feat: Restrict @predictors mentions to curators/admins with warning toast

comments/utils.py

@@ -3,6 +3,7 @@
 from typing import Iterable
 
 from django.db.models import Q, QuerySet
+from django.utils import timezone
 
 from comments.models import Comment
 from projects.permissions import ObjectPermission
@@ -56,10 +57,16 @@ def comment_extract_user_mentions(
                         ObjectPermission.CURATOR
                     )
                 ):
+                    now = timezone.now()
                     query |= Q(
                         pk__in=User.objects.filter(
-                            forecast__post=comment.on_post
-                        ).distinct("pk")
+                            forecast__post=comment.on_post,
+                        )
+                        .exclude(
+                            forecast__end_time__isnull=False,
+                            forecast__end_time__lte=now,
+                        )
+                        .distinct("pk")
                     )
                 continue
 

front_end/messages/en.json

@@ -372,6 +372,7 @@
   "estimatedReadingTime": "{minutes} min read",
   "predictions": "Predictions",
   "predictors": "Predictors",
+  "predictorsMentionWarning": "Only curators and admins can notify @predictors. Your mention will not send notifications.",
   "relativeLog": "Relative Log",
   "unreadAll": "all unread",
   "questionsLeft": "{count, plural, =1 {1 question left} other {{count} questions left} }",

front_end/src/components/comment_feed/comment.tsx

@@ -10,8 +10,10 @@
 import { FontAwesomeIcon } from "@fortawesome/react-fontawesome";
 import Link from "next/link";
 import { useTranslations } from "next-intl";
 import { FC, useCallback, useEffect, useMemo, useRef, useState } from "react";
 
+import toast from "react-hot-toast";
+
 import { softDeleteUserAction } from "@/app/(main)/accounts/profile/actions";
 import { useCommentsFeed } from "@/app/(main)/components/comments_feed_provider";
 import KeyFactorsAddInComment from "@/app/(main)/questions/[id]/components/key_factors/add_in_comment/key_factors_add_in_comment";
@@ -49,7 +51,7 @@
 } from "@/types/post";
 import { QuestionType } from "@/types/question";
 import { sendAnalyticsEvent } from "@/utils/analytics";
-import { parseUserMentions } from "@/utils/comments";
+import { hasPredictorsMention, parseUserMentions } from "@/utils/comments";
 import cn from "@/utils/core/cn";
 import { logError } from "@/utils/core/errors";
 import { isForecastActive } from "@/utils/forecasts/helpers";
@@ -520,6 +522,18 @@
       if (response && "errors" in response) {
         setErrorMessage(response.errors as ErrorResponse);
       } else {
+        // Warn non-curators/admins if they used @predictors
+        const userPermission = postData?.user_permission;
+        if (
+          hasPredictorsMention(parsedMarkdown) &&
+          (!userPermission ||
+            ![ProjectPermissions.CURATOR, ProjectPermissions.ADMIN].includes(
+              userPermission
+            ))
+        ) {
+          toast(t("predictorsMentionWarning"));
+        }
+
         setCommentMarkdown(parsedMarkdown);
         setComments((prev) =>
           updateCommentTextInTree(prev, comment.id, parsedMarkdown)
@@ -853,6 +867,8 @@
                         saveEditDraftDebounced(val);
                       }}
                       withUgcLinks
+                      withUserMentions
+                      userPermission={postData?.user_permission}
                       withCodeBlocks
                     />
                     {hadForecastAtCommentCreation && postData?.question && (

front_end/src/components/comment_feed/comment_editor.tsx

@@ -2,8 +2,10 @@
 
 import { MDXEditorMethods } from "@mdxeditor/editor";
 import { useTranslations } from "next-intl";
 import { FC, useCallback, useEffect, useRef, useState } from "react";
 
+import toast from "react-hot-toast";
+
 import { createComment } from "@/app/(main)/questions/actions";
 import MarkdownEditor from "@/components/markdown_editor";
 import Button from "@/components/ui/button";
@@ -19,7 +21,7 @@
 import { ErrorResponse } from "@/types/fetch";
 import { ProjectPermissions } from "@/types/post";
 import { sendAnalyticsEvent } from "@/utils/analytics";
-import { parseComment } from "@/utils/comments";
+import { hasPredictorsMention, parseComment } from "@/utils/comments";
 
 import { validateComment } from "./validate_comment";
 
@@ -166,6 +168,17 @@
 
       stopAndDiscardDraft();
 
+      // Warn non-curators/admins if they used @predictors
+      if (
+        hasPredictorsMention(parsedMarkdown) &&
+        (!userPermission ||
+          ![ProjectPermissions.CURATOR, ProjectPermissions.ADMIN].includes(
+            userPermission
+          ))
+      ) {
+        toast(t("predictorsMentionWarning"));
+      }
+
       setHasIncludedForecast(false);
       markdownRef.current = "";
       setHasContent(false);

front_end/src/utils/comments.ts

@@ -77,6 +77,20 @@ export function parseUserMentions(
   return markdown;
 }
 
+/**
+ * Checks if a comment text contains an @predictors mention.
+ */
+export function hasPredictorsMention(text: string): boolean {
+  const mentions = text.matchAll(userTagPattern);
+  for (const match of mentions) {
+    const username = (match[1] || match[2] || "").toLowerCase();
+    if (username === "predictors") {
+      return true;
+    }
+  }
+  return false;
+}
+
 /**
  * Returns commentId to focus on if id is provided and comment is not already rendered
  */

tests/unit/test_comments/test_utils.py

@@ -1,6 +1,10 @@
+from datetime import timedelta
+
 import pytest
 import re
 
+from django.utils import timezone
+
 from comments.utils import (
     USERNAME_PATTERN,
     get_mention_for_user,
@@ -150,3 +154,43 @@ def test_comment_extract_user_mentions(
 
     assert {x.username for x in qs} == expected_usernames
     assert mentions == expected_mentions
+
+
+@pytest.mark.django_db
+def test_predictors_mention_excludes_withdrawn_forecasts(question_binary):
+    """@predictors should only notify users with active (non-withdrawn) predictions."""
+    active_forecaster = factory_user(username="active_forecaster")
+    withdrawn_forecaster = factory_user(username="withdrawn_forecaster")
+    admin = factory_user(username="admin")
+
+    post = factory_post(
+        question=question_binary,
+        default_project=factory_project(
+            type=Project.ProjectTypes.TOURNAMENT,
+            default_permission=ObjectPermission.FORECASTER,
+            override_permissions={
+                admin: ObjectPermission.ADMIN,
+            },
+        ),
+    )
+
+    # Active forecast (no end_time)
+    factory_forecast(question=question_binary, author=active_forecaster)
+    # Withdrawn forecast (end_time in the past, after start_time)
+    factory_forecast(
+        question=question_binary,
+        author=withdrawn_forecaster,
+        start_time=timezone.now() - timedelta(days=2),
+        end_time=timezone.now() - timedelta(days=1),
+    )
+
+    qs, mentions = comment_extract_user_mentions(
+        factory_comment(
+            author=admin,
+            on_post=post,
+            text_original="Wanna mention @predictors",
+        )
+    )
+
+    assert {x.username for x in qs} == {"active_forecaster"}
+    assert mentions == {"predictors"}