[pascalkienast]

☑️ Resolves

• Extracted from feat(call): add setting to limit starting calls to specific groups #18647 as discussed with @nickvergessen - the two error-handling fixes, separated from the feature so they can be tested individually and backported.

Both issues can occur when the host restricts who may start calls, for example when start_calls is set to “Moderators only”:

• Federation: The participant’s server determines the call button state using its own start_calls setting. It does not know the host’s setting. If the host is more restrictive, the federated participant still sees an active “Start call” button. The host then returns the correct 403, but the proxying server wraps it in a CannotReachRemoteException. The user sees what looks like a connection error instead of a permission error.
• Signaling/HPB: If the backend join path tries to mark the first participant as in-call when that participant is not allowed to start the call, Talk throws a ForbiddenException. The exception currently escapes instead of being returned as a structured backend error. SIP dial-in is one way to reach this path.

AI (if applicable)

• The content of this PR was partly or fully generated using AI

---

🛠️ API Checklist

🚧 Tasks

How to test

Federation fix:

1. On the host: set "Start calls" to "Moderators only" (Talk admin settings)
2. Invite a federated user (non-moderator) to a conversation, no active call
3. Federated user clicks "Start call"

• Before: generic connection/reach error (CannotReachRemoteException)
• After: proper 403 / permission feedback

Signaling fix:

1. Same restriction; trigger a call start via the signaling backend for a
   participant who may not start (e.g. SIP dial-in into a not-yet-started call)

• Before: uncaught ForbiddenException, unstructured error at the HPB
• After: structured start_call_not_allowed backend error

🏁 Checklist

• ⛑️ Tests (unit and/or integration) are included or not possible
• 📘 API documentation in docs/ has been updated or is not required
• 🔖 Capability not needed

Should be backportable to all supported stable branches; #18647 will be rebased on top once this is merged

[nickvergessen]

/backport to stable34

[nickvergessen]

/backport to stable33

[nickvergessen]

/backport to stable32

[nickvergessen]

Failure in tests/integration/features/federation/call.feature#L81 is expected until stable34 was patched

Failure in tests/integration/features/chat-4/scheduled-messages.feature#L581 was fixed with #18668

[github-actions]

Hello there,
Thank you so much for taking the time and effort to create a pull request to our Nextcloud project.

We hope that the review process is going smooth and is helpful for you. We want to ensure your pull request is reviewed to your satisfaction. If you have a moment, our community management team would very much appreciate your feedback on your experience with this PR review process.

Your feedback is valuable to us as we continuously strive to improve our community developer experience. Please take a moment to complete our short survey by clicking on the following link: https://cloud.nextcloud.com/apps/forms/s/i9Ago4EQRZ7TWxjfmeEpPkf6

Thank you for contributing to Nextcloud and we hope to hear from you soon!

(If you believe you should not receive this message, you can add yourself to the blocklist.)