{"record":{"id":"1e264b6f13df160b","repo":"toeverything/AFFiNE","slug":"mention-user-oneself-denied","errorCode":"mention_user_oneself_denied","errorMessage":"You can not mention yourself.","messagePattern":"You can not mention yourself\\.","errorType":"exception","errorClass":"MentionUserOneselfDenied","httpStatus":403,"severity":"warning","filePath":"packages/backend/server/src/core/notification/resolver.ts","lineNumber":57,"sourceCode":"  }\n\n  @Mutation(() => ID, {\n    description: 'mention user in a doc',\n  })\n  async mentionUser(\n    @CurrentUser() me: UserType,\n    @Args('input') input: MentionInput\n  ) {\n    const parsedInput = MentionNotificationCreateSchema.parse({\n      userId: input.userId,\n      body: {\n        workspaceId: input.workspaceId,\n        doc: input.doc,\n        createdByUserId: me.id,\n      },\n    });\n    if (parsedInput.userId === me.id) {\n      throw new MentionUserOneselfDenied();\n    }\n    // currentUser can update the doc\n    await this.ac\n      .user(me.id)\n      .doc(parsedInput.body.workspaceId, parsedInput.body.doc.id)\n      .assert('Doc.Update');\n    // mention user can read the doc\n    if (\n      !(await this.ac\n        .user(parsedInput.userId)\n        .doc(parsedInput.body.workspaceId, parsedInput.body.doc.id)\n        .can('Doc.Read'))\n    ) {\n      throw new MentionUserDocAccessDenied({\n        docId: parsedInput.body.doc.id,\n      });\n    }\n    const notification = await this.service.createMention(parsedInput);","sourceCodeStart":39,"sourceCodeEnd":75,"githubUrl":"https://github.com/toeverything/AFFiNE/blob/26c515e050211269e911f7d9cfe162a26c83ed98/packages/backend/server/src/core/notification/resolver.ts#L39-L75","documentation":"MentionUserOneselfDenied (code=mention_user_oneself_denied) thrown by the mention mutation when the target userId equals the current user's id. Mentions are for notifying OTHER users; self-mentions are rejected as a business rule. The check runs after schema parse and before any Doc.Update permission assertion.","triggerScenarios":"Client submits a mention where input.userId === me.id — e.g. the user picks themselves from the mention autocomplete, or a paste/copy carried their own user reference.","commonSituations":"Autocomplete list includes the current user and the UI didn't filter them out. A 'reply' or 'assign' flow that defaults the target to the current user. Frontend bug building the userId.","solutions":["Filter the current user out of the mention autocomplete list client-side.","Disable the submit button when the selected user is the current user.","On receiving this error, clear the selection and prompt the user to pick someone else.","Treat code=mention_user_oneself_denied as a soft, expected error (not a bug to log)."],"exampleFix":"// before\nif (parsedInput.userId === me.id) {\n  throw new MentionUserOneselfDenied();\n}\n\n// client side — never send the self-mention\nconst candidates = users.filter(u => u.id !== me.id);\n// and disable submit if somehow selected\nif (selectedUserId === me.id) setSubmitDisabled(true);","handlingStrategy":"validation","validationCode":"function assertNotSelfMention(meId: string, targetId: string) {\n  if (meId === targetId) {\n    throw new UserError('You cannot mention yourself');\n  }\n}","typeGuard":"function isSelfMentionDenied(e: unknown): boolean {\n  return e instanceof Error && (e as any).code === 'mention_user_oneself_denied';\n}","tryCatchPattern":"assertNotSelfMention(me.id, input.userId); // client-side guard\ntry {\n  await resolver.createMention(me, input);\n} catch (e) {\n  if (isSelfMentionDenied(e)) { setMentionError('Pick a different user'); return; }\n  throw e;\n}","preventionTips":["Filter the current user out of the mention autocomplete.","Disable submit when the selected user is yourself.","Treat this code as an expected soft error, not a bug."],"tags":["notification","mention","business-rule","validation","graphql"],"backgroundTag":null,"analyzedSha":"26c515e050211269e911f7d9cfe162a26c83ed98","analyzedAt":"2026-08-12T13:15:16.447Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}