Mentions guide

Safe mentions

Show people the viewer may mention on this resource. On the example task that list is user_ada, user_kai, and user_noor. user_boa is not on it.

async function searchPeople(input: {
  query: string;
  tenantKey: string;
  resourceType: string;
  resourceId: string;
  viewerId: string;
}) {
  const access = await resourceAccess(input.viewerId, input);
  if (!access) return [];
  return access.members
    .filter((member) => member.name.toLowerCase().includes(input.query.toLowerCase()))
    .slice(0, 20);
}

resourceAccess must use the server session when this function runs on your server. If it runs in the browser, it may only search a list your server already filtered for this viewer. Do not call a Bootstrapware user-search URL. There isn't one.

Before minting, intersect the submitted mention ids with access.mentionIds. Put that intersection on the token. The Hosted API rejects any other id. An empty allow-list means this comment cannot mention anyone. Selecting Kai in the composer does not, by itself, let Ada store user_kai.

Offsets are code points in the normalized body. Display text inside the span can be “Kai” while userId is user_kai. A self-mention of Ada stores when she is on the allow-list and does not emit comments.user_mentioned. Editing a comment notifies only newly added ids. Retrying the same operationId does not notify again.

Contract: mentions.