From f1fbcdda0e05846199d954e4f83a2f53785c2e45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=BAlia=20Jaeger=20Foresti?=
 <60678893+juliajforesti@users.noreply.github.com>
Date: Fri, 26 Sep 2025 16:30:01 -0300
Subject: [PATCH] fix: missing external users validation on members tab
 (#37071)

Co-authored-by: Douglas Fabris <devfabris@gmail.com>
---
 .changeset/two-owls-flow.md                    |  5 +++++
 .../RoomMembers/AddUsers/AddUsers.tsx          | 18 +++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/two-owls-flow.md

diff --git a/.changeset/two-owls-flow.md b/.changeset/two-owls-flow.md
new file mode 100644
index 00000000000..7313c108fdd
--- /dev/null
+++ b/.changeset/two-owls-flow.md
@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Prevents adding a external user to a non federated room through Members tab
diff --git a/apps/meteor/client/views/room/contextualBar/RoomMembers/AddUsers/AddUsers.tsx b/apps/meteor/client/views/room/contextualBar/RoomMembers/AddUsers/AddUsers.tsx
index 1168e0de5fb..e84966e7dc5 100644
--- a/apps/meteor/client/views/room/contextualBar/RoomMembers/AddUsers/AddUsers.tsx
+++ b/apps/meteor/client/views/room/contextualBar/RoomMembers/AddUsers/AddUsers.tsx
@@ -1,8 +1,9 @@
 import type { IRoom } from '@rocket.chat/core-typings';
 import { isRoomFederated, isRoomNativeFederated } from '@rocket.chat/core-typings';
-import { Field, FieldLabel, Button, ButtonGroup, FieldGroup } from '@rocket.chat/fuselage';
+import { Field, FieldError, FieldLabel, Button, ButtonGroup, FieldGroup } from '@rocket.chat/fuselage';
 import { useEffectEvent } from '@rocket.chat/fuselage-hooks';
 import { useToastMessageDispatch, useMethod } from '@rocket.chat/ui-contexts';
+import { useId } from 'react';
 import type { ReactElement } from 'react';
 import { Controller, useForm } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
@@ -22,6 +23,8 @@ import UserAutoCompleteMultipleFederated from '../../../../../components/UserAut
 import { useRoom } from '../../../contexts/RoomContext';
 import { useRoomToolbox } from '../../../contexts/RoomToolboxContext';
 
+const hasExternalUsers = (users: string[]): boolean => users.some((user) => user.startsWith('@'));
+
 type AddUsersProps = {
 	rid: IRoom['_id'];
 	onClickBack: () => void;
@@ -32,6 +35,7 @@ const AddUsers = ({ rid, onClickBack, reload }: AddUsersProps): ReactElement =>
 	const { t } = useTranslation();
 	const dispatchToastMessage = useToastMessageDispatch();
 	const room = useRoom();
+	const usersFieldId = useId();
 
 	const { closeTab } = useRoomToolbox();
 	const saveAction = useMethod('addUsersToRoom');
@@ -40,7 +44,7 @@ const AddUsers = ({ rid, onClickBack, reload }: AddUsersProps): ReactElement =>
 		handleSubmit,
 		control,
 		getValues,
-		formState: { isDirty, isSubmitting },
+		formState: { isDirty, isSubmitting, errors },
 	} = useForm({ defaultValues: { users: [] } });
 
 	const handleSave = useEffectEvent(async ({ users }: { users: string[] }) => {
@@ -83,9 +87,17 @@ const AddUsers = ({ rid, onClickBack, reload }: AddUsersProps): ReactElement =>
 							<Controller
 								name='users'
 								control={control}
-								render={({ field }) => <UserAutoCompleteMultiple {...field} placeholder={t('Choose_users')} />}
+								rules={{ validate: (users) => !hasExternalUsers(users) || t('You_cannot_add_external_users_to_non_federated_room') }}
+								render={({ field }) => (
+									<UserAutoCompleteMultiple {...field} placeholder={t('Choose_users')} aria-describedby={`${usersFieldId}-error`} />
+								)}
 							/>
 						)}
+						{errors.users && (
+							<FieldError role='alert' id={`${usersFieldId}-error`}>
+								{errors.users.message}
+							</FieldError>
+						)}
 					</Field>
 				</FieldGroup>
 			</ContextualbarScrollableContent>