From 27bee43f89dd404f97d2afd957c9f01f05d6876d Mon Sep 17 00:00:00 2001
From: Ricky Stretch <rick@stretchy.ca>
Date: Mon, 9 Mar 2026 22:53:08 -0400
Subject: [PATCH] v0.3.7 @mentions lookup fix

---
 .env.example                             |  2 +-
 backend/package.json                     |  2 +-
 backend/src/routes/users.js              | 35 ++++++++++++++++++++----
 build.sh                                 |  2 +-
 frontend/package.json                    |  2 +-
 frontend/src/components/MessageInput.jsx |  2 +-
 frontend/src/utils/api.js                |  2 +-
 7 files changed, 35 insertions(+), 12 deletions(-)

diff --git a/.env.example b/.env.example
index 2762e6b..68fc71c 100644
--- a/.env.example
+++ b/.env.example
@@ -7,7 +7,7 @@ TZ=UTC
 # Copy this file to .env and customize
 
 # Image version to run (set by build.sh, or use 'latest')
-JAMA_VERSION=0.3.6
+JAMA_VERSION=0.3.7
 
 # Default admin credentials (used on FIRST RUN only)
 ADMIN_NAME=Admin User
diff --git a/backend/package.json b/backend/package.json
index d3c0bfa..c994f05 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jama-backend",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "TeamChat backend server",
   "main": "src/index.js",
   "scripts": {
diff --git a/backend/src/routes/users.js b/backend/src/routes/users.js
index 4a92cf5..876d15e 100644
--- a/backend/src/routes/users.js
+++ b/backend/src/routes/users.js
@@ -58,13 +58,36 @@ router.get('/', authMiddleware, adminMiddleware, (req, res) => {
 
 // Search users (public-ish for mentions/add-member)
 router.get('/search', authMiddleware, (req, res) => {
-  const { q } = req.query;
+  const { q, groupId } = req.query;
   const db = getDb();
-  const users = db.prepare(`
-    SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
-    WHERE status = 'active' AND (name LIKE ? OR display_name LIKE ?)
-    LIMIT 10
-  `).all(`%${q}%`, `%${q}%`);
+  let users;
+  if (groupId) {
+    const group = db.prepare('SELECT type, is_direct FROM groups WHERE id = ?').get(parseInt(groupId));
+    if (group && (group.type === 'private' || group.is_direct)) {
+      // Private group or direct message — only show members of this group
+      users = db.prepare(`
+        SELECT u.id, u.name, u.display_name, u.avatar, u.role, u.status, u.hide_admin_tag
+        FROM users u
+        JOIN group_members gm ON gm.user_id = u.id AND gm.group_id = ?
+        WHERE u.status = 'active' AND u.id != ?
+          AND (u.name LIKE ? OR u.display_name LIKE ?)
+        LIMIT 10
+      `).all(parseInt(groupId), req.user.id, `%${q}%`, `%${q}%`);
+    } else {
+      // Public group — all active users
+      users = db.prepare(`
+        SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
+        WHERE status = 'active' AND id != ? AND (name LIKE ? OR display_name LIKE ?)
+        LIMIT 10
+      `).all(req.user.id, `%${q}%`, `%${q}%`);
+    }
+  } else {
+    users = db.prepare(`
+      SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
+      WHERE status = 'active' AND (name LIKE ? OR display_name LIKE ?)
+      LIMIT 10
+    `).all(`%${q}%`, `%${q}%`);
+  }
   res.json({ users });
 });
 
diff --git a/build.sh b/build.sh
index 6dc1167..6f8ec71 100644
--- a/build.sh
+++ b/build.sh
@@ -13,7 +13,7 @@
 # ─────────────────────────────────────────────────────────────
 set -euo pipefail
 
-VERSION="${1:-0.3.6}"
+VERSION="${1:-0.3.7}"
 ACTION="${2:-}"
 REGISTRY="${REGISTRY:-}"
 IMAGE_NAME="jama"
diff --git a/frontend/package.json b/frontend/package.json
index 0ab0506..45fc143 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -1,6 +1,6 @@
 {
   "name": "jama-frontend",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "scripts": {
     "dev": "vite",
diff --git a/frontend/src/components/MessageInput.jsx b/frontend/src/components/MessageInput.jsx
index ac1b097..d1f356e 100644
--- a/frontend/src/components/MessageInput.jsx
+++ b/frontend/src/components/MessageInput.jsx
@@ -105,7 +105,7 @@ export default function MessageInput({ group, replyTo, onCancelReply, onSend, on
         mentionStart.current = lastAt;
         setMentionSearch(between);
         setShowMention(true);
-        api.searchUsers(between).then(({ users }) => {
+        api.searchUsers(between, group?.id).then(({ users }) => {
           setMentionResults(users);
           setMentionIndex(0);
         }).catch(() => {});
diff --git a/frontend/src/utils/api.js b/frontend/src/utils/api.js
index f771e96..cae4fd8 100644
--- a/frontend/src/utils/api.js
+++ b/frontend/src/utils/api.js
@@ -53,7 +53,7 @@ export const api = {
   
   // Users
   getUsers: () => req('GET', '/users'),
-  searchUsers: (q) => req('GET', `/users/search?q=${encodeURIComponent(q)}`),
+  searchUsers: (q, groupId) => req('GET', `/users/search?q=${encodeURIComponent(q)}${groupId ? `&groupId=${groupId}` : ''}`),
   createUser: (body) => req('POST', '/users', body),
   bulkUsers: (users) => req('POST', '/users/bulk', { users }),
   updateName: (id, name) => req('PATCH', `/users/${id}/name`, { name }),