User can send message to a channel without joining it

Description:

If we sign in through RC API, we get rc_uid and rc_token, and with the help of them, we can send a message. The thing is, when a user is authenticated, he/she can even message in channels in which they've not even joined.

Steps to reproduce:

1. Login a user with the help of this API Endp
2. Send a message to a channel in which you aren't even a part of yet using this API endp
3. The message will be sent successfully.

Expected behavior:

User must be a part of that channel to send the message.

Actual behavior:

The message is sent successfully.

Server Setup Information:

• Version of Rocket.Chat Server: 4.6.4
• Operating System: Ubuntu 20.04
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog: Enabled
• NodeJS Version: 14.18.3 - x64
• MongoDB Version:4.4.15

Client Setup Information

• Desktop App or Browser Version: Brave
• Operating System: Ubuntu 20.04

Additional context

Relevant logs:

Reproduce the behavior using the authentication API endpoint to obtain credentials, then call the chat send-message API endpoint for a channel the user has not joined. Trace the authorization checks for that request and verify that an unjoined user cannot send a message while permitted channel members still can.