snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/ee/server/configuration/abac.ts

@@ -0,0 +1,67 @@
+import { Abac, LDAPEnterprise } from '@rocket.chat/core-services';
+import { cronJobs } from '@rocket.chat/cron';
+import { License } from '@rocket.chat/license';
+import { Users } from '@rocket.chat/models';
+import { isValidCron } from 'cron-validator';
+import { Meteor } from 'meteor/meteor';
+
+import { settings } from '../../../server/settings';
+
+const VIRTRU_PDP_SYNC_JOB = 'ABAC_Virtru_PDP_Sync';
+
+Meteor.startup(async () => {
+	let stopWatcher: () => void;
+	let stopCronWatcher: () => void;
+
+	License.onToggledFeature('abac', {
+		up: async () => {
+			const { addSettings } = await import('../settings/abac');
+			const { createPermissions } = await import('../lib/abac');
+
+			await addSettings();
+			await createPermissions();
+
+			await import('../hooks/abac');
+
+			stopWatcher = settings.watch('ABAC_Enabled', async (value) => {
+				if (value && settings.get<string>('ABAC_PDP_Type') !== 'virtru') {
+					await LDAPEnterprise.syncUsersAbacAttributes(Users.findLDAPUsers());
+				}
+			});
+
+			async function configureVirtruPdpSync(): Promise<void> {
+				if (await cronJobs.has(VIRTRU_PDP_SYNC_JOB)) {
+					await cronJobs.remove(VIRTRU_PDP_SYNC_JOB);
+				}
+
+				const abacEnabled = settings.get('ABAC_Enabled');
+				const pdpType = settings.get<string>('ABAC_PDP_Type');
+
+				if (!abacEnabled || pdpType !== 'virtru') {
+					return;
+				}
+
+				const cronValue = settings.get<string>('ABAC_Virtru_Sync_Interval');
+
+				if (!cronValue || !isValidCron(cronValue)) {
+					return;
+				}
+
+				await cronJobs.add(VIRTRU_PDP_SYNC_JOB, cronValue, () => Abac.evaluateRoomMembership());
+			}
+
+			stopCronWatcher = settings.watchMultiple(
+				['ABAC_Enabled', 'ABAC_PDP_Type', 'ABAC_Virtru_Sync_Interval'],
+				() => void configureVirtruPdpSync(),
+			);
+		},
+		down: async () => {
+			stopWatcher?.();
+			stopCronWatcher?.();
+
+			if (await cronJobs.has(VIRTRU_PDP_SYNC_JOB)) {
+				await cronJobs.remove(VIRTRU_PDP_SYNC_JOB);
+			}
+		},
+	});
+});

apps/meteor/ee/server/configuration/contact-verification.ts

@@ -0,0 +1,7 @@
+import { Meteor } from 'meteor/meteor';
+
+import { addSettings } from '../settings/contact-verification';
+
+Meteor.startup(async () => {
+	await addSettings();
+});

apps/meteor/ee/server/configuration/index.ts

@@ -0,0 +1,8 @@
+import './contact-verification';
+import './ldap';
+import './oauth';
+import './outlookCalendar';
+import './saml';
+import './videoConference';
+import './voip';
+import './abac';

