v0.3.7 @mentions lookup fix

.env.example

@@ -7,7 +7,7 @@ TZ=UTC
 # Copy this file to .env and customize
 
 # Image version to run (set by build.sh, or use 'latest')
-JAMA_VERSION=0.3.6
+JAMA_VERSION=0.3.7
 
 # Default admin credentials (used on FIRST RUN only)
 ADMIN_NAME=Admin User

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jama-backend",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "description": "TeamChat backend server",
   "main": "src/index.js",
   "scripts": {

backend/src/routes/users.js

@@ -58,13 +58,36 @@ router.get('/', authMiddleware, adminMiddleware, (req, res) => {
 
 // Search users (public-ish for mentions/add-member)
 router.get('/search', authMiddleware, (req, res) => {
-  const { q } = req.query;
+  const { q, groupId } = req.query;
   const db = getDb();
-  const users = db.prepare(`
+  let users;
-    SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
+  if (groupId) {
-    WHERE status = 'active' AND (name LIKE ? OR display_name LIKE ?)
+    const group = db.prepare('SELECT type, is_direct FROM groups WHERE id = ?').get(parseInt(groupId));
-    LIMIT 10
+    if (group && (group.type === 'private' || group.is_direct)) {
-  `).all(`%${q}%`, `%${q}%`);
+      // Private group or direct message — only show members of this group
+      users = db.prepare(`
+        SELECT u.id, u.name, u.display_name, u.avatar, u.role, u.status, u.hide_admin_tag
+        FROM users u
+        JOIN group_members gm ON gm.user_id = u.id AND gm.group_id = ?
+        WHERE u.status = 'active' AND u.id != ?
+          AND (u.name LIKE ? OR u.display_name LIKE ?)
+        LIMIT 10
+      `).all(parseInt(groupId), req.user.id, `%${q}%`, `%${q}%`);
+    } else {
+      // Public group — all active users
+      users = db.prepare(`
+        SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
+        WHERE status = 'active' AND id != ? AND (name LIKE ? OR display_name LIKE ?)
+        LIMIT 10
+      `).all(req.user.id, `%${q}%`, `%${q}%`);
+    }
+  } else {
+    users = db.prepare(`
+      SELECT id, name, display_name, avatar, role, status, hide_admin_tag FROM users
+      WHERE status = 'active' AND (name LIKE ? OR display_name LIKE ?)
+      LIMIT 10
+    `).all(`%${q}%`, `%${q}%`);
+  }
   res.json({ users });
 });
 

build.sh

@@ -13,7 +13,7 @@
 # ─────────────────────────────────────────────────────────────
 set -euo pipefail
 
-VERSION="${1:-0.3.6}"
+VERSION="${1:-0.3.7}"
 ACTION="${2:-}"
 REGISTRY="${REGISTRY:-}"
 IMAGE_NAME="jama"

frontend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jama-frontend",
-  "version": "0.3.6",
+  "version": "0.3.7",
   "private": true,
   "scripts": {
     "dev": "vite",

frontend/src/components/MessageInput.jsx

@@ -105,7 +105,7 @@ export default function MessageInput({ group, replyTo, onCancelReply, onSend, on
         mentionStart.current = lastAt;
         setMentionSearch(between);
         setShowMention(true);
-        api.searchUsers(between).then(({ users }) => {
+        api.searchUsers(between, group?.id).then(({ users }) => {
           setMentionResults(users);
           setMentionIndex(0);
         }).catch(() => {});

frontend/src/utils/api.js

@@ -53,7 +53,7 @@ export const api = {
   
   // Users
   getUsers: () => req('GET', '/users'),
-  searchUsers: (q) => req('GET', `/users/search?q=${encodeURIComponent(q)}`),
+  searchUsers: (q, groupId) => req('GET', `/users/search?q=${encodeURIComponent(q)}${groupId ? `&groupId=${groupId}` : ''}`),
   createUser: (body) => req('POST', '/users', body),
   bulkUsers: (users) => req('POST', '/users/bulk', { users }),
   updateName: (id, name) => req('PATCH', `/users/${id}/name`, { name }),