Merge branch '33902-fix-private-group-todo-mentions' into 'master'

Fix todos created by private group mentions

Closes #33902

See merge request gitlab-org/gitlab!19037

app/services/issuable_base_service.rb

@@ -355,7 +355,7 @@ class IssuableBaseService < BaseService
     associations =
       {
         labels: issuable.labels.to_a,
-        mentioned_users: issuable.mentioned_users.to_a,
+        mentioned_users: issuable.mentioned_users(current_user).to_a,
         assignees: issuable.assignees.to_a
       }
     associations[:total_time_spent] = issuable.total_time_spent if issuable.respond_to?(:total_time_spent)

changelogs/unreleased/33902-fix-private-group-todo-mentions.yml

+---
+title: Do not generate To-Dos additional when editing group mentions
+merge_request: 19037
+author:
+type: fixed

ee/spec/services/epics/update_service_spec.rb

@@ -136,6 +136,40 @@ describe Epics::UpdateService do
           expect(todo2.reload.state).to eq('pending')
         end
       end
+
+      context 'mentioning a group in epic description' do
+        let(:mentioned1) { create(:user) }
+        let(:mentioned2) { create(:user) }
+
+        before do
+          group.add_developer(mentioned1)
+          epic.update(description: "FYI: #{group.to_reference}")
+        end
+
+        context 'when the group is public' do
+          before do
+            group.update(visibility: Gitlab::VisibilityLevel::PUBLIC)
+          end
+
+          it 'creates todos for only newly mentioned users' do
+            expect do
+              update_epic(description: "FYI: #{mentioned1.to_reference} #{mentioned2.to_reference}")
+            end.to change { Todo.count }.by(1)
+          end
+        end
+
+        context 'when the group is private' do
+          before do
+            group.update(visibility: Gitlab::VisibilityLevel::PRIVATE)
+          end
+
+          it 'creates todos for only newly mentioned users that are group members' do
+            expect do
+              update_epic(description: "FYI: #{mentioned1.to_reference} #{mentioned2.to_reference}")
+            end.to not_change { Todo.count }
+          end
+        end
+      end
     end
 
     context 'when Epic has tasks' do

spec/support/shared_examples/updating_mentions_shared_examples.rb

@@ -58,9 +58,25 @@ RSpec.shared_examples 'updating mentions' do |service_class|
       end
     end
 
+    shared_examples 'updating attribute with existing group mention' do |attribute|
+      before do
+        mentionable.update!({ attribute => "FYI: #{group.to_reference}" })
+      end
+
+      it 'creates todos for only newly mentioned users' do
+        expect do
+          update_mentionable(
+            { attribute => "For #{group.to_reference}, cc: #{mentioned_user.to_reference}" }
+          )
+        end.to change { Todo.count }.by(1)
+      end
+    end
+
     context 'when group is public' do
       it_behaves_like 'updating attribute with allowed mentions', :title
       it_behaves_like 'updating attribute with allowed mentions', :description
+      it_behaves_like 'updating attribute with existing group mention', :title
+      it_behaves_like 'updating attribute with existing group mention', :description
     end
 
     context 'when the group is private' do
@@ -70,6 +86,8 @@ RSpec.shared_examples 'updating mentions' do |service_class|
 
       it_behaves_like 'updating attribute with allowed mentions', :title
       it_behaves_like 'updating attribute with allowed mentions', :description
+      it_behaves_like 'updating attribute with existing group mention', :title
+      it_behaves_like 'updating attribute with existing group mention', :description
     end
   end