Users that shouldn't be able to see DMs can

Description:

User is assigned a role that is marked as not being able to view Direct Messages (for testing I assigned a new role that had NOTHING in the permissions screen ticked, and this was set as that user only having that role). As another user with the ability to create and view DMs, I sent a DM to this user. As expected, I couldn't see the DM if I was logged i via Firefox, but if I logged into the android app, I could and was able to reply. I should also note that via Firefox, I was also able to reply, but not see anything that was sent back to the no DM user. For clarity, this is the workflow:

1. JoeBloggs is created as admin. He has all admin access, including being able to create and send Direct Messages.
2. JoeBloggs creates NoDM user and sets their only role as a new NoDM role that has nothing set within the permission screen
3. NoDM user logs into the workspace on android (tried on both the RocketChat and RocketChat experimental for good measure)
4. JoeBloggs sends a Direct Message to the NoDM user. Notification is seen by the NoDM user and they can open the DM channel and reply.

Environment Information:

• Rocket.Chat Server Version: 4.2.2 on snap 4.x/edge channel
• Rocket.Chat App Version: 4.22.0.27.17 & 4.23.0.27400
• Device Name: AndroidPhone
• OS Version: Android 10

Steps to reproduce:

1. JoeBloggs is created as admin. He has all admin access, including being able to create and send Direct Messages.
2. JoeBloggs creates NoDM user and sets their only role as a new NoDM role that has nothing set within the permission screen
3. NoDM user logs into the workspace on android (tried on both the RocketChat and RocketChat experimental for good measure)
4. JoeBloggs sends a Direct Message to the NoDM user. Notification is seen by the NoDM user and they can open the DM channel and reply.

Expected behavior:

Direct Messages are NOT viewable by the NoDM user and certainly they shouldn't be able to reply!

Actual behavior:

Direct Messages ARE viewable by the NoDM user and they CAN reply.

Additional context: