While investigating Private Topics Plugin - #109 by thoka I stumbled upon the fact, that a mention for a user in a restricted category is not reported, when the username contains uppercase letters.
If I mention @SomeUser, the editor requests /composer/mentions.json?names[]=SomeUser&topic_id=10728
in the result the username is returned in lowercase, without user_reasons set.
A query for the username in lowercase letters returns "user_reasons": {"someuser":"category"}.
If I use lowercase letters for the usernames in the composer, warnings for people with not sufficient rights will be shown.
If one use the autocompletion provided by the editor, the typed lowercase usernames will be replaced by uppercase names and therefore not reported.
However if name is not downcased, users[name] does not exist.
Fix:
if user = users[name.downcase]
...
elsif group = groups[name.downcase]
...
Or better: downcase all names at the start of the method because there are a lot of issues in there, groups nicely does .where("lower(name) IN (?)", @names.map(&:downcase)) but functions like visible_group_ids_for_allowed_check, topic_allowed_group_ids, mentionable_group_ids and members_visible_group_ids all do where(name: @names) which introduces case sensitivity issues as well.
