fix: correct delete messages permission behavior in Administration

RocketChat · Jan 1, 2025 · d467937 · d467937
1 parent b71e093
commit d467937
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 0 deletions.
diff --git a/packages/react/src/hooks/useFetchChatData.js b/packages/react/src/hooks/useFetchChatData.js
@@ -20,6 +20,15 @@ const useFetchChatData = (showRoles) => {
   const isUserAuthenticated = useUserStore(
     (state) => state.isUserAuthenticated
   );
+  const setDeleteMessageRoles = useMessageStore(
+    (state) => state.setDeleteMessageRoles
+  );
+  const setDeleteOwnMessageRoles = useMessageStore(
+    (state) => state.setDeleteOwnMessageRoles
+  );
+  const setForceDeleteMessageRoles = useMessageStore(
+    (state) => state.setForceDeleteMessageRoles
+  );
   const setViewUserInfoPermissions = useUserStore(
     (state) => state.setViewUserInfoPermissions
   );

diff --git a/packages/react/src/views/Message/MessageToolbox.js b/packages/react/src/views/Message/MessageToolbox.js
@@ -85,6 +85,24 @@ export const MessageToolbox = ({
     ? true
     : message.u._id === authenticatedUserId;
 
+  const isAllowedToDeleteMessage = userRoles.some((role) =>
+    deleteMessageRoles.has(role)
+  );
+  const isAllowedToDeleteOwnMessage = userRoles.some((role) =>
+    deleteOwnMessageRoles.has(role)
+  );
+  const isAllowedToForceDeleteMessage = userRoles.some((role) =>
+    forceDeleteMessageRoles.has(role)
+  );
+
+  const canDeleteMessage = isAllowedToForceDeleteMessage
+    ? true
+    : isAllowedToDeleteMessage
+    ? true
+    : isAllowedToDeleteOwnMessage
+    ? message.u._id === authenticatedUserId
+    : false;
+
   const isVisibleForMessageType =
     message.files?.[0].type !== 'audio/mpeg' &&
     message.files?.[0].type !== 'video/mp4';