apps/meteor/ee/server/configuration/ldap.ts

@@ -0,0 +1,127 @@
+import { LDAPEnterprise } from '@rocket.chat/core-services';
+import type { IImportUser, ILDAPEntry, IUser } from '@rocket.chat/core-typings';
+import { cronJobs } from '@rocket.chat/cron';
+import { License } from '@rocket.chat/license';
+import { Settings } from '@rocket.chat/models';
+import { isValidCron } from 'cron-validator';
+import { Meteor } from 'meteor/meteor';
+
+import { callbacks } from '../../../server/lib/callbacks';
+import type { LDAPConnection } from '../../../server/lib/ldap/Connection';
+import { logger } from '../../../server/lib/ldap/Logger';
+import { settings } from '../../../server/settings';
+import { LDAPEEManager } from '../lib/ldap/Manager';
+import { addSettings, ldapIntervalValuesToCronMap } from '../settings/ldap';
+
+Meteor.startup(async () => {
+	await License.onLicense('ldap-enterprise', async () => {
+		await addSettings();
+
+		// Configure background sync cronjob
+		function configureBackgroundSync(jobName: string, enableSetting: string, intervalSetting: string, cb: () => void): () => Promise<void> {
+			let lastSchedule: string;
+			return async function addCronJobDebounced(): Promise<void> {
+				if (settings.get('LDAP_Enable') !== true || settings.get(enableSetting) !== true) {
+					if (await cronJobs.has(jobName)) {
+						logger.info({ msg: 'Disabling LDAP Background Sync', jobName });
+						await cronJobs.remove(jobName);
+					}
+					return;
+				}
+
+				const settingValue = settings.get<string>(intervalSetting);
+				const schedule =
+					ldapIntervalValuesToCronMap[settingValue] ??
+					(isValidCron(settingValue) ? settingValue : ((await Settings.findOneById(intervalSetting))?.packageValue as string));
+				if (schedule) {
+					if (schedule !== lastSchedule && (await cronJobs.has(jobName))) {
+						await cronJobs.remove(jobName);
+					}
+
+					lastSchedule = schedule;
+					logger.info({ msg: 'Enabling LDAP Background Sync', jobName });
+
+					await cronJobs.add(jobName, schedule, cb);
+				}
+			};
+		}
+
+		const addCronJob = configureBackgroundSync('LDAP_Sync', 'LDAP_Background_Sync', 'LDAP_Background_Sync_Interval', () =>
+			LDAPEnterprise.sync(),
+		);
+		const addAvatarCronJob = configureBackgroundSync(
+			'LDAP_AvatarSync',
+			'LDAP_Background_Sync_Avatars',
+			'LDAP_Background_Sync_Avatars_Interval',
+			() => LDAPEnterprise.syncAvatars(),
+		);
+		const addLogoutCronJob = configureBackgroundSync(
+			'LDAP_AutoLogout',
+			'LDAP_Sync_AutoLogout_Enabled',
+			'LDAP_Sync_AutoLogout_Interval',
+			() => LDAPEnterprise.syncLogout(),
+		);
+
+		const addAbacCronJob = configureBackgroundSync(
+			'LDAP_AbacSync',
+			'LDAP_Background_Sync_ABAC_Attributes',
+			'LDAP_Background_Sync_ABAC_Attributes_Interval',
+			() => LDAPEnterprise.syncAbacAttributes(),
+		);
+
+		settings.watchMultiple(['LDAP_Background_Sync', 'LDAP_Background_Sync_Interval'], addCronJob);
+		settings.watchMultiple(['LDAP_Background_Sync_Avatars', 'LDAP_Background_Sync_Avatars_Interval'], addAvatarCronJob);
+		settings.watchMultiple(['LDAP_Sync_AutoLogout_Enabled', 'LDAP_Sync_AutoLogout_Interval'], addLogoutCronJob);
+		settings.watchMultiple(['LDAP_Background_Sync_ABAC_Attributes', 'LDAP_Background_Sync_ABAC_Attributes_Interval'], addAbacCronJob);
+
+		settings.watch('LDAP_Enable', async () => {
+			await addCronJob();
+			await addAvatarCronJob();
+			await addLogoutCronJob();
+			await addAbacCronJob();
+		});
+
+		settings.watch<string>('LDAP_Groups_To_Rocket_Chat_Teams', (value) => {
+			try {
+				LDAPEEManager.validateLDAPTeamsMappingChanges(value);
+			} catch (err) {
+				logger.error({ err });
+			}
+		});
+
+		settings.watch<string>('LDAP_ABAC_AttributeMap', (value) => {
+			try {
+				LDAPEEManager.validateLDAPABACAttributeMap(value);
+			} catch (err) {
+				logger.error({ err });
+			}
+		});
+
+		callbacks.add(
+			'mapLDAPUserData',
+			(userData: IImportUser, ldapUser?: ILDAPEntry) => {
+				if (!ldapUser) {
+					return;
+				}
+
+				LDAPEEManager.copyCustomFields(ldapUser, userData);
+				LDAPEEManager.copyActiveState(ldapUser, userData);
+			},
+			callbacks.priority.MEDIUM,
+			'mapLDAPCustomFields',
+		);
+
+		callbacks.add(
+			'onLDAPLogin',
+			async ({ user, ldapUser, isNewUser }: { user: IUser; ldapUser: ILDAPEntry; isNewUser: boolean }, ldap?: LDAPConnection) => {
+				if (!ldap) {
+					return;
+				}
+
+				await LDAPEEManager.advancedSyncForUser(ldap, user, isNewUser, ldapUser.dn);
+			},
+			callbacks.priority.MEDIUM,
+			'advancedLDAPSync',
+		);
+	});
+});

