Follow-up from "Private/Internal (Sub)Group email notifications not sent when mentioned in MR description"

Summary

Follo-up for #30112 (closed) to investigate point 3 in this discussion.

After investigating, the missing param current_user is also causing a bug where extra todos are being generated.

Steps to reproduce

1. In a private group and being signed in as a member, update the title or description of an issue (same for MRs and Epics) and include a mention to the group.
2. Mark To-Dos as done.
3. Update title or description that contained the group mention, without removing the mention.
4. Navigate to the To-Do list, there will be a new To-Do generated by the private group mention.

What is the current bug behavior?

A new To-Do is generated everytime the title or description is edited like it would be if the mention was newly included. This is wrongly notifying all group members for every edit.

What is the expected correct behavior?

To-do should be generated only when the group is being mentioned for the first time. All following updates, that don't modify the mention, should not generate new To-Dos.

Relevant logs and/or screenshots

1. 2. 3.

Possible fixes

This is happening because the collection of mentioned used captured before the update, is empty when the mention includes a private group. We can see in this line that the method #mentioned_users is not passing the current user as a param and this results in lack of access to read the private group members.

Suggested fix:

diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index 3e17d75c02c..8a79c5f889d 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -355,7 +355,7 @@ class IssuableBaseService < BaseService
     associations =
       {
         labels: issuable.labels.to_a,
-        mentioned_users: issuable.mentioned_users.to_a,
+        mentioned_users: issuable.mentioned_users(current_user).to_a,
         assignees: issuable.assignees.to_a
       }