User is able to delete own messages without appropriate permissions

Description:

When using the product as designed to restrict standard "user" role users from deleting messages, while still allowing "Admin" role users to delete messages, the product still allows standard "user" role users to delete messages inappropriately.

Steps to reproduce:

With these settings:
"Allow Message Deleting" = Enabled
"Block Message Deleting After (n) Minutes" = 0
"Delete Message" = Enabled for Admin role only
"delete-own-message" = Enabled for Admin role only

With these users:
"User1" = only role is user
"Admin1" = roles of Admin and user

Expected behavior:

User1 should not be able to delete any messages.
Admin1 should be able to delete any messages.

Actual behavior:

User1 can delete any message
Admin1 can delete any message

Server Setup Information:

• Version of Rocket.Chat Server: 3.12.1
• Operating System: Ubuntu 20.04.2
• Deployment Method: snap
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: 12.18.4
• MongoDB Version: 3.6.14

Client Setup Information

• Desktop App or Browser Version: Desktop (3.1.1), Browser (Chrome 89.0.4389.114)
• Operating System: Windows 10 (1909)

Additional context

I have not yet built another server to test if it is reproduceable across multiple installations, but I may do that later today.

Relevant logs:

No errors in View Logs, and not other output to mention.

No source file or test is named. Reproduce with “Allow Message Deleting” enabled, deletion blocked after 0 minutes, and both delete permissions enabled only for Admin; verify that a standard user cannot delete messages while an Admin can delete any message. Done means the reported permission behavior is corrected and covered by an appropriate regression test.