Fix: Apply changed setting permissions reactively

packages/rocketchat-authorization/server/publications/permissions.js

@@ -48,11 +48,21 @@ Meteor.methods({
 	}
 });
 
+function notifySettings(type, permission) {
+	if (permission.level === permissionLevel.SETTING) {
+		// if the permission changes, the effect on the visible settings depends on the role affected.
+		// The selected-settings-based consumers have to react accordingly and either add or remove the
+		// setting from the user's collection
+		const setting = RocketChat.models.Settings.findOneById(permission.settingId);
+		RocketChat.Notifications.notifyLoggedInThisInstance('private-settings-changed', 'auth', setting);
+	}
+}
 
 RocketChat.models.Permissions.on('changed', (type, permission) => {
 	RocketChat.Notifications.notifyLoggedInThisInstance('permissions-changed', type, permission);
-	if (permission.level === permissionLevel.SETTING) {
-		RocketChat.Notifications.notifyLoggedInThisInstance('selected-settings-changed', type, permission);
-	}
+	notifySettings(type, permission);
 });
 
+RocketChat.models.Permissions.on('removed', (type, permission) => {
+	notifySettings(type, permission);
+});

packages/rocketchat-ui-admin/client/SettingsCachedCollection.js

@@ -0,0 +1,31 @@
+import _ from 'underscore';
+
+export class PrivateSettingsCachedCollection extends RocketChat.CachedCollection {
+	constructor() {
+		super({
+			name: 'private-settings',
+			eventType: 'onLogged'
+		});
+	}
+
+	setupListener(eventType, eventName) {
+		super.setupListener(eventType, eventName);
+
+		// private settings also need to listen to a change of authorizationsfor the setting-based authorizations
+		RocketChat.Notifications[eventType || this.eventType](eventName || this.eventName, (t, record) => {
+			this.log('record received', t, record);
+			if (t === 'auth') {
+				if (! (RocketChat.authz.hasAllPermission([`change-setting-${ record._id }`, 'manage-selected-settings'])
+					|| RocketChat.authz.hasAllPermission('view-privileged-setting'))) {
+					this.collection.remove(record._id);
+					RoomManager.close(record.t + record.name);
+				} else {
+					delete record.$loki;
+					this.collection.upsert({_id: record._id}, _.omit(record, '_id'));
+				}
+
+				this.saveCache();
+			}
+		});
+	}
+}

packages/rocketchat-ui-admin/client/admin.js

@@ -2,6 +2,7 @@
 import _ from 'underscore';
 import s from 'underscore.string';
 import toastr from 'toastr';
+import {PrivateSettingsCachedCollection} from './SettingsCachedCollection';
 
 const TempSettings = new Mongo.Collection(null);
 
@@ -45,10 +46,7 @@ const setFieldValue = function(settingId, value, type, editor) {
 
 Template.admin.onCreated(function() {
 	if (RocketChat.settings.cachedCollectionPrivate == null) {
-		RocketChat.settings.cachedCollectionPrivate = new RocketChat.CachedCollection({
-			name: 'private-settings',
-			eventType: 'onLogged'
-		});
+		RocketChat.settings.cachedCollectionPrivate = new PrivateSettingsCachedCollection();
 		RocketChat.settings.collectionPrivate = RocketChat.settings.cachedCollectionPrivate.collection;
 		RocketChat.settings.cachedCollectionPrivate.init();
 	}

packages/rocketchat-ui-admin/client/adminFlex.js

@@ -1,13 +1,11 @@
 import _ from 'underscore';
 import s from 'underscore.string';
+import {PrivateSettingsCachedCollection} from './SettingsCachedCollection';
 
 Template.adminFlex.onCreated(function() {
 	this.settingsFilter = new ReactiveVar('');
 	if (RocketChat.settings.cachedCollectionPrivate == null) {
-		RocketChat.settings.cachedCollectionPrivate = new RocketChat.CachedCollection({
-			name: 'private-settings',
-			eventType: 'onLogged'
-		});
+		RocketChat.settings.cachedCollectionPrivate = new PrivateSettingsCachedCollection();
 		RocketChat.settings.collectionPrivate = RocketChat.settings.cachedCollectionPrivate.collection;
 		RocketChat.settings.cachedCollectionPrivate.init();
 	}