feat: show @all and @here in mention list based on user permission

[Rohit3523]

Proposed changes

Right now we show @ALL and @here to all user even they don't have permission to use them. So with this PR, we will just check user permission and show @ALL or @here based on the permission.

Issue(s)

https://rocketchat.atlassian.net/browse/COMM-80

How to test or reproduce

Screenshots

1. User with no mention permission

2. User with only mention-all permission

3. User with only mention-here permission

4. User with both permissions

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Improvement (non-breaking change which improves a current function)
• New feature (non-breaking change which adds functionality)
• Documentation update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc
• I have signed the CLA
• Lint and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works (if applicable)
• I have added necessary documentation (if applicable)
• Any dependent changes have been merged and published in downstream modules

Further comments

Summary by CodeRabbit

• New Features
  • Autocomplete now respects permission settings for special mentions: @ALL and @here appear only for users granted those permissions, letting admins control team-wide notifications.
• Tests
  • Added automated tests covering all permission combinations to ensure @all/@here visibility matches granted permissions.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

[coderabbitai]

Walkthrough

Adds two new supported permissions, mention-all and mention-here, and gates inclusion of @all and @here autocomplete entries in the message composer based on those permission flags; adds tests covering the four permission combinations.

Changes

Cohort / File(s)	Summary
Permission system expansion app/lib/methods/getPermissions.ts	Extends exported SUPPORTED_PERMISSIONS by adding 'mention-all' and 'mention-here'.
Autocomplete permission checks app/containers/MessageComposer/hooks/useAutocomplete.ts	Introduces usePermissions usage and uses mentionAll / mentionHere flags to conditionally include @all and @here autocomplete entries.
Tests: autocomplete behavior app/containers/MessageComposer/MessageComposer.test.tsx	Adds four tests asserting visibility of @all and @here autocomplete items across combinations of the two permissions.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• Verify naming consistency of 'mention-all' and 'mention-here' with backend/ACL.
• Inspect usePermissions integration and flag mapping in useAutocomplete.ts.
• Check tests for correct mocking/timing of autocomplete and potential flakiness.

Poem

🐇 I nibble keys and hop on strings,
I whisper when the @ sign rings,
"All" and "Here" wait until allowed,
I skip and bound, a permissions crowd,
A tiny dance — the mentions sing.

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: conditionally showing @ALL and @here mentions based on user permissions, which is the core feature implemented across the modified files.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch mention-remove

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

app/containers/MessageComposer/hooks/useAutocomplete.ts (1)

216-216: Add mentionAll and mentionHere to the dependency array.

The useEffect hook uses mentionAll and mentionHere (lines 94, 103) but doesn't include them in its dependency array. This violates the exhaustive-deps rule and could lead to stale closures where the effect uses outdated permission values.

Apply this diff to fix the dependency array:

-	}, [text, type, rid, commandParams]);
+	}, [text, type, rid, commandParams, mentionAll, mentionHere]);

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 3e090fb and d737068.

📒 Files selected for processing (2)

• app/containers/MessageComposer/hooks/useAutocomplete.ts (4 hunks)
• app/lib/methods/getPermissions.ts (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

app/containers/MessageComposer/hooks/useAutocomplete.ts (1)

app/lib/hooks/usePermissions.ts (1)

• usePermissions (52-59)

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: ESLint and Test / run-eslint-and-test

🔇 Additional comments (3)

app/containers/MessageComposer/hooks/useAutocomplete.ts (2)

19-19: LGTM!

The import statement is correct and necessary for the permission checks.

---

94-111: LGTM!

The conditional logic correctly guards the display of @all and @here mentions behind their respective permission checks and text matching criteria. Once the rid parameter is passed to usePermissions (as noted in the previous comment), this implementation will function as intended.

app/lib/methods/getPermissions.ts (1)

69-71: LGTM!

The new permission entries for mention-all and mention-here are properly added to the SUPPORTED_PERMISSIONS array. The formatting is consistent with the existing structure, and these permissions correctly support the autocomplete feature.

[diegolmello]

All good, but I'm missing autocomplete tests

[Rohit3523]

All good, but I'm missing autocomplete tests

I have added the unit test :)

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

📥 Commits

Reviewing files that changed from the base of the PR and between 884f96f and b228fd9.

⛔ Files ignored due to path filters (1)

• app/containers/MessageComposer/__snapshots__/MessageComposer.test.tsx.snap is excluded by !**/*.snap

📒 Files selected for processing (1)

• app/containers/MessageComposer/MessageComposer.test.tsx (1 hunks)

🧰 Additional context used

🧬 Code graph analysis (1)

app/containers/MessageComposer/MessageComposer.test.tsx (1)

app/reducers/mockedStore.ts (1)

• mockedStore (7-7)

🔇 Additional comments (1)

app/containers/MessageComposer/MessageComposer.test.tsx (1)

442-504: Comprehensive permission test coverage.

These tests effectively validate all four permission combinations for @ALL and @here mentions, ensuring the autocomplete behavior matches the PR requirements. The test structure follows existing patterns and includes appropriate assertions for both presence and absence of autocomplete items.

[Rohit3523]

Requesting a review :)