Other users visibility with guest accounts / users.list call

Description:

When permission view-outside-room and viewing public channels is disabled you can find just the users you have in same private rooms with you in the normal RC UI. But when using REST API with the same credentials and running users.list call, it will return all the users from server. I think also in that case you should get only the users in your own rooms. To avoid users.list returning all users, you have to disable permission view-d-room. But then you don't have possibility to view or send direct messages.

So what is the point that users.list command is connected with view-d-room permission? I think it should rather be connected with view-outside-room permission some how. And also the user should have permission to start direct messaging with those who are in the same private channels with her/him if view-outside-room is disabled.

I'll suppose this should work like for example in Mattermost with external guest users:
https://mattermost.com/blog/mattermost-guest-accounts/: "Guests are classified as a specific type of user that has a specific set of permissions and restrictions for interacting with other users on your Mattermost server. They can’t find and join public or private channels without being invited, and they can’t launch direct messages or group chats with users other than ones that are members of channels they have access to."

We are almost there but guest can still start a discussion with anyone in the server if they know correct address eg. https://rcservername/direct/username and also they can see all users in the server with users.list call. It would be better that they could see only users in the same room in any cases or with any method. Else we have to disable a direct messaging possibility for guests.

Server Setup Information:

• Version of Rocket.Chat Server: 3.0.4
• Operating System: Centos
• Deployment Method: tar
• Number of Running Instances:
• DB Replicaset Oplog:
• NodeJS Version: v12.14.1
• MongoDB Version: 4.0.16

Start at the users.list REST endpoint and the permission checks for view-outside-room and view-d-room. Confirm how guest visibility and direct-message access should interact, then verify that users.list and direct-message entry points expose only users from accessible rooms.