snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/api/api.helpers.ts

@@ -0,0 +1,118 @@
+import type { IUser } from '@rocket.chat/core-typings';
+
+import type { ActionThis } from './definition';
+import { hasAllPermissionAsync, hasAtLeastOnePermissionAsync } from '../lib/authorization/hasPermission';
+import type { DeprecationLoggerNextPlannedVersion } from '../lib/deprecationWarningLogger';
+import { apiDeprecationLogger } from '../lib/deprecationWarningLogger';
+
+type RequestMethod = 'GET' | 'POST' | 'PUT' | 'DELETE' | '*';
+export type PermissionsPayload = {
+	[key in RequestMethod]?: {
+		operation: 'hasAll' | 'hasAny';
+		permissions: string[];
+	};
+};
+
+type PermissionsPayloadLight = {
+	[key in RequestMethod]?: string[];
+};
+
+type PermissionsRequiredKey = string[] | PermissionsPayload | PermissionsPayloadLight;
+
+const isLegacyPermissionsPayload = (permissionsPayload: PermissionsRequiredKey): permissionsPayload is string[] => {
+	return Array.isArray(permissionsPayload);
+};
+
+const isLightPermissionsPayload = (permissionsPayload: PermissionsRequiredKey): permissionsPayload is PermissionsPayloadLight => {
+	return (
+		typeof permissionsPayload === 'object' &&
+		Object.keys(permissionsPayload).some((key) => ['GET', 'POST', 'PUT', 'DELETE', '*'].includes(key.toUpperCase())) &&
+		Object.values(permissionsPayload).every((value) => Array.isArray(value))
+	);
+};
+
+const isPermissionsPayload = (permissionsPayload: PermissionsRequiredKey): permissionsPayload is PermissionsPayload => {
+	return (
+		typeof permissionsPayload === 'object' &&
+		Object.keys(permissionsPayload).some((key) => ['GET', 'POST', 'PUT', 'DELETE', '*'].includes(key.toUpperCase())) &&
+		Object.values(permissionsPayload).every((value) => typeof value === 'object' && value.operation && value.permissions)
+	);
+};
+
+export async function canBypassRateLimit(userId: IUser['_id'], bypassPermissions: string[] = []): Promise<boolean> {
+	return hasAtLeastOnePermissionAsync(userId, ['api-bypass-rate-limit', ...bypassPermissions]);
+}
+
+export async function checkPermissionsForInvocation(
+	userId: IUser['_id'],
+	permissionsPayload: PermissionsPayload,
+	requestMethod: RequestMethod,
+): Promise<boolean> {
+	const permissions = permissionsPayload[requestMethod] || permissionsPayload['*'];
+
+	if (!permissions) {
+		// how we reached here in the first place?
+		return false;
+	}
+
+	if (permissions.permissions.length === 0) {
+		// You can pass an empty array of permissions to allow access to the method
+		return true;
+	}
+
+	if (permissions.operation === 'hasAll') {
+		return hasAllPermissionAsync(userId, permissions.permissions);
+	}
+
+	if (permissions.operation === 'hasAny') {
+		return hasAtLeastOnePermissionAsync(userId, permissions.permissions);
+	}
+
+	return false;
+}
+
+// We'll assume options only contains permissionsRequired, as we don't care of the other elements
+export function checkPermissions(options: { permissionsRequired?: PermissionsRequiredKey }) {
+	if (!options.permissionsRequired) {
+		return false;
+	}
+
+	if (isPermissionsPayload(options.permissionsRequired)) {
+		// No modifications needed
+		return true;
+	}
+
+	if (isLegacyPermissionsPayload(options.permissionsRequired)) {
+		options.permissionsRequired = {
+			'*': {
+				operation: 'hasAll',
+				permissions: options.permissionsRequired,
+			},
+		};
+		return true;
+	}
+
+	if (isLightPermissionsPayload(options.permissionsRequired)) {
+		Object.keys(options.permissionsRequired).forEach((method) => {
+			const methodKey = method as RequestMethod;
+			// @ts-expect-error -- we know the type of the value but ts refuses to infer it
+			options.permissionsRequired[methodKey] = {
+				operation: 'hasAll',
+				// @ts-expect-error -- we know the type of the value but ts refuses to infer it
+				permissions: options.permissionsRequired[methodKey],
+			};
+		});
+		return true;
+	}
+
+	// If reached here, options.permissionsRequired contained an invalid payload
+	return false;
+}
+
+export function parseDeprecation(
+	methodThis: ActionThis<any, any, any>,
+	{ alternatives, version }: { version: DeprecationLoggerNextPlannedVersion; alternatives?: string[] },
+): void {
+	const infoMessage = alternatives?.length ? ` Please use the alternative(s): ${alternatives.join(',')}` : '';
+	apiDeprecationLogger.endpoint(methodThis.route, version, methodThis.response, infoMessage);
+}