Rocket.chat: Don't require user exist in a public room to add other users
0.49.3
Question for core team, mostly @marceloschmidt - Is there a strong reason for requiring that a user calling addUserToRoom must be a member of the room.
I have two uses cases I'm writing, 1st: automated workflows were a bot will drop people in a room at the end of an interaction. 2nd: provisioning scripts for new instances that will create rooms and add users according to a pre-defined config.
In both scenarios, I need the bot (1) and system admin (2) users to exist in the room first to add the new users - but they don't need to be there for any other reason and I don't really want users to see them in the room.
It makes sense for private rooms, but is there any good reason why I can't just remove that check for public rooms - there will still be the add-user-to-room permission check. I'm happy to make the PR if there's no objection to the concept.
timkinnane
All 8 comments
Actually, in the case where the user calling the method is an admin, would it be bad to allow adding users to private rooms too (where the admin is not a member)? I think I need that for the provisioning scenario. I can just do that on my fork without a PR though if it's not desired in core.
timkinnane
on 20 Jan 2017
I would say that a new permission add-user-to-room-always or something of that sort would be a good addition and then use that to check, as I agree with you it would be nice to have for admins and privileged users like staff.
graywolf336
on 20 Jan 2017
Is this in 0.50.0 ? In my case I would like to add users to channels/private rooms without being in the channel.
maxdwit
on 24 Jan 2017
@maxdwit No it isn't, I will see about getting it into the next release though.
graywolf336
on 24 Jan 2017
@graywolf336 I was about to do this now, if you haven't yet? I'm going with your suggestion of adding a new permission, but for semantic accuracy I was thinking to change the original permission to be add-user-to-own-room and the new one add-user-to-any-room?
timkinnane
on 27 Jan 2017
@timkinnane go for it. That sounds good to me, be sure to create a migration to rename the existing one if it's required. 馃憤
graywolf336
on 27 Jan 2017
Yep, got it. ;)
timkinnane
on 27 Jan 2017
Test in 0.51. via API,
as Administrator - departed the "Test" Channel.
Added User to Channel via API.
Verified User is in this Channel.
Works as expected. Thanks
maxdwit
on 15 Jun 2017
Related issues
mddvul22
路
3Comments
engelgabriel
路
3Comments
danpospisil
路
3Comments
karlprieb
路
3Comments
antn89
路
3Comments
Most helpful comment
I would say that a new permission
add-user-to-room-alwaysor something of that sort would be a good addition and then use that to check, as I agree with you it would be nice to have for admins and privileged users like staff.