Permissions & access control
Three layers decide what a user can do: OS permissions (camera, microphone…), workspace settings from GET /settings/effective (feature gates and limits set by the client admin), and group roles (owner, admins, members, per-group permissions). The package applies all three the same way as the web package; the backend enforces them again.
OS permissions
iOS can't show a permission prompt from the lock screen. Accepting a CallKit call on a phone that never granted camera / microphone rejects the call (permission_denied) — ask for both during onboarding or on the first call.
Feature gates (effective settings)
Denied controls generally stay visible but disabled and explain why on tap.
import {useAdminFeatureGate, useEffectiveSettings} from '@realtimexsco/live-chat-react-native'; const gate = useAdminFeatureGate('videoCall'); // { visible, enabled, disabledReason }const {settings, refresh, getGate, isGroupPermissionLocked} = useEffectiveSettings();Pure helpers: getFeatureGate(settings, key), getCallGate(settings, mode), getCallsPlatformGate, getCallRecordingGate, getWhiteboardGate, isGroupPermissionLocked, and the messages ADMIN_PERMISSION_DENIED_MESSAGE, CALLS_NOT_CONFIGURED_MESSAGE, CALLS_NOT_ALLOWED_BY_PLATFORM_MESSAGE.
Workspace limits
When the backend refuses an action (GROUP_LIMIT_REACHED, PIN_LIMIT_REACHED, ATTACHMENT_TYPE_NOT_ALLOWED, MESSAGE_RATE_LIMITED, …) the package shows the server's message as is and, for a refused send, removes the optimistic message and keeps the text in the composer.
Group roles and group permissions
Group permission keys and package defaults (DEFAULT_GROUP_PERMISSIONS): onlyAdminCanSendMessage: false, onlyAdminCanEditInfo: false, senderCanEditMessage: true, allowMemberAdd: true, allowMemberRemove: false, moderationEnabled: false.
Resolution order: package defaults → workspace groupPolicy.defaults → the group's own values → keys in groupPolicy.locked always use the workspace default (locked toggles show a lock and can't be changed). The same resolved values are sent when a group is created or its permissions are saved.