[error-room-not-found] when trying to add user to a private group from API with [add-user-to-any-p-room] permission

[driesmeyers]

Description:

I'm trying to add a registered user to a private group. I'm posting a request via API (https://rocket.chat/docs/developer-guides/rest-api/groups/invite/) with admin credentials. The admin is not a member of the private group but should be able to add another user with the add-user-to-any-p-room permission. I keep getting 'error-room-not-found' as error type. However the request seems to work when the admin is member of the private group.

Server Setup Information:

• Version of Rocket.Chat Server: 0.64.0-develop
• Operating System: macOS 10.13.4 High Sierra
• Deployment Method(snap/docker/tar/etc):
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• Node Version: v8.11.1
• mongoDB Version: 3.4.10

Steps to Reproduce:

1. Enable add-user-to-any-p-room permission for user that is sending the request
2. Create second user
3. Set request headers x-auth-token and x-user-id
4. Send POST request to http://localhost:3000/api/v1/groups.invite
   Body:
   {
   "userId": "75c9mWS83yCTcqn2X", // straight from database
   "roomId": "dnqSmTG52uCzyPm3j" // straight from database
   }

Same request works when the admin is member of the private group.

Expected behavior:

User is added to the group while admin is still not a member.

Actual behavior:

Response with error type "error-room-not-found'

Relevant logs:

Nothing relevant coming from logs.

Response:
{
"success": false,
"error": "The required "roomId" or "roomName" param provided does not match any group [error-room-not-found]",
"errorType": "error-room-not-found"
}

error thrown in Rocket.Chat/packages/rocketchat-api/server/v1/groups.js line 17

[thepowerprocess]

I am also seeing this.

[q16marvin]

i have still exakt this problem, admin with permission "add-user-to-any-p-room" cant add users to private rooms where admin is not a member, what do i wrong?

[vv9k]

I can also confirm that this is still a problem, tried to use api today to invite users to a private group which admin user is not a part of and i got:
The required "roomId" or "roomName" param provided does not match any group [error-room-not-found]

And I made sure that the Admin role has add-user-to-any-p-room

And I checked that admin added to the group can in fact invite others with the same payload sent to groups.invite.

[Kuper299]

I'm also facing the same issue, was this matter solved or was a bypass found?

Trying to delete a room using an API call (Using Python Sessions), the session is active and working well as I managed to call different endpoints successfully.

receiving the following response:

{ "success": false, "error": "The required \"roomId\" or \"roomName\" param provided does not match any group [error-room-not-found]", "errorType": "error-room-not-found" }

I tried to switch between roomId and roomName but the output is the same.

Also, I can confirm the roomId and roomName are correct.

About the system:

Running on AWS,
Data base: MongoDb 5.0.19
Rocket chat version: 5.4.1
Node version: v14.19.3

Please let me know if you need further information and thank you.

[jeffreyvanhees]

I noticed this issue was closed, but I'm still encountering the same problem. Has there been any progress on finding a solution?

For context, I'm making direct HTTP requests without using any packages, which suggests the issue lies with the API itself rather than client implementations.

I'm using the /api/v1/channels.invite-endpoint and I'm sure my userId and roomId are correct.