snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/imports/personal-access-tokens/server/api/methods/generateToken.ts

@@ -0,0 +1,73 @@
+import { Meteor } from 'meteor/meteor';
+import { Random } from '@rocket.chat/random';
+import { Accounts } from 'meteor/accounts-base';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Users } from '@rocket.chat/models';
+
+import { hasPermissionAsync } from '../../../../../server/lib/authorization/hasPermission';
+import { twoFactorRequired } from '../../../../../server/lib/2fa/twoFactorRequired';
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'personalAccessTokens:generateToken'(params: { tokenName: string; bypassTwoFactor: boolean }): Promise<string>;
+	}
+}
+
+export const generatePersonalAccessTokenOfUser = async ({
+	bypassTwoFactor,
+	tokenName,
+	userId,
+}: {
+	tokenName: string;
+	userId: string;
+	bypassTwoFactor: boolean;
+}): Promise<string> => {
+	if (!(await hasPermissionAsync(userId, 'create-personal-access-tokens'))) {
+		throw new Meteor.Error('not-authorized', 'Not Authorized', {
+			method: 'personalAccessTokens:generateToken',
+		});
+	}
+
+	const token = Random.secret();
+	const tokenExist = await Users.findPersonalAccessTokenByTokenNameAndUserId({
+		userId,
+		tokenName,
+	});
+	if (tokenExist) {
+		throw new Meteor.Error('error-token-already-exists', 'A token with this name already exists', {
+			method: 'personalAccessTokens:generateToken',
+		});
+	}
+
+	await Users.addPersonalAccessTokenToUser({
+		userId,
+		loginTokenObject: {
+			hashedToken: Accounts._hashLoginToken(token),
+			type: 'personalAccessToken',
+			createdAt: new Date(),
+			lastTokenPart: token.slice(-6),
+			name: tokenName,
+			bypassTwoFactor,
+		},
+	});
+	return token;
+};
+
+Meteor.methods<ServerMethods>({
+	'personalAccessTokens:generateToken': twoFactorRequired(async function ({
+		tokenName,
+		bypassTwoFactor,
+	}: {
+		tokenName: string;
+		bypassTwoFactor: boolean;
+	}) {
+		const uid = Meteor.userId();
+		if (!uid) {
+			throw new Meteor.Error('not-authorized', 'Not Authorized', {
+				method: 'personalAccessTokens:generateToken',
+			});
+		}
+
+		return generatePersonalAccessTokenOfUser({ tokenName, userId: uid, bypassTwoFactor });
+	}),
+});

apps/meteor/imports/personal-access-tokens/server/api/methods/index.ts

@@ -0,0 +1,3 @@
+import './generateToken';
+import './regenerateToken';
+import './removeToken';

apps/meteor/imports/personal-access-tokens/server/api/methods/regenerateToken.ts

@@ -0,0 +1,56 @@
+import { Meteor } from 'meteor/meteor';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Users } from '@rocket.chat/models';
+import { isPersonalAccessToken } from '@rocket.chat/core-typings';
+
+import { hasPermissionAsync } from '../../../../../server/lib/authorization/hasPermission';
+import { twoFactorRequired } from '../../../../../server/lib/2fa/twoFactorRequired';
+import { removePersonalAccessTokenOfUser } from './removeToken';
+import { generatePersonalAccessTokenOfUser } from './generateToken';
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'personalAccessTokens:regenerateToken'(params: { tokenName: string }): Promise<string>;
+	}
+}
+
+export const regeneratePersonalAccessTokenOfUser = async (tokenName: string, userId: string): Promise<string> => {
+	if (!(await hasPermissionAsync(userId, 'create-personal-access-tokens'))) {
+		throw new Meteor.Error('not-authorized', 'Not Authorized', {
+			method: 'personalAccessTokens:regenerateToken',
+		});
+	}
+
+	const tokenExist = await Users.findPersonalAccessTokenByTokenNameAndUserId({
+		userId,
+		tokenName,
+	});
+	if (!tokenExist) {
+		throw new Meteor.Error('error-token-does-not-exists', 'Token does not exist', {
+			method: 'personalAccessTokens:regenerateToken',
+		});
+	}
+
+	await removePersonalAccessTokenOfUser(tokenName, userId);
+
+	const tokenObject = tokenExist.services?.resume?.loginTokens?.find((token) => isPersonalAccessToken(token) && token.name === tokenName);
+
+	return generatePersonalAccessTokenOfUser({
+		tokenName,
+		userId,
+		bypassTwoFactor: (tokenObject && isPersonalAccessToken(tokenObject) && tokenObject.bypassTwoFactor) || false,
+	});
+};
+
+Meteor.methods<ServerMethods>({
+	'personalAccessTokens:regenerateToken': twoFactorRequired(async function ({ tokenName }: { tokenName: string }) {
+		const uid = Meteor.userId();
+		if (!uid) {
+			throw new Meteor.Error('not-authorized', 'Not Authorized', {
+				method: 'personalAccessTokens:regenerateToken',
+			});
+		}
+
+		return regeneratePersonalAccessTokenOfUser(tokenName, uid);
+	}),
+});

apps/meteor/imports/personal-access-tokens/server/api/methods/removeToken.ts

@@ -0,0 +1,49 @@
+import { Meteor } from 'meteor/meteor';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Users } from '@rocket.chat/models';
+
+import { hasPermissionAsync } from '../../../../../server/lib/authorization/hasPermission';
+import { twoFactorRequired } from '../../../../../server/lib/2fa/twoFactorRequired';
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'personalAccessTokens:removeToken'(params: { tokenName: string }): Promise<void>;
+	}
+}
+
+export const removePersonalAccessTokenOfUser = async (tokenName: string, userId: string): Promise<void> => {
+	if (!(await hasPermissionAsync(userId, 'create-personal-access-tokens'))) {
+		throw new Meteor.Error('not-authorized', 'Not Authorized', {
+			method: 'personalAccessTokens:removeToken',
+		});
+	}
+	const tokenExist = await Users.findPersonalAccessTokenByTokenNameAndUserId({
+		userId,
+		tokenName,
+	});
+	if (!tokenExist) {
+		throw new Meteor.Error('error-token-does-not-exists', 'Token does not exist', {
+			method: 'personalAccessTokens:removeToken',
+		});
+	}
+	await Users.removePersonalAccessTokenOfUser({
+		userId,
+		loginTokenObject: {
+			type: 'personalAccessToken',
+			name: tokenName,
+		},
+	});
+};
+
+Meteor.methods<ServerMethods>({
+	'personalAccessTokens:removeToken': twoFactorRequired(async function ({ tokenName }: { tokenName: string }) {
+		const uid = Meteor.userId();
+		if (!uid) {
+			throw new Meteor.Error('not-authorized', 'Not Authorized', {
+				method: 'personalAccessTokens:removeToken',
+			});
+		}
+
+		return removePersonalAccessTokenOfUser(tokenName, uid);
+	}),
+});