Merge pull request #3375 from techAPJ/patch-2

FEATURE: invite existing users to private topic

spec/controllers/users_controller_spec.rb

@@ -1170,6 +1170,25 @@ describe UsersController do
       expect(json["users"].map { |u| u["username"] }).to include(user.username)
     end
 
+    it "searches only for users who have access to private topic" do
+      privileged_user = Fabricate(:user, trust_level: 4, username: "joecabit", name: "Lawrence Tierney")
+      privileged_group = Fabricate(:group)
+      privileged_group.add(privileged_user)
+      privileged_group.save
+
+      category = Fabricate(:category)
+      category.set_permissions(privileged_group => :readonly)
+      category.save
+
+      private_topic = Fabricate(:topic, category: category)
+
+      xhr :post, :search_users, term: user.name.split(" ").last, topic_id: private_topic.id, topic_allowed_users: "true"
+      expect(response).to be_success
+      json = JSON.parse(response.body)
+      expect(json["users"].map { |u| u["username"] }).to_not include(user.username)
+      expect(json["users"].map { |u| u["username"] }).to include(privileged_user.username)
+    end
+
     context "when `enable_names` is true" do
       before do
         SiteSetting.enable_names = true