apps/meteor/ee/server/configuration/oauth.ts

@@ -0,0 +1,99 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
+import { Logger } from '@rocket.chat/logger';
+import { Roles } from '@rocket.chat/models';
+import { capitalize } from '@rocket.chat/tools';
+
+import { callbacks } from '../../../server/lib/callbacks';
+import { settings } from '../../../server/settings';
+import { OAuthEEManager } from '../lib/oauth/Manager';
+import { syncUserRoles } from '../lib/syncUserRoles';
+
+interface IOAuthUserService {
+	serviceName: string;
+	serviceData: Record<string, any>;
+	user: IUser;
+}
+
+interface IOAuthUserIdentity {
+	serviceName: string;
+	identity: Record<string, any>;
+	user: IUser;
+}
+
+interface IOAuthSettings {
+	mapChannels: boolean;
+	mergeRoles: boolean;
+	rolesToSync: string;
+	rolesClaim: string;
+	groupsClaim: string;
+	channelsAdmin: string;
+	channelsMap: string;
+}
+
+const logger = new Logger('EECustomOAuth');
+
+function getOAuthSettings(serviceName: string): IOAuthSettings {
+	return {
+		mapChannels: settings.get<boolean>(`Accounts_OAuth_Custom-${serviceName}-map_channels`),
+		mergeRoles: settings.get<boolean>(`Accounts_OAuth_Custom-${serviceName}-merge_roles`),
+		rolesToSync: settings.get<string>(`Accounts_OAuth_Custom-${serviceName}-roles_to_sync`),
+		rolesClaim: settings.get<string>(`Accounts_OAuth_Custom-${serviceName}-roles_claim`),
+		groupsClaim: settings.get<string>(`Accounts_OAuth_Custom-${serviceName}-groups_claim`),
+		channelsAdmin: settings.get<string>(`Accounts_OAuth_Custom-${serviceName}-channels_admin`),
+		channelsMap: settings.get<string>(`Accounts_OAuth_Custom-${serviceName}-groups_channel_map`),
+	};
+}
+
+function getChannelsMap(channelsMap: string): Record<string, any> | undefined {
+	channelsMap = (channelsMap || '{}').trim();
+
+	try {
+		return JSON.parse(channelsMap);
+	} catch (err) {
+		logger.error({ msg: 'Unexpected error', err });
+	}
+}
+
+await License.onLicense('oauth-enterprise', () => {
+	callbacks.add('afterProcessOAuthUser', async (auth: IOAuthUserService) => {
+		auth.serviceName = capitalize(auth.serviceName);
+		const settings = getOAuthSettings(auth.serviceName);
+
+		if (settings.mapChannels) {
+			const channelsMap = getChannelsMap(settings.channelsMap);
+			await OAuthEEManager.mapSSOGroupsToChannels(auth.user, auth.serviceData, settings.groupsClaim, channelsMap, settings.channelsAdmin);
+		}
+
+		if (settings.mergeRoles) {
+			await OAuthEEManager.updateRolesFromSSO(
+				auth.user,
+				auth.serviceData,
+				settings.rolesClaim,
+				settings.rolesToSync.split(',').map((role) => role.trim()),
+			);
+		}
+	});
+
+	callbacks.add('afterValidateNewOAuthUser', async (auth: IOAuthUserIdentity) => {
+		auth.serviceName = capitalize(auth.serviceName);
+		const settings = getOAuthSettings(auth.serviceName);
+
+		if (settings.mapChannels) {
+			const channelsMap = getChannelsMap(settings.channelsMap);
+			await OAuthEEManager.mapSSOGroupsToChannels(auth.user, auth.identity, settings.groupsClaim, channelsMap, settings.channelsAdmin);
+		}
+
+		if (settings.mergeRoles) {
+			const rolesFromSSO = await OAuthEEManager.mapRolesFromSSO(auth.identity, settings.rolesClaim);
+			const mappedRoles = (await Roles.findInIdsOrNames(rolesFromSSO).toArray()).map((role) => role._id);
+			const rolesToSync = settings.rolesToSync.split(',').map((role) => role.trim());
+
+			const allowedRoles = (await Roles.findInIdsOrNames(rolesToSync).toArray()).map((role) => role._id);
+
+			await syncUserRoles(auth.user._id, mappedRoles, {
+				allowedRoles,
+			});
+		}
+	});
+});

