Repository navigation
Predictive user search for adding team members - #141
Merged
Merged
Conversation
GET /team/:teamId/members/candidates?q= returns up to 10 users whose username contains q (3-50 chars), excluding current members. Admins and the team's leads only, session-only. For a team lead it returns plain users only, matching what a lead can add, so it does not expose admins or other leads. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0121r5gnmvth6hy4tPpNT8sM
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Back-end for a type-ahead on the Team Settings "add member" box.
GET /team/:teamId/members/candidates?q=returns up to 10 users whose username containsq(case-insensitive), ordered by username, leaving out users already in the team.qmust be 3 to 50 characters of[A-Za-z0-9-_](422 otherwise). The pattern is safe to use in a regex as is.useraccounts only, which is exactly what a lead can add, so it does not expose admins or other leads. Admins also see team leads and admins._id,usernameandrole.This is a deliberate, narrow directory lookup: team leads cannot list users otherwise, so the minimum length, the result cap and the role filter keep it from becoming a way to enumerate all accounts.
Testing
9 new tests in
test/team-members.tests.js: substring and case-insensitive matching, excluding current members, role filtering for lead vs admin, empty result, the 10-result cap, 422 for short or invalidq, 403 for a member, another team's lead and API tokens, 404 for an unknown team. All 41 tests in that file pass. I did not re-run the full suite for this change.Companion PRs: AnglesHQ/angles-ui and AnglesHQ/angles-javascript-client.
🤖 Generated with Claude Code
https://claude.ai/code/session_0121r5gnmvth6hy4tPpNT8sM
Generated by Claude Code