LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Calls in private group rooms: only admins can start or join. Members see "1 Live · Join" and then "You don't have permission to join!" #328

New Issue
Closed
opened 2026-10-05 18:54:20 -04:00 by jared · 0 comments
jared commented 2026-10-05 18:54:20 -04:00
Owner
Copy Link
Copy Source

Lotus shows the call button in DMs and invite-only rooms without a space parent (LOTUS_FEATURES "Call Button Scoping"; CallEmbedProvider rings in exactly those rooms). But createRoom (src/app/components/create-room/utils.ts:96-100, 142-145) grants org.matrix.msc3401.call.member: 0 only for voice rooms (RoomType.Call). Every other room gets Synapse's default state_default: 50, and call.member is a state event, so ordinary members (PL 0) can't send it.

Measured (invite-only private_chat room, the shape a normal "Create Room → Private" gives: state_default: 50, no call.member entry; main = admin, Bob = member):

  • Bob's header has no Start call button.
  • main starts a call. Bob gets no ring, because handleTimelineEvent checks hasCallPermission. His room shows "1 Live" and a Join button, and pressing it shows "You don't have permission to join!".
  • Server state: only @aud_main in the call.

So group calls in private rooms work only for admins. Everyone else sees a call they can't join. DMs are fine, because the trusted_private_chat preset makes both users PL 100.

Fix:

  • Add events: { 'org.matrix.msc3401.call.member': 0 } to power_level_content_override for every room created with calls possible (Element Web does the same for its call-enabled rooms).
  • For existing rooms, when an admin starts a call and call.member needs more than the default user level, offer "Let members join calls in this room?", which sets it to 0.
  • Hide "Join" or "1 Live" from users who can't join, or explain why ("Only moderators can join calls here"), rather than a bare error after clicking.

Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny 30e2dbcd, cinny-desktop 8f67ec7, element-call 3b0050e8.

Lotus shows the call button in DMs **and invite-only rooms without a space parent** (LOTUS_FEATURES "Call Button Scoping"; `CallEmbedProvider` rings in exactly those rooms). But `createRoom` (src/app/components/create-room/utils.ts:96-100, 142-145) grants `org.matrix.msc3401.call.member: 0` **only for voice rooms** (`RoomType.Call`). Every other room gets Synapse's default `state_default: 50`, and `call.member` is a state event, so ordinary members (PL 0) can't send it. **Measured** (invite-only `private_chat` room, the shape a normal "Create Room → Private" gives: `state_default: 50`, no `call.member` entry; main = admin, Bob = member): - Bob's header has **no Start call** button. - main starts a call. Bob gets **no ring**, because `handleTimelineEvent` checks `hasCallPermission`. His room shows **"1 Live"** and a **Join** button, and pressing it shows **"You don't have permission to join!"**. - Server state: only `@aud_main` in the call. So group calls in private rooms work only for admins. Everyone else sees a call they can't join. DMs are fine, because the `trusted_private_chat` preset makes both users PL 100. **Fix:** - Add `events: { 'org.matrix.msc3401.call.member': 0 }` to `power_level_content_override` for every room created with calls possible (Element Web does the same for its call-enabled rooms). - For existing rooms, when an admin starts a call and `call.member` needs more than the default user level, offer "Let members join calls in this room?", which sets it to 0. - Hide "Join" or "1 Live" from users who can't join, or explain why ("Only moderators can join calls here"), rather than a bare error after clicking. --- _Found in the October 2026 client audit (Playwright against a local Synapse + LiveKit stack, plus code reading). Code refs are at cinny `30e2dbcd`, cinny-desktop `8f67ec7`, element-call `3b0050e8`._
jared added the bugpriority: mediumarea: calls labels 2026-10-05 18:54:20 -04:00
jared closed this issue 2026-10-17 19:54:43 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: calls bug priority: medium
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#328