authz publications security

packages/rocketchat-authorization/server/publications/roles.coffee

@@ -2,6 +2,7 @@ Meteor.publish 'roles', ->
 	unless @userId
 		return @ready()
 
-	# @TODO validate permission
+	if not RocketChat.authz.hasPermission @userId, 'access-rocket-permissions'
+		throw new Meteor.Error "not-authorized"
 
 	return RocketChat.authz.getRoles()

packages/rocketchat-authorization/server/publications/usersInRole.coffee

@@ -2,6 +2,7 @@ Meteor.publish 'usersInRole', (roleName) ->
 	unless @userId
 		return @ready()
 
-	# @TODO validate permission
+	if not RocketChat.authz.hasPermission @userId, 'access-rocket-permissions'
+		throw new Meteor.Error "not-authorized"
 
 	return RocketChat.authz.getUsersInRole roleName