From fc401a0fc35b123a895ed63b9142d607b18307cc Mon Sep 17 00:00:00 2001
From: spaced4ndy <8711996+spaced4ndy@users.noreply.github.com>
Date: Fri, 29 May 2026 17:26:27 +0400
Subject: [PATCH] wip

---
 src/Simplex/Chat/Library/Subscriber.hs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/Simplex/Chat/Library/Subscriber.hs b/src/Simplex/Chat/Library/Subscriber.hs
index 4c0de89be2..0df684d006 100644
--- a/src/Simplex/Chat/Library/Subscriber.hs
+++ b/src/Simplex/Chat/Library/Subscriber.hs
@@ -3146,6 +3146,8 @@ processAgentMessageConn vr user@User {userId} corrId agentConnId agentMessage =
         changeMemberRole gInfo' member@GroupMember {memberRole = fromRole} gEvent
           | senderRole < GRAdmin || senderRole < fromRole =
               messageError "x.grp.mem.role with insufficient member permissions" $> Nothing
+          | useRelays' gInfo && (isRosterRole memRole || isRosterRole fromRole) && senderRole /= GROwner =
+              messageError "x.grp.mem.role: only the owner can change moderator/admin roles in relay groups" $> Nothing
           | otherwise = do
               withStore' $ \db -> updateGroupMemberRole db user member memRole
               (gInfo'', m', scopeInfo) <- mkGroupChatScope gInfo' m