snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/ee/server/hooks/abac/beforeAddUserToRoom.ts

@@ -0,0 +1,22 @@
+import { Abac } from '@rocket.chat/core-services';
+import { License } from '@rocket.chat/license';
+
+import { beforeAddUserToRoom } from '../../../../server/hooks/rooms/beforeAddUserToRoom';
+import { settings } from '../../../../server/settings';
+
+beforeAddUserToRoom.patch(async (prev, users, room, actor) => {
+	await prev(users, room, actor);
+
+	const validUsers = users.filter(Boolean);
+	// No need to check ABAC when theres no users or when room is not private or when room is not ABAC managed
+	if (!validUsers.length || room.t !== 'p' || !room?.abacAttributes?.length) {
+		return;
+	}
+
+	// Throw error (prevent add) if ABAC is disabled (setting, license) but room is ABAC managed
+	if (!settings.get('ABAC_Enabled') || !License.hasModule('abac')) {
+		throw new Error('error-room-is-abac-managed');
+	}
+
+	await Abac.checkUsernamesMatchAttributes(validUsers as string[], room.abacAttributes, room);
+});

apps/meteor/ee/server/hooks/abac/index.ts

@@ -0,0 +1,2 @@
+import './beforeAddUserToRoom';
+import './scopeAdminRoomsForAbac';

apps/meteor/ee/server/hooks/abac/scopeAdminRoomsForAbac.ts

@@ -0,0 +1,30 @@
+import { Abac } from '@rocket.chat/core-services';
+import type { IRoom, IRoomAbacRedaction } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
+import { Users } from '@rocket.chat/models';
+
+import { scopeAdminRoomsForAbac } from '../../../../server/api/lib/scopeAdminRoomsForAbac';
+import { isABACManagedRoom } from '../../../../server/lib/authorization/isABACManagedRoom';
+
+const redact = <T extends Pick<IRoom, 't' | 'abacAttributes'>>(rooms: T[]): Array<T & IRoomAbacRedaction> =>
+	rooms.map((room) => (isABACManagedRoom(room) ? { ...room, abacAttributes: [], abacAttributesRedacted: true } : room));
+
+scopeAdminRoomsForAbac.patch(async (next, rooms, uid) => {
+	const managed = License.hasModule('abac') ? rooms.filter(isABACManagedRoom) : [];
+	if (!managed.length) {
+		return next(rooms, uid);
+	}
+
+	try {
+		const user = await Users.findOneById(uid, { projection: { _id: 1, username: 1, name: 1 } });
+		if (!user) {
+			return redact(rooms);
+		}
+
+		const scoped = await Abac.scopeRoomsForAdmin(managed, user);
+		const scopedById = new Map(scoped.map((room) => [room._id, room]));
+		return rooms.map((room) => scopedById.get(room._id) ?? room);
+	} catch (err) {
+		return redact(rooms);
+	}
+});