No category notifications for staged users in private category

[mint_saxon]

Staged users on my instance are not getting e-mail notifications for posts in private categories, even if they’ve been added to a group which should give them permission to. This seems to have stopped working with a recent change in Discourse.

---

Steps to reproduce:

1. Create a staged user

• I was originally looking at users imported from an Mbox file, I have also tried creating a staged user by sending a PM to their e-mail address which showed the same problem)

2. Create a category which is only visible to a specific group (members can “Create / Reply / See”, but no other permissions assigned)

3. Add the staged user to the group by entering their e-mail address on the “Bulk Add To Group” button

• the “Add Members” dialogue box doesn’t recognise the usernames of staged users, probably by design)
• the user does show up in the member list, though

4. Go to the staged user’s preferences page, and set them to “Watching” the category

5. Make a new post in the private category

On my community’s dev site (running v2.4.0.beta3 +10) this successfully sends an e-mail notification to the staged user, as well as any non-staged users who are watching the category.

On our live site, running 2.4.0.beta9, nothing about the post shows up on the user’s notification page. If I then un-stage the user by clicking “Impersonate” on the admin page for their user, notifications start coming through fine.

---

The two sites have almost-identical configurations (SSO is enabled on both).

---

Background

Our use-case is that we’re migrating mailing lists onto Discourse, but the lists are for private sub-groups of our community (hence the category which is visible only to members of a specific group) – and we’d like to support staged users for people who’d prefer to continue interacting via e-mail, so it’s a simpler transition from the existing lists.

The easiest way we’ve found for people to continue getting all messages sent to the mailing list by default (one of the main benefits of switching to Discourse will be being able to dial down the level of e-mails without leaving the list entirely, so it seems fair to start with the existing behaviour of receiving everything) is to use Mozilla’s group-category-notification plug-in to have all members of the group “Watching” the category.

I’ve read that being able to add staged users to groups “could stop working at any time”, so I’m open to other ideas

[eviltrout (Robin Ward)]

We recently added a fix because staged users were receiving notifications for content they shouldn’t have been able to see:

https://github.com/discourse/discourse/commit/0c4ac2a7bc726176b1d76b98f789a35e5d1bddfc

@Roman_Rizzi still, if the user has access to the group it should work right?

[mint_saxon]

@eviltrout thanks, that looks like exactly the problem:

# lib/guardian/topic_guardian.rb, L152
-    can_see_category?(topic.category)
+    category = topic.category
+    can_see_category?(category) &&
+       (!category.read_restricted || !is_staged? || topic.user == user)

The logic has changed from checking if can_see_category?(topic.category) passes (which I think it does, as per below), to disallowing the notification if the user is staged in all cases.

This seems like a bug? Otherwise staged users will never be sent notifications for posts in private categories, even if they’ve explicitly been granted permission to. Should I move to bug?

can_see_category?

I think can_see_category? is passing, because of the last line:

def can_see_category?(category)
    return false unless category
    return true if is_admin?
    return true if !category.read_restricted
    return true if is_staged? && category.email_in.present? && category.email_in_allow_strangers
    # this one:
    secure_category_ids.include?(category.id)
  end

• the user is staged
• the category has an “email in” address set
• catgeory.email_in_allow_strangers is enabled) I disabled email_in_allow_strangers because I realised I don’t need it… but secure_category_ids.include?(category.id) returns true

[mint_saxon]

I submitted a pull request which restores notifications to staged users:

https://github.com/discourse/discourse/pull/8765

EDIT: merged! Thanks y’all