fix: Check for room scoped permissions for creating discussions

.changeset/sweet-chefs-exist.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Check for room scoped permissions for starting discussions

apps/meteor/app/discussion/client/createDiscussionMessageAction.ts

@@ -59,7 +59,7 @@ Meteor.startup(() => {
 					return false;
 				}
 
-				return uid !== user._id ? hasPermission('start-discussion-other-user') : hasPermission('start-discussion');
+				return uid !== user._id ? hasPermission('start-discussion-other-user', room._id) : hasPermission('start-discussion', room._id);
 			},
 			order: 1,
 			group: 'menu',

apps/meteor/app/discussion/server/methods/createDiscussion.ts

@@ -221,7 +221,7 @@ export const createDiscussion = async (
 		});
 	}
 
-	if (!(await hasAtLeastOnePermissionAsync(userId, ['start-discussion', 'start-discussion-other-user']))) {
+	if (!(await hasAtLeastOnePermissionAsync(userId, ['start-discussion', 'start-discussion-other-user'], prid))) {
 		throw new Meteor.Error('error-action-not-allowed', 'You are not allowed to create a discussion', { method: 'createDiscussion' });
 	}
 	const user = await Users.findOneById(userId);

apps/meteor/client/views/room/composer/messageBox/MessageBoxActionsToolbar/actions/CreateDiscussionAction.tsx

@@ -14,8 +14,8 @@ const CreateDiscussionAction = ({ room }: { room: IRoom }) => {
 		setModal(<CreateDiscussion onClose={() => setModal(null)} defaultParentRoom={room?.prid || room?._id} />);
 
 	const discussionEnabled = useSetting('Discussion_enabled') as boolean;
-	const canStartDiscussion = usePermission('start-discussion');
-	const canSstartDiscussionOtherUser = usePermission('start-discussion-other-user');
+	const canStartDiscussion = usePermission('start-discussion', room._id);
+	const canSstartDiscussionOtherUser = usePermission('start-discussion-other-user', room._id);
 
 	const allowDiscussion = room && discussionEnabled && !isRoomFederated(room) && (canStartDiscussion || canSstartDiscussionOtherUser);