apps/meteor/ee/server/configuration/outlookCalendar.ts

@@ -0,0 +1,14 @@
+import { Calendar } from '@rocket.chat/core-services';
+import { License } from '@rocket.chat/license';
+import { Meteor } from 'meteor/meteor';
+
+import { addSettings } from '../settings/outlookCalendar';
+
+Meteor.startup(() =>
+	License.onLicense('outlook-calendar', async () => {
+		addSettings();
+
+		await Calendar.setupNextNotification();
+		await Calendar.setupNextStatusChange();
+	}),
+);

apps/meteor/ee/server/configuration/saml.ts

@@ -0,0 +1,73 @@
+import { License } from '@rocket.chat/license';
+import { Roles, Users } from '@rocket.chat/models';
+
+import { ensureArray } from '../../../lib/utils/arrayUtils';
+import type { ISAMLUser } from '../../../server/lib/saml/definition/ISAMLUser';
+import { SAMLUtils } from '../../../server/lib/saml/lib/Utils';
+import { settings } from '../../../server/settings';
+import { addSettings } from '../settings/saml';
+
+await License.onLicense('saml-enterprise', () => {
+	SAMLUtils.events.on('mapUser', async ({ profile, userObject }: { profile: Record<string, any>; userObject: ISAMLUser }) => {
+		const roleAttributeName = settings.get('SAML_Custom_Default_role_attribute_name') as string;
+		const roleAttributeSync = settings.get('SAML_Custom_Default_role_attribute_sync');
+
+		if (!roleAttributeSync) {
+			return;
+		}
+
+		if (roleAttributeName && profile[roleAttributeName]) {
+			let value = profile[roleAttributeName] || '';
+			if (typeof value === 'string') {
+				value = value.split(',');
+			}
+
+			const savedRoles = await Roles.findInIdsOrNames(ensureArray<string>(value)).toArray();
+
+			userObject.roles = savedRoles.map((role) => role._id);
+		}
+	});
+
+	SAMLUtils.events.on('loadConfigs', (service: string, configs: Record<string, any>): void => {
+		// Include ee settings on the configs object so that they can be copied to the login service too
+		const rawCustomAuthnContext = settings.get(`${service}_custom_authn_context`);
+		const customAuthnContext = typeof rawCustomAuthnContext === 'string' ? rawCustomAuthnContext.trim() : undefined;
+
+		Object.assign(configs, {
+			...(customAuthnContext !== undefined && { customAuthnContext }),
+			authnContextComparison: settings.get(`${service}_authn_context_comparison`),
+			identifierFormat: settings.get(`${service}_identifier_format`),
+			nameIDPolicyTemplate: settings.get(`${service}_NameId_template`),
+			authnContextTemplate: settings.get(`${service}_AuthnContext_template`),
+			authRequestTemplate: settings.get(`${service}_AuthRequest_template`),
+			logoutResponseTemplate: settings.get(`${service}_LogoutResponse_template`),
+			logoutRequestTemplate: settings.get(`${service}_LogoutRequest_template`),
+			metadataCertificateTemplate: settings.get(`${service}_MetadataCertificate_template`),
+			metadataTemplate: settings.get(`${service}_Metadata_template`),
+		});
+	});
+
+	SAMLUtils.events.on('updateCustomFields', async (loginResult: Record<string, any>, updatedUser: { userId: string; token: string }) => {
+		const userDataCustomFieldMap = settings.get('SAML_Custom_Default_user_data_custom_fieldmap') as string;
+		const customMap: Record<string, any> = JSON.parse(userDataCustomFieldMap);
+
+		const customFieldsList: Record<string, any> = {};
+
+		for (const spCustomFieldName in customMap) {
+			if (!customMap.hasOwnProperty(spCustomFieldName)) {
+				continue;
+			}
+
+			const customAttribute = customMap[spCustomFieldName];
+			const value = SAMLUtils.getProfileValue(loginResult.profile, {
+				fieldName: spCustomFieldName,
+			});
+			customFieldsList[customAttribute] = value;
+		}
+
+		await Users.updateCustomFieldsById(updatedUser.userId, customFieldsList);
+	});
+});
+
+// For setting creation we add the listener first because the event is emmited during startup
+SAMLUtils.events.on('addSettings', (name: string): void | Promise<void> => License.onLicense('saml-enterprise', () => addSettings(name)));

