From f6f86080df1959d32d668f5f3561c168cf9f01ee Mon Sep 17 00:00:00 2001 From: manikantagoudgoud447 Date: Sun, 21 Jun 2026 20:10:26 +0530 Subject: [PATCH 1/3] fix: use $ne operator in findCustomRoles to prevent false negatives The query protected:false missed roles where the protected field was absent, causing a false negative. Changed to protected:{$ne:true} which correctly matches both protected:false and missing protected field. Applied the same fix to countCustomRoles. --- packages/models/src/models/Roles.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/models/src/models/Roles.ts b/packages/models/src/models/Roles.ts index 36468e3e4b14e..b98020a40def9 100644 --- a/packages/models/src/models/Roles.ts +++ b/packages/models/src/models/Roles.ts @@ -138,7 +138,7 @@ export class RolesRaw extends BaseRaw implements IRolesModel { findCustomRoles(options?: FindOptions): FindCursor { const query: Filter = { - protected: false, + protected: { $ne: true }, }; return this.find(query, options || {}); @@ -146,7 +146,7 @@ export class RolesRaw extends BaseRaw implements IRolesModel { countCustomRoles(options?: CountDocumentsOptions): Promise { const query: Filter = { - protected: false, + protected: { $ne: true }, }; return this.countDocuments(query, options || {}); From 7db02e6a64830a22142ecbd92502a005a564eeec Mon Sep 17 00:00:00 2001 From: manikantagoudgoud447 Date: Sun, 21 Jun 2026 20:29:14 +0530 Subject: [PATCH 2/3] fix: ensure protected flag is set for built-in roles during startup Since legacy workspaces might have built-in roles missing the protected flag, this ensures that the protected flag is added to them on startup. --- apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts b/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts index ea59a2961ea44..0074127ee679a 100644 --- a/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts +++ b/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts @@ -18,6 +18,8 @@ export const createOrUpdateProtectedRoleAsync = async ( roleData.mandatory2fa || role.mandatory2fa, ); + await Roles.updateOne({ _id: roleId, protected: { $ne: true } }, { $set: { protected: true } }); + return; } From 58dbc6caef0151770a2ab6404ea89efba5086960 Mon Sep 17 00:00:00 2001 From: manikantagoudgoud447 Date: Sat, 25 Jul 2026 18:41:59 +0530 Subject: [PATCH 3/3] chore: address review feedback for protected roles fix --- .changeset/fix-missing-protected-roles.md | 6 ++++++ apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts | 2 -- 2 files changed, 6 insertions(+), 2 deletions(-) create mode 100644 .changeset/fix-missing-protected-roles.md diff --git a/.changeset/fix-missing-protected-roles.md b/.changeset/fix-missing-protected-roles.md new file mode 100644 index 0000000000000..6f28fac9bca7d --- /dev/null +++ b/.changeset/fix-missing-protected-roles.md @@ -0,0 +1,6 @@ +--- +'@rocket.chat/models': patch +'@rocket.chat/meteor': patch +--- + +Fix custom roles not being found when `protected` is missing. Closes #40798. diff --git a/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts b/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts index 0074127ee679a..ea59a2961ea44 100644 --- a/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts +++ b/apps/meteor/server/lib/roles/createOrUpdateProtectedRole.ts @@ -18,8 +18,6 @@ export const createOrUpdateProtectedRoleAsync = async ( roleData.mandatory2fa || role.mandatory2fa, ); - await Roles.updateOne({ _id: roleId, protected: { $ne: true } }, { $set: { protected: true } }); - return; }