[API, Client 1903] Users without invite permissions can action join requests after permission was revoked
needs more information
LillithRosePup
Trimmed audit logs:
[
{
"actorDisplayName": "DisplayName",
"actorId": "usr_id",
"created_at": "2026-09-20T23:17:42.779Z",
"data": {},
"description": "Member DisplayName has rejected DisplayName's join request.",
"eventType": "group.request.reject",
"groupId": "grp_7f6a7e77-6488-4216-8a75-acab5322fb95",
"id": "gaud_45c8d522-0649-40d2-9792-b37d1c30e151",
"targetId": "usr_id"
},
{
"actorDisplayName": "FragmentedAdmin",
"actorId": "usr_2ab84e3d-086a-4d15-b2e7-ec77bcab8530",
"created_at": "2026-09-20T16:28:12.319Z",
"data": {
"roleId": "grol_eebb0fdf-9377-4821-898d-687e91486368",
"roleName": "temp perms"
},
"description": "FragmentedAdmin unassigned the role \"temp perms\" from DisplayName",
"eventType": "group.member.role.unassign",
"groupId": "grp_7f6a7e77-6488-4216-8a75-acab5322fb95",
"id": "gaud_36faf99f-7ecd-451e-ac65-9980e4b74d2f",
"targetId": "usr_id"
}
]
Actor Member:
{
"acceptedByDisplayName": "DisplayName",
"acceptedById": "usr_id",
"bannedAt": null,
"createdAt": "2025-05-18T02:15:37.705Z",
"groupId": "grp_7f6a7e77-6488-4216-8a75-acab5322fb95",
"hasJoinedFromPurchase": false,
"id": "gmem_54223642-089c-44d9-9a99-cad18da0b082",
"isRepresenting": false,
"isSubscribedToAnnouncements": true,
"joinedAt": "2025-05-18T02:16:02.779Z",
"lastPostReadAt": "2026-09-20T00:54:57.556Z",
"mRoleIds": [],
"managerNotes": "",
"membershipStatus": "member",
"roleIds": [
"grol_0af25075-2f81-4170-b0bd-36abf33abfa1"
],
"userId": "usr_id",
"visibility": "visible"
}
Only Group Roles:
[
{
"createdAt": "2024-03-10T20:46:05.830Z",
"description": "A member of the group.",
"groupId": "grp_7f6a7e77-6488-4216-8a75-acab5322fb95",
"id": "grol_0af25075-2f81-4170-b0bd-36abf33abfa1",
"isAddedOnJoin": true,
"isManagementRole": false,
"isSelfAssignable": false,
"name": "Commoner",
"order": 10,
"permissions": [
"group-instance-join"
],
"requiresPurchase": false,
"requiresTwoFactor": false,
"updatedAt": "2024-04-24T23:59:51.886Z"
},
{
"createdAt": "2024-03-28T20:52:20.683Z",
"defaultRole": true,
"description": "Permissions applied to all group members.",
"groupId": "grp_7f6a7e77-6488-4216-8a75-acab5322fb95",
"id": "grol_34d6a182-8072-4068-816e-de602d10e700",
"isAddedOnJoin": false,
"isManagementRole": false,
"isSelfAssignable": false,
"name": "Everyone",
"order": 99999997,
"permissions": [],
"requiresPurchase": false,
"requiresTwoFactor": false,
"updatedAt": "2024-03-28T20:52:20.683Z"
}
]
Build number attached is the build of the actor
Log In
StormRel
updated the status to
needs more information
Can you clarify the steps/scenario for this bug? Was this involving a group instance?
LillithRosePup
StormRel A user requested our group while the Actor had invite permissions. Later, the actor's invite managment permissions were revoked, as they were temporary. Further later, presumably they still had the group request notification, as they were able to deny it