fix: don't allow omnichannel agents to join closed rooms

.changeset/gold-cougars-stare.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue that allowed agents without the `preview-c-room` permission to join a closed livechat conversation, creating a livechat room that could not be closed or removed from the sidebar.

apps/meteor/client/views/room/hooks/useOpenRoom.ts

@@ -97,7 +97,7 @@ export function useOpenRoom({ type, reference }: { type: RoomType; reference: st
 			const sub = Subscriptions.findOne({ rid: room._id });
 
 			// if user doesn't exist at this point, anonymous read is enabled, otherwise an error would have been thrown
-			if (user && !sub && !hasPreviewPermission) {
+			if (user && !sub && !hasPreviewPermission && type !== 'l') {
 				throw new NotSubscribedToRoomError(undefined, { rid: room._id });
 			}
 

apps/meteor/tests/e2e/omnichannel/omnichannel-chat-history.spec.ts

@@ -31,9 +31,11 @@ test.describe('Omnichannel chat history', () => {
 		await api.delete('/livechat/users/agent/user1');
 		await api.delete('/livechat/users/manager/user1');
 		await agent.page.close();
+
+		await api.post('/permissions.update', { permissions: [{ _id: 'view-c-room', roles: ['admin', 'owner', 'moderator', 'user'] }] });
 	});
 
-	test('Receiving a message from visitor', async ({ page }) => {
+	test('Receiving a message from visitor', async ({ page, api }) => {
 		await test.step('Expect send a message as a visitor', async () => {
 			await page.goto('/livechat');
 			await poLiveChat.openLiveChat();
@@ -72,5 +74,17 @@ test.describe('Omnichannel chat history', () => {
 			await agent.poHomeOmnichannel.contacts.contactInfo.historyItem.click();
 			await expect(agent.poHomeOmnichannel.contacts.contactInfo.historyMessage).toBeVisible();
 		});
+
+		await api.post('/permissions.update', { permissions: [{ _id: 'view-c-room', roles: [] }] });
+
+		await test.step('Expect to not be able to see conversation history', async () => {
+			await agent.page.reload();
+
+			await agent.poHomeOmnichannel.contacts.contactInfo.historyItem.click();
+			await agent.poHomeOmnichannel.contacts.contactInfo.historyMessage.click();
+
+			// Should not show the NoSubscribedRoom.tsx component on livechat rooms
+			await expect(agent.page.getByRole('button', { name: 'Join_channel' })).not.toBeVisible();
+		});
 	});
 });