1 files changed, 21 insertions, 13 deletions
diff --git a/app/services/quick_actions/interpret_service.rb b/app/services/quick_actions/interpret_service.rb
index ab489ba49ca..906c4b98f56 100644
--- a/app/services/quick_actions/interpret_service.rb
+++ b/app/services/quick_actions/interpret_service.rb
@@ -61,28 +61,32 @@ module QuickActions
 
     private
 
+    def failed_parse(message)
+      raise Gitlab::QuickActions::CommandDefinition::ParseError, message
+    end
+
     def extractor
       Gitlab::QuickActions::Extractor.new(self.class.command_definitions)
     end
 
-    # rubocop: disable CodeReuse/ActiveRecord
     def extract_users(params)
-      return [] if params.nil?
+      return [] if params.blank?
 
-      users = extract_references(params, :user)
+      # We are using the a simple User.by_username query here rather than a ReferenceExtractor
+      # because the needs here are much simpler: we only deal in usernames, and
+      # want to also handle bare usernames. The ReferenceExtractor also has
+      # different behaviour, and will return all group members for groups named
+      # using a user-style reference, which is not in scope here.
+      args        = params.split(/\s|,/).select(&:present?).uniq - ['and']
+      usernames   = (args - ['me']).map { _1.delete_prefix('@') }
+      found       = User.by_username(usernames).to_a.select { can?(:read_user_profile, _1) }
+      found_names = found.map(&:username).to_set
+      missing     = args.reject { |arg| arg == 'me' || found_names.include?(arg.delete_prefix('@')) }.map { "'#{_1}'" }
 
-      if users.empty?
-        users =
-          if params.strip == 'me'
-            [current_user]
-          else
-            User.where(username: params.split(' ').map(&:strip))
-          end
-      end
+      failed_parse(format(_("Failed to find users for %{missing}"), missing: missing.to_sentence)) if missing.present?
 
-      users
+      found + [current_user].select { args.include?('me') }
     end
-    # rubocop: enable CodeReuse/ActiveRecord
 
     def find_milestones(project, params = {})
       group_ids = project.group.self_and_ancestors.select(:id) if project.group
@@ -187,6 +191,10 @@ module QuickActions
         user: current_user
       )
     end
+
+    def can?(ability, object)
+      Ability.allowed?(current_user, ability, object)
+    end
   end
 end