snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/api/v1/middlewares/authentication.ts

@@ -0,0 +1,73 @@
+import { hashLoginToken } from '@rocket.chat/account-utils';
+import { Authorization } from '@rocket.chat/core-services';
+import { Users } from '@rocket.chat/models';
+import type { Request, Response, NextFunction } from 'express';
+
+import { oAuth2ServerAuth } from '../../../lib/auth/oauth2-server/oauth2-server';
+
+type AuthenticationMiddlewareConfig = {
+	rejectUnauthorized?: boolean;
+	cookies?: boolean;
+};
+
+export function authenticationMiddleware(
+	config: AuthenticationMiddlewareConfig = {
+		rejectUnauthorized: true,
+		cookies: false,
+	},
+) {
+	return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+		if (config.cookies) {
+			req.headers['x-auth-token'] = req.cookies.rc_token ?? req.headers['x-auth-token'];
+			req.headers['x-user-id'] = req.cookies.rc_uid ?? req.headers['x-user-id'];
+		}
+
+		const { 'x-user-id': userId, 'x-auth-token': authToken } = req.headers;
+
+		if (userId && authToken) {
+			const user = await Users.findOneByIdAndLoginToken(userId as string, hashLoginToken(authToken as string));
+			req.user = user || undefined;
+		} else {
+			const { authorization } = req.headers;
+			const accessToken = typeof req.query.access_token === 'string' ? req.query.access_token : undefined;
+			delete req.query.access_token;
+			req.user = await oAuth2ServerAuth({ authorization, accessToken });
+		}
+
+		if (config.rejectUnauthorized && !req.user) {
+			res.status(401).send('Unauthorized');
+			return;
+		}
+
+		req.userId = req?.user?._id;
+
+		next();
+	};
+}
+
+export function hasPermissionMiddleware(
+	permission: string,
+	{ rejectUnauthorized } = {
+		rejectUnauthorized: true,
+	},
+) {
+	return async (req: Request, res: Response, next: NextFunction): Promise<void> => {
+		if (!req.userId) {
+			if (rejectUnauthorized) {
+				res.status(401).send('Unauthorized');
+				return;
+			}
+			req.unauthorized = true;
+			return next();
+		}
+
+		if (!(await Authorization.hasPermission(req.userId, permission))) {
+			if (rejectUnauthorized) {
+				res.status(403).send('Forbidden');
+				return;
+			}
+			req.unauthorized = true;
+		}
+		next();
+	};
+}