apps/meteor/ee/server/configuration/videoConference.ts

@@ -0,0 +1,52 @@
+import { VideoConf } from '@rocket.chat/core-services';
+import type { IRoom, IUser, VideoConference } from '@rocket.chat/core-typings';
+import { VideoConferenceStatus } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
+import { Rooms, Subscriptions } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { callbacks } from '../../../server/lib/callbacks';
+import { videoConfTypes } from '../../../server/lib/videoConfTypes';
+import { addSettings } from '../settings/video-conference';
+
+Meteor.startup(async () => {
+	await License.onLicense('videoconference-enterprise', async () => {
+		await addSettings();
+
+		videoConfTypes.registerVideoConferenceType(
+			{ type: 'direct', status: VideoConferenceStatus.CALLING },
+			async ({ _id, t }, allowRinging) => {
+				if (!allowRinging || t !== 'd') {
+					return false;
+				}
+
+				const room = await Rooms.findOneById<Pick<IRoom, 'uids'>>(_id, { projection: { uids: 1 } });
+
+				return Boolean(room && (!room.uids || room.uids.length === 2));
+			},
+		);
+
+		videoConfTypes.registerVideoConferenceType({ type: 'videoconference', ringing: true }, async ({ _id, t }, allowRinging) => {
+			if (!allowRinging || t === 'l') {
+				return false;
+			}
+
+			if (t === 'd') {
+				const room = await Rooms.findOneById<Pick<IRoom, 'uids'>>(_id, { projection: { uids: 1 } });
+				if (room && (!room.uids || room.uids.length <= 2)) {
+					return false;
+				}
+			}
+
+			if ((await Subscriptions.countByRoomId(_id)) > 10) {
+				return false;
+			}
+
+			return true;
+		});
+
+		callbacks.add('onJoinVideoConference', async (callId: VideoConference['_id'], userId?: IUser['_id']) =>
+			VideoConf.addUser(callId, userId),
+		);
+	});
+});

apps/meteor/ee/server/configuration/voip.ts

@@ -0,0 +1,10 @@
+import { MediaCall } from '@rocket.chat/core-services';
+import { License } from '@rocket.chat/license';
+
+import { addSettings } from '../settings/voip';
+
+License.onValidateLicense(async () => {
+	await addSettings();
+
+	await MediaCall.hangupExpiredCalls();
+});