fix: group moderation and profile sync

server/store/store.go

@@ -2628,15 +2628,22 @@ func (groupBusinessMapper) TransferOwner(tenantID types.TenantID, topic string,
 	return nil
 }
 
-func (groupBusinessMapper) CanPost(tenantID types.TenantID, topic string, uid types.Uid, admin bool, now time.Time) (bool, error) {
+func (groupBusinessMapper) CanPost(tenantID types.TenantID, topic string, uid types.Uid, _ bool, now time.Time) (bool, error) {
 	if strings.TrimSpace(topic) == "" || uid.IsZero() || now.IsZero() {
 		return false, types.ErrMalformed
 	}
-	if admin {
-		return true, nil
-	}
 	topic = strings.TrimSpace(topic)
 	mapper := groupBusinessMapper{}
+	member, err := mapper.GetMember(tenantID, topic, uid)
+	if errors.Is(err, types.ErrNotFound) {
+		return false, nil
+	}
+	if err != nil {
+		return false, err
+	}
+	if allowed, checkMute := groupMemberPostRole(member); !checkMute {
+		return allowed, nil
+	}
 	settings, err := mapper.GetSettings(tenantID, topic)
 	if err != nil && !errors.Is(err, types.ErrNotFound) {
 		return false, err
@@ -2655,6 +2662,21 @@ func (groupBusinessMapper) CanPost(tenantID types.TenantID, topic string, uid ty
 		(mute.ExpiresAt != nil && !mute.ExpiresAt.After(now)), nil
 }
 
+func groupMemberPostRole(member *types.GroupMember) (allowed, checkMute bool) {
+	if member == nil || member.MemberStatus != types.GroupMemberStatusActive {
+		return false, false
+	}
+	// The loaded Topic access snapshot can lag behind a role change.
+	switch member.Role {
+	case types.GroupMemberRoleOwner, types.GroupMemberRoleAdmin:
+		return true, false
+	case types.GroupMemberRoleMember:
+		return false, true
+	default:
+		return false, false
+	}
+}
+
 type groupMuteCacheValue struct {
 	Found bool             `json:"found"`
 	Mute  *types.GroupMute `json:"mute,omitempty"`