From d2ffc035d8b01ea0c3c5a87745aa08c44a92059b Mon Sep 17 00:00:00 2001 From: "Ketan (CometChat)" Date: Mon, 2 Nov 2026 19:13:20 +0530 Subject: [PATCH 1/3] docs(rbac): hide group messages sent before a member joined Add a task page for the SBAC permission listMessages.historyBeforeJoin, written in the words customers use (restrict history for new members, WhatsApp-style group history), with the Set Scope Permissions request that denies pre-join history for the participant scope. Register it in docs.json and cross-link it from the SBAC Messages table and the current Message History sections of the JavaScript, React Native, iOS, Android and Flutter SDK docs. Refs ENG-41037, Zendesk #45862. --- docs.json | 1 + rest-api/rbac-overview.mdx | 2 ++ rest-api/rbac/hide-history-before-join.mdx | 37 ++++++++++++++++++++++ sdk/android/v5/receive-messages.mdx | 4 +++ sdk/flutter/receive-messages.mdx | 4 +++ sdk/ios/receive-message.mdx | 4 +++ sdk/javascript/receive-message.mdx | 4 +++ sdk/react-native/receive-messages.mdx | 4 +++ 8 files changed, 60 insertions(+) create mode 100644 rest-api/rbac/hide-history-before-join.mdx diff --git a/docs.json b/docs.json index af5fb7603..e5a8ee3a0 100644 --- a/docs.json +++ b/docs.json @@ -4941,6 +4941,7 @@ "group": "Role Based Access Control", "pages": [ "rest-api/rbac-overview", + "rest-api/rbac/hide-history-before-join", "rest-api/rbac/list-role-permissions", "rest-api/rbac/set-role-permissions", "rest-api/rbac/unset-role-permissions", diff --git a/rest-api/rbac-overview.mdx b/rest-api/rbac-overview.mdx index adea83761..828f2f1bb 100644 --- a/rest-api/rbac-overview.mdx +++ b/rest-api/rbac-overview.mdx @@ -300,6 +300,8 @@ For `allow` / `deny` values: | Group Message Editing | Allow or deny editing messages in groups | string | `editMessage` | allow, deny | allow | | Group Message Deletion | Allow or deny deleting messages in groups | string | `deleteMessage` | allow, deny | allow | +To stop new members from seeing messages sent before they joined a group, set `listMessages.historyBeforeJoin` to `deny` for their scope. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + #### 4. Message Thread | Title | Description | Data Type | Permission Key | Available Values | Default | diff --git a/rest-api/rbac/hide-history-before-join.mdx b/rest-api/rbac/hide-history-before-join.mdx new file mode 100644 index 000000000..245c42ea1 --- /dev/null +++ b/rest-api/rbac/hide-history-before-join.mdx @@ -0,0 +1,37 @@ +--- +title: "Hide Group Messages Sent Before a Member Joined" +sidebarTitle: "Hide History Before Join" +description: "Restrict history for new members with WhatsApp-style group history: use the SBAC permission listMessages.historyBeforeJoin so newly added members cannot see messages sent before they joined a group." +--- + +To stop newly added members from seeing a group's earlier messages, use the SBAC **Message History** permission `listMessages.historyBeforeJoin`. It is set per member scope (`admin`, `moderator`, `participant`) on a group, takes `allow` or `deny`, and defaults to `allow`. When it is `deny` for a scope, members with that scope cannot list messages sent before they joined the group. + +## Hide pre-join history for a scope + + + + Call [Set Scope Permissions](/rest-api/rbac/set-scope-permissions) for the group and scope. The request body is a `permissions` object keyed by permission key. + + ```bash + curl -X PUT "https://.api-.cometchat.io/v3/groups/cometchat-guid-1/scopes/participant/permissions" \ + -H "apikey: YOUR_REST_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{"permissions": {"listMessages.historyBeforeJoin": "deny"}}' + ``` + + + Call [List Scope Permissions](/rest-api/rbac/list-scope-permissions) for the same group and scope to confirm `listMessages.historyBeforeJoin` is `deny`. + + + +## Values + +- `deny`: members with this scope cannot list messages sent before they joined the group. +- `allow` (default): members with this scope can list the full group history. Set it with the same request, or call [Unset Scope Permissions](/rest-api/rbac/unset-scope-permissions) to return to the default. + +The permission applies per scope, not per member or per date. To apply it to every member of a group, set it for each scope. + +## Related + +- [RBAC and SBAC overview](/rest-api/rbac-overview) for the full SBAC permission table and evaluation order. +- [Set Scope Permissions](/rest-api/rbac/set-scope-permissions) for the request and response reference. diff --git a/sdk/android/v5/receive-messages.mdx b/sdk/android/v5/receive-messages.mdx index 9f4034f46..48156a85a 100644 --- a/sdk/android/v5/receive-messages.mdx +++ b/sdk/android/v5/receive-messages.mdx @@ -650,6 +650,10 @@ messagesRequest.fetchPrevious(object : CallbackListener>() { Calling the `fetchPrevious()` method on the same object repeatedly allows you to fetch the entire conversation between the logged in user and the specified user. This can be implemented with upward scrolling to display the entire conversation. + +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + + ## Search Messages In other words, as a logged-in user, how do I search a message? diff --git a/sdk/flutter/receive-messages.mdx b/sdk/flutter/receive-messages.mdx index 42cf334f1..857c7f946 100644 --- a/sdk/flutter/receive-messages.mdx +++ b/sdk/flutter/receive-messages.mdx @@ -341,6 +341,10 @@ messageRequest.fetchPrevious(onSuccess: (List list) { Calling the `fetchPrevious()` method on the same object repeatedly allows you to fetch the entire conversation between the logged in user and the specified user. This can be implemented with upward scrolling to display the entire conversation. + +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + + ## Search Messages In other words, as a logged-in user, how do I search a message? diff --git a/sdk/ios/receive-message.mdx b/sdk/ios/receive-message.mdx index c064f6c5c..324a47ce0 100644 --- a/sdk/ios/receive-message.mdx +++ b/sdk/ios/receive-message.mdx @@ -216,6 +216,10 @@ messagesRequest.fetchPrevious(onSuccess: { (messages) in The list of messages received is in the form of [`BaseMessage`](/sdk/reference/messages#basemessage) objects. A [`BaseMessage`](/sdk/reference/messages#basemessage) can be a [`TextMessage`](/sdk/reference/messages#textmessage), [`MediaMessage`](/sdk/reference/messages#mediamessage), or [`CustomMessage`](/sdk/reference/messages#custommessage). Use type casting to check the type. + +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + + --- ## Offline support diff --git a/sdk/javascript/receive-message.mdx b/sdk/javascript/receive-message.mdx index 62a43cf50..dd5433b5b 100644 --- a/sdk/javascript/receive-message.mdx +++ b/sdk/javascript/receive-message.mdx @@ -224,6 +224,10 @@ messagesRequest.fetchPrevious().then( The `fetchPrevious()` method returns an array of [`BaseMessage`](/sdk/reference/messages#basemessage) objects (which may be [`TextMessage`](/sdk/reference/messages#textmessage), [`MediaMessage`](/sdk/reference/messages#mediamessage), or other subclasses). + +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + + ## Search Messages With offline support on, this filter is answered by the server only; the cached page is empty. diff --git a/sdk/react-native/receive-messages.mdx b/sdk/react-native/receive-messages.mdx index 70cf48b55..0922d4c7a 100644 --- a/sdk/react-native/receive-messages.mdx +++ b/sdk/react-native/receive-messages.mdx @@ -302,6 +302,10 @@ messagesRequest.fetchPrevious().then( The `fetchPrevious()` method returns an array of [`BaseMessage`](/sdk/reference/messages#basemessage) objects (which may be [`TextMessage`](/sdk/reference/messages#textmessage), [`MediaMessage`](/sdk/reference/messages#mediamessage), or other subclasses). + +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). + + ## Search Messages Add `setSearchKeyword()` to the builder to filter messages by keyword. From e8615b9101fb9b0af766049694b092e31535f2b6 Mon Sep 17 00:00:00 2001 From: "Ketan (CometChat)" Date: Mon, 2 Nov 2026 19:25:19 +0530 Subject: [PATCH 2/3] docs(rbac): Fold the history-before-join guidance into the RBAC overview as a section --- docs.json | 1 - rest-api/rbac-overview.mdx | 27 +++++++++++++++- rest-api/rbac/hide-history-before-join.mdx | 37 ---------------------- sdk/android/v5/receive-messages.mdx | 2 +- sdk/flutter/receive-messages.mdx | 2 +- sdk/ios/receive-message.mdx | 2 +- sdk/javascript/receive-message.mdx | 2 +- sdk/react-native/receive-messages.mdx | 2 +- 8 files changed, 31 insertions(+), 44 deletions(-) delete mode 100644 rest-api/rbac/hide-history-before-join.mdx diff --git a/docs.json b/docs.json index e5a8ee3a0..af5fb7603 100644 --- a/docs.json +++ b/docs.json @@ -4941,7 +4941,6 @@ "group": "Role Based Access Control", "pages": [ "rest-api/rbac-overview", - "rest-api/rbac/hide-history-before-join", "rest-api/rbac/list-role-permissions", "rest-api/rbac/set-role-permissions", "rest-api/rbac/unset-role-permissions", diff --git a/rest-api/rbac-overview.mdx b/rest-api/rbac-overview.mdx index 828f2f1bb..ee8fd5c9f 100644 --- a/rest-api/rbac-overview.mdx +++ b/rest-api/rbac-overview.mdx @@ -300,7 +300,7 @@ For `allow` / `deny` values: | Group Message Editing | Allow or deny editing messages in groups | string | `editMessage` | allow, deny | allow | | Group Message Deletion | Allow or deny deleting messages in groups | string | `deleteMessage` | allow, deny | allow | -To stop new members from seeing messages sent before they joined a group, set `listMessages.historyBeforeJoin` to `deny` for their scope. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, set `listMessages.historyBeforeJoin` to `deny` for their scope. See [Hide group messages sent before a member joined](#hide-group-messages-sent-before-a-member-joined). #### 4. Message Thread @@ -342,6 +342,31 @@ The following example denies the sendMessage permission for the participant scop } ``` +### Hide Group Messages Sent Before a Member Joined + +To stop newly added members from seeing a group's earlier messages, use the **Message History** permission `listMessages.historyBeforeJoin`. It is set per member scope (`admin`, `moderator`, `participant`) on a group, takes `allow` or `deny`, and defaults to `allow`. When it is `deny` for a scope, members with that scope cannot list messages sent before they joined the group. + + + + Call [Set Scope Permissions](/rest-api/rbac/set-scope-permissions) for the group and scope. The request body is a `permissions` object keyed by permission key. + + ```bash + curl -X PUT "https://.api-.cometchat.io/v3/groups/cometchat-guid-1/scopes/participant/permissions" \ + -H "apikey: YOUR_REST_API_KEY" \ + -H "Content-Type: application/json" \ + -d '{"permissions": {"listMessages.historyBeforeJoin": "deny"}}' + ``` + + + Call [List Scope Permissions](/rest-api/rbac/list-scope-permissions) for the same group and scope to confirm `listMessages.historyBeforeJoin` is `deny`. + + + +- `deny`: members with this scope cannot list messages sent before they joined the group. +- `allow` (default): members with this scope can list the full group history. Set it with the same request, or call [Unset Scope Permissions](/rest-api/rbac/unset-scope-permissions) to return to the default. + +The permission applies per scope, not per member or per date. To apply it to every member of a group, set it for each scope. + ### SBAC Permission Evaluation Order 1. **Explicitly configured permission** for the scope which has the highest priority diff --git a/rest-api/rbac/hide-history-before-join.mdx b/rest-api/rbac/hide-history-before-join.mdx deleted file mode 100644 index 245c42ea1..000000000 --- a/rest-api/rbac/hide-history-before-join.mdx +++ /dev/null @@ -1,37 +0,0 @@ ---- -title: "Hide Group Messages Sent Before a Member Joined" -sidebarTitle: "Hide History Before Join" -description: "Restrict history for new members with WhatsApp-style group history: use the SBAC permission listMessages.historyBeforeJoin so newly added members cannot see messages sent before they joined a group." ---- - -To stop newly added members from seeing a group's earlier messages, use the SBAC **Message History** permission `listMessages.historyBeforeJoin`. It is set per member scope (`admin`, `moderator`, `participant`) on a group, takes `allow` or `deny`, and defaults to `allow`. When it is `deny` for a scope, members with that scope cannot list messages sent before they joined the group. - -## Hide pre-join history for a scope - - - - Call [Set Scope Permissions](/rest-api/rbac/set-scope-permissions) for the group and scope. The request body is a `permissions` object keyed by permission key. - - ```bash - curl -X PUT "https://.api-.cometchat.io/v3/groups/cometchat-guid-1/scopes/participant/permissions" \ - -H "apikey: YOUR_REST_API_KEY" \ - -H "Content-Type: application/json" \ - -d '{"permissions": {"listMessages.historyBeforeJoin": "deny"}}' - ``` - - - Call [List Scope Permissions](/rest-api/rbac/list-scope-permissions) for the same group and scope to confirm `listMessages.historyBeforeJoin` is `deny`. - - - -## Values - -- `deny`: members with this scope cannot list messages sent before they joined the group. -- `allow` (default): members with this scope can list the full group history. Set it with the same request, or call [Unset Scope Permissions](/rest-api/rbac/unset-scope-permissions) to return to the default. - -The permission applies per scope, not per member or per date. To apply it to every member of a group, set it for each scope. - -## Related - -- [RBAC and SBAC overview](/rest-api/rbac-overview) for the full SBAC permission table and evaluation order. -- [Set Scope Permissions](/rest-api/rbac/set-scope-permissions) for the request and response reference. diff --git a/sdk/android/v5/receive-messages.mdx b/sdk/android/v5/receive-messages.mdx index 