Unexpected behavior when starting a conversation without the "Searching" permission #10929

1 Answer(s)

• 

  0

  AI-Bot created 4 hours ago

  Support Team ABP Agent

  • In ABP Commercial Chat module, the Chat → Messaging → Searching permission is used to control whether a user is allowed to search / start a new conversation with arbitrary users (i.e., users they don’t already have a conversation/contact relationship with).

  • So the expected behavior for a user without this permission should be:

    1. They should not be able to start a brand-new conversation with a user they’ve never interacted with (or the UI should prevent selecting such users).
    2. If they still somehow reach a “new conversation” state (deep link, cached UI state, etc.), then when they try to send the first message, the server is expected to return 403 (Forbidden) (as you already see).
    3. The client should handle this 403 gracefully (show an authorization/toast/message and keep the page usable). The current behavior you report (unhandled AbpRemoteCallException: Forbidden that breaks the Blazor page) is a client-side unhandled exception and is not desirable.

  • Practically, you can treat what you’re seeing as a UI/client robustness bug in the Chat Blazor UI: the backend authorization is correctly enforced, but the Blazor page is not catching/handling AbpRemoteCallException for that action.

  • Workaround (recommended in your app until it’s fixed upstream):

    1. Hide/disable “start conversation / user search” UI if the user lacks the permission (via IAuthorizationService / IPermissionChecker / AuthorizeView).
    2. Add a try/catch around the SendMessageAsync call in the page/component and handle AbpRemoteCallException (status 403) by showing a message and reverting UI state instead of letting it bubble and kill the circuit.

    Example pattern (you’ll need to adapt names to your page code-behind):

  try
    {
        await ConversationClientProxy.SendMessageAsync(input);
    }
    catch (Volo.Abp.Http.Client.AbpRemoteCallException ex)
    {
        // Forbidden
        if (ex.HttpStatusCode == System.Net.HttpStatusCode.Forbidden)
        {
            // Show a UI message/toast and prevent the page from breaking
            // e.g. await MessageService.Error(L["YouAreNotAllowedToStartConversation"]);
            return;
        }
  
        throw; // keep other errors visible
    }
  

  • Also, to prevent the “open conversation with someone never interacted with” path entirely: ensure the UI only allows initiating conversations from an allowed set (existing contacts/conversations) when Searching is not granted.

  (Links omitted because I couldn’t retrieve repository sources via the available tools in this environment to validate exact implementation details/URLs.)

  ---

  This response was generated by AI. If it didn’t solve your problem, feel free to post a new answer — our support team will jump in to help you soon.

  Markdown supported.

  Copy, paste, or drag & drop images and files (max 100 MB per file, 100 MB total per post)

  Save Cancel