User directory disabled, users list visible in mentions autocomplete

Feature
1

Hello, we are using Discourse for customer care, as described in Is it a security violation to show a directory of users?

We have already disabled enable_user_directory (thanks for the feature!)
When posting a user can @ mention other users and see the list of users in the autocompletion box, so in some way can still browse the list of users.

I have already tried to set the max mentions per post and newuser max mentions per post to 0, this prevents the user from mentioning but not from seeing the autocompletion list.

Is there any way to block this? A min trust level for mentions would be great.
I searched the plugins but could not find anything.

I know Discourse has been designed for public communities and this is not the way it is meant to be used, I read all the discussion about hiding the users directory, so I know this will be low level priority :slight_smile:

Many thanks.
Massimiliano

2

What are your “who can mention message this group” settings?

If your goal is to not expose member names anywhere that is quite a task.

Search drop down, topic lists, Badge pages to name a few.

3

All groups have “who can mention message this group” set to Nobody.

Badges are off, users can read and search topics only in their groups, so to this regard they are already partitioned.
They can see other users name in search drop down, true.

We have also turned off MPs, so if they see another user they cannot talk to each other.
I think that will do.

I don’t know what kind of hooks there are for the plugin system.
A plugin to:

  • disable mentions of mention autocomplete
  • disable user name as a result in the search drop down
    could be written?