48156a85a..05c03c73e 100644 --- a/sdk/android/v5/receive-messages.mdx +++ b/sdk/android/v5/receive-messages.mdx @@ -651,7 +651,7 @@ messagesRequest.fetchPrevious(object : CallbackListener>() { Calling the `fetchPrevious()` method on the same object repeatedly allows you to fetch the entire conversation between the logged in user and the specified user. This can be implemented with upward scrolling to display the entire conversation. -To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac-overview#hide-group-messages-sent-before-a-member-joined). ## Search Messages diff --git a/sdk/flutter/receive-messages.mdx b/sdk/flutter/receive-messages.mdx index 857c7f946..2d2466b7e 100644 --- a/sdk/flutter/receive-messages.mdx +++ b/sdk/flutter/receive-messages.mdx @@ -342,7 +342,7 @@ messageRequest.fetchPrevious(onSuccess: (List list) { Calling the `fetchPrevious()` method on the same object repeatedly allows you to fetch the entire conversation between the logged in user and the specified user. This can be implemented with upward scrolling to display the entire conversation. -To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac-overview#hide-group-messages-sent-before-a-member-joined). ## Search Messages diff --git a/sdk/ios/receive-message.mdx b/sdk/ios/receive-message.mdx index 324a47ce0..a73e979c7 100644 --- a/sdk/ios/receive-message.mdx +++ b/sdk/ios/receive-message.mdx @@ -217,7 +217,7 @@ The list of messages received is in the form of [`BaseMessage`](/sdk/reference/m -To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac-overview#hide-group-messages-sent-before-a-member-joined). --- diff --git a/sdk/javascript/receive-message.mdx b/sdk/javascript/receive-message.mdx index dd5433b5b..ab55fe7ae 100644 --- a/sdk/javascript/receive-message.mdx +++ b/sdk/javascript/receive-message.mdx @@ -225,7 +225,7 @@ messagesRequest.fetchPrevious().then( The `fetchPrevious()` method returns an array of [`BaseMessage`](/sdk/reference/messages#basemessage) objects (which may be [`TextMessage`](/sdk/reference/messages#textmessage), [`MediaMessage`](/sdk/reference/messages#mediamessage), or other subclasses). -To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac-overview#hide-group-messages-sent-before-a-member-joined). ## Search Messages diff --git a/sdk/react-native/receive-messages.mdx b/sdk/react-native/receive-messages.mdx index 0922d4c7a..287c6927c 100644 --- a/sdk/react-native/receive-messages.mdx +++ b/sdk/react-native/receive-messages.mdx @@ -303,7 +303,7 @@ messagesRequest.fetchPrevious().then( The `fetchPrevious()` method returns an array of [`BaseMessage`](/sdk/reference/messages#basemessage) objects (which may be [`TextMessage`](/sdk/reference/messages#textmessage), [`MediaMessage`](/sdk/reference/messages#mediamessage), or other subclasses). -To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac/hide-history-before-join). +To stop new members from seeing messages sent before they joined a group, use the SBAC permission `listMessages.historyBeforeJoin`. See [Hide group messages sent before a member joined](/rest-api/rbac-overview#hide-group-messages-sent-before-a-member-joined). ## Search Messages From e8f9251fc676f94e04af1295e3449f16cc71f990 Mon Sep 17 00:00:00 2001 From: "Ketan (CometChat)" Date: Tue, 3 Nov 2026 15:20:21 +0530 Subject: [PATCH 3/3] docs(rbac): State that deny filters pre-join messages and that rejoining resets the join time --- rest-api/rbac-overview.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/rest-api/rbac-overview.mdx b/rest-api/rbac-overview.mdx index ee8fd5c9f..d1912b177 100644 --- a/rest-api/rbac-overview.mdx +++ b/rest-api/rbac-overview.mdx @@ -362,10 +362,10 @@ To stop newly added members from seeing a group's earlier messages, use the **Me -- `deny`: members with this scope cannot list messages sent before they joined the group. +- `deny`: messages sent before the member joined are left out of the list. The request succeeds; it returns only messages from the join time onward. - `allow` (default): members with this scope can list the full group history. Set it with the same request, or call [Unset Scope Permissions](/rest-api/rbac/unset-scope-permissions) to return to the default. -The permission applies per scope, not per member or per date. To apply it to every member of a group, set it for each scope. +The permission applies per scope, not per member or per date. To apply it to every member of a group, set it for each scope. The join time is the member's most recent join: a member who leaves and rejoins sees history only from the rejoin onward. ### SBAC Permission Evaluation Order