[FIX] mail: avoid adding non-members on mention in channels

task-2392010

closes odoo/odoo#62230

Signed-off-by: Alexandre Kühn (aku) <aku@odoo.com>

2 files changed, 61 insertions, 2 deletions

diff --git a/addons/mail/static/src/components/composer/composer_tests.js b/addons/mail/static/src/components/composer/composer_tests.js
index d8b369910b1..a7819454b8e 100644
--- a/addons/mail/static/src/components/composer/composer_tests.js
+++ b/addons/mail/static/src/components/composer/composer_tests.js
@@ -2003,7 +2003,7 @@ QUnit.test('send message only once when button send is clicked twice quickly', a
     assert.verifySteps(
         ['message_post'],
         "The message has been posted only once"
-    )
+    );
 });
 
 QUnit.test('send message only once when enter is pressed twice quickly', async function (assert) {
@@ -2040,7 +2040,62 @@ QUnit.test('send message only once when enter is pressed twice quickly', async f
     assert.verifySteps(
         ['message_post'],
         "The message has been posted only once"
-    )
+    );
+});
+
+QUnit.test("mentioned partners should not be notified if they are not member of current channel", async function (assert) {
+    assert.expect(4);
+
+    this.data['res.partner'].records.push({
+        email: "testpartner@example.com",
+        name: "TestPartner",
+    });
+    this.data['mail.channel'].records.push({
+        id: 10,
+        members: [this.data.currentPartnerId],
+    });
+    await this.start({
+        async mockRPC(route, args) {
+            if (args.model === 'mail.channel' && args.method === 'message_post') {
+                assert.step('message_post');
+                assert.strictEqual(
+                    args.kwargs.partner_ids.length,
+                    0,
+                    "message_post should not contain mentioned partners that are not members of channel"
+                );
+            }
+            return this._super(...arguments);
+        },
+    });
+    const thread = this.env.models['mail.thread'].findFromIdentifyingData({
+        id: 10,
+        model: 'mail.channel',
+    });
+    await this.createComposerComponent(thread.composer);
+    await afterNextRender(() => {
+        document.querySelector(`.o_ComposerTextInput_textarea`).focus();
+        document.execCommand('insertText', false, "@");
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keydown'));
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keyup'));
+    });
+    await afterNextRender(() => {
+        document.querySelector(`.o_ComposerTextInput_textarea`).focus();
+        document.execCommand('insertText', false, "Test");
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keydown'));
+        document.querySelector(`.o_ComposerTextInput_textarea`)
+            .dispatchEvent(new window.KeyboardEvent('keyup'));
+    });
+    await afterNextRender(() => document.querySelector('.o_ComposerSuggestion').click());
+    assert.strictEqual(
+        document.querySelector(`.o_ComposerTextInput_textarea`).value.replace(/\s/, " "),
+        "@TestPartner ",
+        "text content of composer should have mentioned partner + additional whitespace afterwards"
+    );
+    await afterNextRender(() => document.querySelector('.o_Composer_buttonSend').click());
+    assert.verifySteps(['message_post'], "the message should be posted");
 });
 
 });
diff --git a/addons/mail/static/src/models/composer/composer.js b/addons/mail/static/src/models/composer/composer.js
index 8bedfa4e3d7..2e087a1bb72 100644
--- a/addons/mail/static/src/models/composer/composer.js
+++ b/addons/mail/static/src/models/composer/composer.js
@@ -188,6 +188,10 @@ function factory(dependencies) {
          * @returns {mail.partner[]}
          */
         _computeRecipients() {
+            if (this.thread && this.thread.model === 'mail.channel') {
+                // prevent from notifying/adding to followers non-members
+                return [['unlink-all']];
+            }
             const recipients = [...this.mentionedPartners];
             if (this.thread && !this.isLog) {
                 for (const recipient of this.thread.suggestedRecipientInfoList) {