0.2.89

src/auth/mod.rs

@@ -1830,9 +1830,10 @@ pub async fn resource_mentions(
         .await
         .map_err(AuthError::database)?;
         if access.is_none() {
-            return Err(AuthError::forbidden(
-                "This resource was not shared with your account.",
-            ));
+            // A signed-in visitor can read public resources without a direct share.
+            // An empty list keeps member identities private and avoids treating
+            // unavailable mention suggestions as a failed page request.
+            return Ok(Json(serde_json::json!({ "users": [] })));
         }
     }
     let rows = sqlx::query(queries::get(state.db.kind(), query))