code: public HsqlArrayList listVisibleUsers(Session session) {
  
          HsqlArrayList list;
          User          user;
          boolean       isAdmin;
          String        sessionName;
          String        userName;
  
          list        = new HsqlArrayList();
          isAdmin     = session.isAdmin();
          sessionName = session.getUsername();
  
          if (userList == null || userList.size() == 0) {
              return list;
          }
  
          for (int i = 0; i < userList.size(); i++) {
              user = (User) userList.get(i);
  
              if (user == null) {
                  continue;
              }
  
              userName = user.getNameString();
  
              if (isAdmin) {
                  list.add(user);
              } else if (sessionName.equals(userName)) {
                  list.add(user);
              }
          }
  
          return list;
      }
docs: Retrieves the <code>User</code> objects representing the database
  users that are visible to the <code>User</code> object
  represented by the <code>session</code> argument. <p>
  
  If the <code>session</code> argument's <code>User</code> object
  attribute has isAdmin() true (directly or by virtue of a Role),
  then all of the
  <code>User</code> objects in this collection are considered visible.
  Otherwise, only this object's special <code>PUBLIC</code>
  <code>User</code> object attribute and the session <code>User</code>
  object, if it exists in this collection, are considered visible. <p>
  
  @param session The <code>Session</code> object used to determine
  visibility
  @return a list of <code>User</code> objects visible to
  the <code>User</code> object contained by the
  <code>session</code> argument.