FIX: don't ever fetch staged accounts in unseen mentions

app/controllers/users_controller.rb

@@ -201,12 +201,15 @@ class UsersController < ApplicationController
   end
 
   def is_local_username
-    users = params[:usernames]
+    usernames = params[:usernames]
-    users = [params[:username]] if users.blank?
+    usernames = [params[:username]] if usernames.blank?
-    users.each(&:downcase!)
+    usernames.each(&:downcase!)
 
-    result = User.where(username_lower: users).pluck(:username_lower)
+    result = User.where(staged: false)
-    render json: {valid: result}
+                 .where(username_lower: usernames)
+                 .pluck(:username_lower)
+
+    render json: { valid: result }
   end
 
   def render_available_true

spec/controllers/users_controller_spec.rb

@@ -1539,4 +1539,32 @@ describe UsersController do
 
   end
 
+  describe ".is_local_username" do
+
+    let(:user) { Fabricate(:user) }
+
+    it "finds the user" do
+      xhr :get, :is_local_username, username: user.username
+      expect(response).to be_success
+      json = JSON.parse(response.body)
+      expect(json["valid"][0]).to eq(user.username)
+    end
+
+    it "supports multiples usernames" do
+      xhr :get, :is_local_username, usernames: [user.username, "system"]
+      expect(response).to be_success
+      json = JSON.parse(response.body)
+      expect(json["valid"].size).to eq(2)
+    end
+
+    it "never includes staged accounts" do
+      staged = Fabricate(:user, staged: true)
+      xhr :get, :is_local_username, usernames: [staged.username]
+      expect(response).to be_success
+      json = JSON.parse(response.body)
+      expect(json["valid"].size).to eq(0)
+    end
+
+  end
+
 end