Privacy: Disable/Hide complete list of user

Description:

We'd like to host RC for our organization. However, there are privacy concerns regarding the feature that allows user to see the list of all user in the system and the possibility to DM them. We are able to hide the user list with the embedded-layout. However, when using the app, the user list feature is always enabled.

Steps to reproduce:

Persistent behavior

Expected behavior:

Switch to disable the complete user list in order to appease 'privacy fanatics'.

Suggested workaround / Request

The easiest solution that comes to my mind would be to alter the query that fills the list in such a way, that the server would only return an empty record. That would be a crude workaround but nevertheless it would work well in our scenario.

Could you please advise if such workaround would interfere with the rest of the application. And if not: could you please provide me insight, which api hook is used to query the complete user list, in order to alter the servers response to never return any user at all.

Actual behavior:

Currently, there is a list of all users signed up on the server. This can be hidden when using the embedded mode, however, it is always visible to users using the app.

Server Setup Information:

• Version of Rocket.Chat Server: 3.5.3
• Operating System: Ubuntu 20.04
• Deployment Method: snap
• Number of Running Instances: 1
• DB Replicaset Oplog: -
• NodeJS Version: 12.16.1
• MongoDB Version: 4.0

Client Setup Information

Any

Additional context

Relevant logs:

Best regards

The issue names no file, test, or entry point. Start by locating the app user-list entry point and the API hook that supplies the complete user list; done means a configurable switch can hide the complete list for app users without disrupting the rest of the application.