fix: filter non-members from thread followers

[Copilot]

Thread followers and mentions were not being validated against room membership, allowing non-members to receive notifications and appear as followers in private channels.

Changes

• Added filterUsersInRoom utility in apps/meteor/app/threads/server/functions.ts

  • Validates user IDs against room membership before adding to thread replies
  • Handles different room types: direct messages (checks uids), private/public channels (checks subscriptions)
  • Returns empty array on error to fail safely

• Applied filtering to three user sets before thread operations:

  • followers - existing thread participants
  • mentionIds - users @mentioned in the reply
  • highlightsUids - users with keyword highlights triggered

• Preserved existing behavior for room members while preventing leakage to non-members

// Before: unfiltered arrays passed directly
await Messages.updateRepliesByThreadId(tmid, [...followers, ...mentionIds], ts);

// After: filtered to room members only
const [followersInRoom, mentionIdsInRoom] = await Promise.all([
  filterUsersInRoom({ roomId: rid, userIds: followers, room }),
  filterUsersInRoom({ roomId: rid, userIds: mentionIds, room }),
]);
await Messages.updateRepliesByThreadId(tmid, [...followersInRoom, ...mentionIdsInRoom], ts);

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.