Unexpected behavior when starting a conversation without the "Searching" permission #10929

2 Answer(s)

• 

  0

  AI-Bot created 20 days ago

  Support Team ABP Agent

  • In ABP Commercial Chat module, the Chat → Messaging → Searching permission is used to control whether a user is allowed to search / start a new conversation with arbitrary users (i.e., users they don’t already have a conversation/contact relationship with).

  • So the expected behavior for a user without this permission should be:

    1. They should not be able to start a brand-new conversation with a user they’ve never interacted with (or the UI should prevent selecting such users).
    2. If they still somehow reach a “new conversation” state (deep link, cached UI state, etc.), then when they try to send the first message, the server is expected to return 403 (Forbidden) (as you already see).
    3. The client should handle this 403 gracefully (show an authorization/toast/message and keep the page usable). The current behavior you report (unhandled AbpRemoteCallException: Forbidden that breaks the Blazor page) is a client-side unhandled exception and is not desirable.

  • Practically, you can treat what you’re seeing as a UI/client robustness bug in the Chat Blazor UI: the backend authorization is correctly enforced, but the Blazor page is not catching/handling AbpRemoteCallException for that action.

  • Workaround (recommended in your app until it’s fixed upstream):

    1. Hide/disable “start conversation / user search” UI if the user lacks the permission (via IAuthorizationService / IPermissionChecker / AuthorizeView).
    2. Add a try/catch around the SendMessageAsync call in the page/component and handle AbpRemoteCallException (status 403) by showing a message and reverting UI state instead of letting it bubble and kill the circuit.

    Example pattern (you’ll need to adapt names to your page code-behind):

  try
    {
        await ConversationClientProxy.SendMessageAsync(input);
    }
    catch (Volo.Abp.Http.Client.AbpRemoteCallException ex)
    {
        // Forbidden
        if (ex.HttpStatusCode == System.Net.HttpStatusCode.Forbidden)
        {
            // Show a UI message/toast and prevent the page from breaking
            // e.g. await MessageService.Error(L["YouAreNotAllowedToStartConversation"]);
            return;
        }
  
        throw; // keep other errors visible
    }
  

  • Also, to prevent the “open conversation with someone never interacted with” path entirely: ensure the UI only allows initiating conversations from an allowed set (existing contacts/conversations) when Searching is not granted.

  (Links omitted because I couldn’t retrieve repository sources via the available tools in this environment to validate exact implementation details/URLs.)

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel
• 

  0

  maliming created 19 days ago

  Support Team Fullstack Developer

  Hi,

  Without the Searching permission, a user can only send messages to people they already have a conversation with. They can't start a new conversation, so the server rejects that message.

  The Blazor chat page doesn't handle this correctly. The search still lists all users, and the page doesn't catch the error when sending fails. This is a bug on our side.

  You can use this workaround for now. Add this class to your Application project. With it, users without the Searching permission only see the people they already have a conversation with in the search results.

  using System.Collections.Generic;
  using System.Threading.Tasks;
  using Microsoft.AspNetCore.Authorization;
  using Volo.Abp.DependencyInjection;
  using Volo.Abp.PermissionManagement;
  using Volo.Chat.Authorization;
  using Volo.Chat.Conversations;
  using Volo.Chat.Users;
  
  namespace YourProjectName.Chat;
  
  [Dependency(ReplaceServices = true)]
  [ExposeServices(typeof(IContactAppService), typeof(ContactAppService))]
  public class MyContactAppService : ContactAppService
  {
      public MyContactAppService(
          IChatUserLookupService chatUserLookupService,
          IConversationRepository conversationRepository,
          IPermissionFinder permissionFinder)
          : base(chatUserLookupService, conversationRepository, permissionFinder)
      {
      }
  
      public override async Task<List<ChatContactDto>> GetContactsAsync(GetContactsInput input)
      {
          if (input.IncludeOtherContacts && !await AuthorizationService.IsGrantedAsync(ChatPermissions.Searching))
          {
              input.IncludeOtherContacts = false;
          }
  
          return await base.GetContactsAsync(input);
      }
  }
  

  We'll fix this in the next patch release. The search box will be hidden for users without the Searching permission, and a failed send will show an error message instead of breaking the page. Your ticket has been refunded.

  Thanks

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel