Private posts mentioning non-followers should not notify them, neither locally nor via Salmon

app/lib/feed_manager.rb

@@ -96,6 +96,7 @@ class FeedManager
     should_filter ||= receiver.blocking?(status.account)                                    # or it's from someone I blocked
     should_filter ||= receiver.blocking?(status.mentions.includes(:account).map(&:account)) # or if it mentions someone I blocked
     should_filter ||= (status.account.silenced? && !receiver.following?(status.account))    # of if the account is silenced and I'm not following them
+    should_filter ||= (status.private_visibility? && !receiver.following?(status.account))  # or if the mentioned account is not permitted to see the private status
 
     if status.reply? && !status.thread.account.nil?                                         # or it's a reply
       should_filter ||= receiver.blocking?(status.thread.account)                           # to a user I blocked

app/services/process_mentions_service.rb

@@ -28,6 +28,8 @@ class ProcessMentionsService < BaseService
     status.mentions.each do |mention|
       mentioned_account = mention.account
 
+      next if status.private_visibility? && !mentioned_account.following?(status.account)
+
       if mentioned_account.local?
         NotifyService.new.call(mentioned_account, mention)
       else