From de74787a48f8221750b36e5dfe114d076ca4e306 Mon Sep 17 00:00:00 2001
From: Bohdan Horbeshko <bodqhrohro@gmail.com>
Date: Thu, 26 Jun 2025 11:28:04 -0400
Subject: [PATCH] Setting both role and affiliation should yield bad-request

---
 xmpp/handlers.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/xmpp/handlers.go b/xmpp/handlers.go
index afb5027..d21c394 100644
--- a/xmpp/handlers.go
+++ b/xmpp/handlers.go
@@ -1813,6 +1813,11 @@ func handleSetQueryMucAdmin(s xmpp.Sender, iq *stanza.IQ, query *extensions.Quer
 
 		var status telegram.ChatMemberStatus
 
+		if item.Role != "" && item.Affiliation != "" {
+			iqAnswerSetError(answer, 400)
+			return
+		}
+
 		switch item.Role {
 		case "none":
 			status = telegram.ChatMemberStatusKicked
@@ -1823,7 +1828,6 @@ func handleSetQueryMucAdmin(s xmpp.Sender, iq *stanza.IQ, query *extensions.Quer
 		case "moderator":
 			status = telegram.ChatMemberStatusPromoted
 		}
-		// affiliations have a higher priority over roles
 		switch item.Affiliation {
 		case "none":
 			status = telegram.ChatMemberStatusKicked