roles.removeUserFromRole ignores the documented roomId parameter

Open Beginner friendly
  • Is something wrong?
#43,346 2 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@maalideekshith is already working on this.

Since Oct 31, 2026.

  • #1 by @maalideekshith — open
  • #43387 by @sudoKrishna — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
76/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
typescript
Domain
api, backend-api-design

Research direction

Start with apps/meteor/server/api/v1/roles.ts and compare roles.removeUserFromRole with the corresponding roles.addUserToRole endpoint. Then review the parameter definitions in packages/rest-typings/src/v1/roles.ts and scope behavior in packages/models/src/models/Subscriptions.ts. Done means removal accepts the documented roomId, keeps scope working, and gives scope precedence when both are supplied.

Written by the indexing model from the issue text.

Description

type: bug
Description

The roles.removeUserFromRole REST API accepts a roomId parameter in its public TypeScript definitions, validation schema, and API documentation. However, the endpoint handler does not read or use this parameter.

In apps/meteor/server/api/v1/roles.ts, the handler currently extracts:

const { roleId, username, scope } = bodyParams;

As a result, when a caller provides the documented roomId parameter to remove a subscription-scoped role, the membership check receives an undefined scope.

Steps to reproduce
  1. Create a room and add a user to it.
  2. Assign the user a subscription-scoped role using roles.addUserToRole:
{
  "roleId": "moderator",
  "username": "testuser",
  "roomId": "ROOM_ID"
}
  1. Call roles.removeUserFromRole with:
{
  "roleId": "moderator",
  "username": "testuser",
  "roomId": "ROOM_ID"
}
Actual behavior

The API returns:

400 error-user-not-in-role

The handler ignores roomId, so the membership check cannot identify the user's room-scoped role.

Expected behavior

The endpoint should support the documented roomId parameter when removing subscription-scoped roles.

The existing scope parameter should remain supported for backward compatibility because existing callers depend on it.

If both scope and roomId are provided, scope should take precedence.

Relevant files
  • apps/meteor/server/api/v1/roles.ts
  • packages/rest-typings/src/v1/roles.ts
  • packages/models/src/models/Subscriptions.ts
Additional context

The corresponding roles.addUserToRole endpoint already supports roomId.

PR #39213 migrates the roles REST endpoints to typed TypeBox validation, but does not appear to address this specific parameter-handling issue.

Dominant language
TypeScript
Stars
46.5k
Forks
14.1k
Avg merge
1d 21h
Merged PRs (30d)
381

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from RocketChat/Rocket.Chat

All issues in RocketChat/Rocket.Chat

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.