 'town-square');
+
+    if (!townSquare) {
+        throw new Error('Town Square channel not found');
+    }
+
+    // # Create multiple posts that mention the second user
+    for (let i = 0; i < MENTION_COUNT; i++) {
+        const message = `Hey @${mentionedUser.username}, this is mention #${i + 1}`;
+        await userClient.createPost({
+            channel_id: townSquare.id,
+            message,
+            user_id: mentioningUser.id,
+        });
+    }
+
+    // # Login as the mentioned user to check mentions in the UI
+    const {page: mentionedPage, channelsPage: mentionedChannelsPage} = await pw.testBrowser.login(mentionedUser);
+    await mentionedChannelsPage.goto(team.name, 'town-square');
+    await mentionedChannelsPage.toBeVisible();
+
+    // # Click on the Recent Mentions button in the channel header
+    await mentionedPage.getByRole('button', {name: 'Recent mentions'}).click();
+
+    // * Verify the right sidebar opens and is visible
+    await mentionedChannelsPage.sidebarRight.toBeVisible();
+
+    // # Get all the mention posts in the right sidebar
+    const mentionPosts = mentionedChannelsPage.sidebarRight.container.locator('.post');
+
+    // * Verify the correct number of mention posts are displayed
+    await expect(mentionPosts).toHaveCount(MENTION_COUNT);
+
+    // * Verify the content of each mention displays correctly with the right mention text
+    for (let i = 0; i < MENTION_COUNT; i++) {
+        const mentionNumber = MENTION_COUNT - i;
+        const expectedText = `Hey @${mentionedUser.username}, this is mention #${mentionNumber}`;
+        await expect(mentionPosts.nth(i)).toContainText(expectedText);
+    }
+});

e2e-tests/playwright/specs/functional/channels/mentions/notify_all.spec.ts

@@ -0,0 +1,47 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, test} from '@mattermost/playwright-lib';
+
+// NOTIFY_ALL_MEMBERS threshold from webapp constants — modal triggers when member count > 5.
+const NOTIFY_ALL_THRESHOLD = 5;
+
+test(
+    'MM-68128 notify-all confirm modal title has correct line-height',
+    {tag: ['@mentions', '@visual']},
+    async ({pw}) => {
+        const {adminClient, team, user} = await pw.initSetup();
+
+        // # Add enough extra members so the channel member count exceeds the threshold
+        for (let i = 0; i < NOTIFY_ALL_THRESHOLD; i++) {
+            const extraUser = await pw.createNewUserProfile(adminClient, {prefix: 'notify-extra'});
+            await adminClient.addToTeam(team.id, extraUser.id);
+        }
+
+        // # Log in and go to Town Square (all team members are in it by default)
+        const {channelsPage} = await pw.testBrowser.login(user);
+        await channelsPage.goto(team.name, 'town-square');
+        await channelsPage.toBeVisible();
+
+        // # Type a message with @all to trigger the notify-all confirmation modal
+        await channelsPage.centerView.postCreate.writeMessage('@all test');
+
+        // # Click the Send button (without waiting for navigation — the modal will intercept)
+        await channelsPage.centerView.postCreate.sendMessage();
+
+        // # Wait for the confirm modal
+        const confirmModal = channelsPage.page.locator('#confirmModal');
+        await confirmModal.waitFor({state: 'visible'});
+
+        // * Verify the modal has the correct title text
+        const modalTitle = confirmModal.locator('.modal-title');
+        await expect(modalTitle).toContainText('Confirm sending notifications to entire channel');
+
+        // * Read the computed line-height of the modal title and assert correct spacing.
+        const lineHeight = await modalTitle.evaluate((el) => {
+            return window.getComputedStyle(el).lineHeight;
+        });
+
+        expect(lineHeight, `Modal title line-height should be 28px but got ${lineHeight}`).toBe('28px');
+    },
+);

e2e-tests/playwright/specs/functional/channels/mentions/preview_mention_popover.spec.ts

@@ -0,0 +1,60 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+import {expect, setWysiwygUserPreference, test} from '@mattermost/playwright-lib';
+
+/**
+ * @objective Clicking a user at-mention in the composer preview opens the profile popover
+ * and does not post the draft.
+ *
+ * @precondition Two users on the same team. The markdown composer preview is available
+ * (WYSIWYG editor preference is off).
+ */
+test(
+    'MM-67123 clicking a user mention in composer preview opens the profile popover',
+    {tag: '@mentions'},
+    async ({pw}) => {
+        // # Create two users on the same team and disable the WYSIWYG editor so preview is available
+        const {adminClient, user, userClient, team} = await pw.initSetup();
+        await setWysiwygUserPreference(userClient, user.id, false);
+
+        const mentionedUser = await adminClient.createUser(await pw.random.user('mentioned'), '', '');
+        await adminClient.addToTeam(team.id, mentionedUser.id);
+        const townSquare = await adminClient.getChannelByName(team.id, 'town-square');
+        await adminClient.addToChannel(mentionedUser.id, townSquare.id);
+
+        const {channelsPage} = await pw.testBrowser.login(user);
+        await channelsPage.goto(team.name, 'town-square');
+        await channelsPage.toBeVisible();
+
+        const unique = `preview-mention-${pw.random.id()}`;
+        const {postCreate} = channelsPage.centerView;
+
+        // # Type a draft that mentions the other user via autocomplete so the mention resolves
+        await postCreate.writeMessage(`@${mentionedUser.username}`);
+        await expect(postCreate.suggestionList).toBeVisible();
+        await postCreate.suggestionOptions.first().click();
+        await postCreate.input.pressSequentially(` ${unique}`);
+        const draft = await postCreate.getInputValue();
+
+        // # Show the composer markdown preview
+        await postCreate.togglePreview();
+        await expect(postCreate.previewArea).toBeVisible();
+        await expect(postCreate.previewArea).toContainText(`@${mentionedUser.username}`);
+        await expect(postCreate.previewArea).toContainText(unique);
+
+        // # Click the rendered mention in the preview
+        await postCreate.clickMentionInPreview();
+
+        // * The mentioned user's profile popover opens
+        await expect(channelsPage.userProfilePopover.container).toBeVisible();
+        await expect(channelsPage.userProfilePopover.container).toContainText(`@${mentionedUser.username}`);
+
+        // * The draft remains in the composer and is not posted
+        await expect(postCreate.input).toHaveValue(draft);
+        await expect(postCreate.previewArea).toContainText(unique);
+
+        const lastPost = await channelsPage.getLastPost();
+        await expect(lastPost.container).not.toContainText(unique);
+    },
+);