Don't require user exist in a public room to add other users

[timkinnane]

0.49.3

Question for core team, mostly @marceloschmidt - Is there a strong reason for requiring that a user calling addUserToRoom must be a member of the room.

I have two uses cases I'm writing, 1st: automated workflows were a bot will drop people in a room at the end of an interaction. 2nd: provisioning scripts for new instances that will create rooms and add users according to a pre-defined config.

In both scenarios, I need the bot (1) and system admin (2) users to exist in the room first to add the new users - but they don't need to be there for any other reason and I don't really want users to see them in the room.

It makes sense for private rooms, but is there any good reason why I can't just remove that check for public rooms - there will still be the add-user-to-room permission check. I'm happy to make the PR if there's no objection to the concept.

See relevant line.

[timkinnane]

Actually, in the case where the user calling the method is an admin, would it be bad to allow adding users to private rooms too (where the admin is not a member)? I think I need that for the provisioning scenario. I can just do that on my fork without a PR though if it's not desired in core.

[graywolf336]

I would say that a new permission add-user-to-room-always or something of that sort would be a good addition and then use that to check, as I agree with you it would be nice to have for admins and privileged users like staff.

[maxdwit]

Is this in 0.50.0 ? In my case I would like to add users to channels/private rooms without being in the channel.

[graywolf336]

@maxdwit No it isn't, I will see about getting it into the next release though.

[timkinnane]

@graywolf336 I was about to do this now, if you haven't yet? I'm going with your suggestion of adding a new permission, but for semantic accuracy I was thinking to change the original permission to be add-user-to-own-room and the new one add-user-to-any-room?

[graywolf336]

@timkinnane go for it. That sounds good to me, be sure to create a migration to rename the existing one if it's required. 👍

[timkinnane]

Yep, got it. ;)

[maxdwit]

Test in 0.51. via API,
as Administrator - departed the "Test" Channel.
Added User to Channel via API.
Verified User is in this Channel.
Works as expected. Thanks