Able to access the channel even if kicked out by admin

[umangutkarsh]

Description:

The user is still able to access the channel and message on the channel even if the admin kicks out the user.

Steps to reproduce:

1. Start RocketChat server
2. Login with different users on the EC and RC (don't login as admin in the EC)
3. Kick the other user from the channel
4. The other user is still able to access the channel.

Expected behavior:

The user should may be logged out with an appropriate message instead of still staying logged in.

Actual behavior:

kick.webm

[umangutkarsh]

Hey @abhinavkrin . I am working on this. I'll let you know once I find a solution to fix this.

Thanks.

[Spiral-Memory]

Hey @umangutkarsh , this is the default behavior of the Rocket Chat application itself. It has nothing to do with embedded chat. Log into Rocket Chat from two different browsers with different IDs and kick the person out; you will observe the same behavior. If you want, you may raise this issue on Rocket Chat itself. Solving and restricting it from here will not make sense.

2024-02-08.14-15-05.mp4

[umangutkarsh]

Hey @umangutkarsh , this is the default behavior of the Rocket Chat application itself. It has nothing to do with embedded chat. Log into Rocket Chat from two different browsers with different IDs and kick the person out; you will observe the same behavior. If you want, you may raise this issue on Rocket Chat itself. Solving and restricting it from here will not make sense.

2024-02-08.14-15-05.mp4

In the video you have recorded, the user is removed from the channel and an appropriate message appears that you have been removed from the channel.

I'll look into this in the evening.
Didn't quite get what you were trying to explain.

If not required, I'll close the issue once the maintainers comment on this.
Thanks

[Spiral-Memory]

Yes, but that is just on the frontend part; the user will still be able to access the messages of that channel because that's the default behavior of Rocket Chat itself. They get a button to join with the message box disabled, that's it.

There is no backend or anything that stops a user who is kicked out from accessing the channel.

Also there is no backend validation on rocket chat to see if the user have joined or not to see the messages or access the channel.

Also, regarding the frontend message, just refresh the embedded chat app, and you will see the same message. In Rocket Chat also, you will have to refresh once after you kick out to see the "@xyz removed abc" message. So there is nothing that have to be done on embedded chat regarding this issue I am also attaching the screenshot of embedded chat that, we do get removal message, but after refresh, and that issue also lies on rocket chat.

The core issue lies in Rocket Chat, and along with frontend validation, backend validation is required in Rocket Chat actually. Once implemented, the issue will automatically be fixed in the Embedded chat.

[umangutkarsh]

Yes, but that is just on the frontend part; the user will still be able to access the messages of that channel because that's the default behavior of Rocket Chat itself. They get a button to join with the message box disabled, that's it.

There is no backend or anything that stops a user who is kicked out from accessing the channel.

Also there is no backend validation on rocket chat to see if the user have joined or not to see the messages or access the channel.

Also, regarding the frontend message, just refresh the embedded chat app, and you will see the same message. In Rocket Chat also, you will have to refresh once after you kick out to see the "@xyz removed abc" message. So there is nothing that have to be done on embedded chat regarding this issue I am also attaching the screenshot of embedded chat that, we do get removal message, but after refresh, and that issue also lies on rocket chat.

The core issue lies in Rocket Chat, and along with frontend validation, backend validation is required in Rocket Chat actually. Once implemented, the issue will automatically be fixed in the Embedded chat.

I get this, that the issue lies with the backend validation in RC. Since the user can still join the channel and see messages. But what I wanted to point out is that if the admin kicks a user, then the user should at least be notified about it right? Like in RC also the user is removed and he/she has to join again.
This functionality is there in RC, but not in EC.

In EC, user can still message even if not a member of the channel as shown in 'Members' section.
Something like this:

kick3.webm

What do you think?

Let the maintainers comment on this once, if not required I'll close the issue.

[Spiral-Memory]

That is what i am trying to point out that here also Users are already being notified in Embedded Chat also, Just refresh the embedded chat app once after kicking out and you will see that kickes out message. Why does one have to refresh ? That problem also lies in RC.

Also regarding your question that the user can still access the channel even if the user is not a member of the channel that is default behaviour of RC also.. it is just frontend disabling of the textbox that's it, but what i am trying to say is, rather than fixing it as a hack or workaround, let us think about the root cause of issue and fix it from there only..

Yaa sure, let the maintainers comment here.
Thank you for your understanding !