Notifications on PMs respect access rights.

spec/models/post_alert_observer_spec.rb

@@ -35,7 +35,6 @@ describe PostAlertObserver do
     end
   end
 
-
   context 'quotes' do
 
     it 'notifies a user by username' do
@@ -79,6 +78,7 @@ describe PostAlertObserver do
     end
 
 
+
     it "doesn't notify the user who created the topic in regular mode" do
       topic.notify_regular!(user)
       mention_post
@@ -93,6 +93,21 @@ describe PostAlertObserver do
         post.destroy
       }.should change(evil_trout.notifications, :count).by(-1)
     end
+  end
+
+
+  context 'private message' do
+    let(:user) { Fabricate(:user) }
+    let(:mention_post) { Fabricate(:post, user: user, raw: 'Hello @eviltrout')}
+    let(:topic) { mention_post.topic }   
+    let(:post)  
+
+    it "won't notify someone who can't see the post" do
+      lambda {
+        Guardian.any_instance.expects(:can_see?).with(instance_of(Post)).returns(false)
+        mention_post
+      }.should_not change(evil_trout.notifications, :count)
+    end
 
   end