snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/auth/oauth2-server/addOAuthApp.ts

@@ -0,0 +1,69 @@
+import type { IOAuthApps, IUser } from '@rocket.chat/core-typings';
+import { OAuthApps, Users } from '@rocket.chat/models';
+import { Random } from '@rocket.chat/random';
+import { Meteor } from 'meteor/meteor';
+
+import { parseUriList } from './parseUriList';
+import type { OauthAppsAddParams } from '../../../api/v1/oauthapps';
+import { hasPermissionAsync } from '../../authorization/hasPermission';
+
+export async function addOAuthApp(applicationParams: OauthAppsAddParams, uid: IUser['_id'] | undefined): Promise<IOAuthApps> {
+	if (!uid) {
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'addOAuthApp' });
+	}
+
+	const user = await Users.findOneById(uid, { projection: { username: 1 } });
+
+	if (!user?.username) {
+		// TODO: username is required, but not always present
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'addOAuthApp' });
+	}
+
+	if (!(await hasPermissionAsync(uid, 'manage-oauth-apps'))) {
+		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'addOAuthApp' });
+	}
+
+	if (!applicationParams.name || typeof applicationParams.name.valueOf() !== 'string' || applicationParams.name.trim() === '') {
+		throw new Meteor.Error('error-invalid-name', 'Invalid name', { method: 'addOAuthApp' });
+	}
+
+	if (
+		!applicationParams.redirectUri ||
+		typeof applicationParams.redirectUri.valueOf() !== 'string' ||
+		applicationParams.redirectUri.trim() === ''
+	) {
+		throw new Meteor.Error('error-invalid-redirectUri', 'Invalid redirectUri', {
+			method: 'addOAuthApp',
+		});
+	}
+
+	if (typeof applicationParams.active !== 'boolean') {
+		throw new Meteor.Error('error-invalid-arguments', 'Invalid arguments', {
+			method: 'addOAuthApp',
+		});
+	}
+
+	const application = {
+		...applicationParams,
+		redirectUri: parseUriList(applicationParams.redirectUri),
+		clientId: Random.id(),
+		clientSecret: Random.secret(),
+		_createdAt: new Date(),
+		_updatedAt: new Date(),
+		_createdBy: {
+			_id: user._id,
+			username: user.username,
+		},
+	};
+
+	if (application.redirectUri.length === 0) {
+		throw new Meteor.Error('error-invalid-redirectUri', 'Invalid redirectUri', {
+			method: 'addOAuthApp',
+		});
+	}
+
+	return {
+		...application,
+		_id: (await OAuthApps.insertOne(application)).insertedId,
+	};
+}

apps/meteor/server/lib/auth/oauth2-server/index.ts

@@ -0,0 +1,4 @@
+import './oauth2-server';
+import './addOAuthApp';
+import '../../../meteor-methods/auth/updateOAuthApp';
+import '../../../meteor-methods/auth/deleteOAuthApp';

apps/meteor/server/lib/auth/oauth2-server/oauth2-server.ts

@@ -0,0 +1,85 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { OAuthAccessTokens, Users } from '@rocket.chat/models';
+import type { Request, Response } from 'express';
+import type express from 'express';
+import { Meteor } from 'meteor/meteor';
+import { WebApp } from 'meteor/webapp';
+
+import { isPlainObject } from '../../../../lib/utils/isPlainObject';
+import { API } from '../../../api';
+import { OAuth2Server } from '../../../oauth2-server/oauth';
+
+const oauth2server = new OAuth2Server({
+	// If you're developing something related to oauth servers, you should change this to true
+	debug: false,
+});
+
+// https://github.com/RocketChat/rocketchat-oauth2-server/blob/e758fd7ef69348c7ceceabe241747a986c32d036/model.coffee#L27-L27
+async function getAccessToken(accessToken: string) {
+	return OAuthAccessTokens.findOneByAccessToken(accessToken);
+}
+
+export async function oAuth2ServerAuth(partialRequest: { authorization?: string; accessToken?: string }): Promise<IUser | undefined> {
+	const headerToken = partialRequest.authorization?.replace('Bearer ', '');
+	const incomingToken = headerToken || partialRequest.accessToken;
+
+	if (!incomingToken) {
+		return;
+	}
+
+	const accessToken = await getAccessToken(incomingToken);
+
+	// If there is no token available or the token has expired, return undefined
+	if (!accessToken || (accessToken.expires != null && accessToken.expires < new Date())) {
+		return;
+	}
+
+	const user = await Users.findOneActiveById(accessToken.userId);
+
+	if (!user) {
+		return;
+	}
+
+	return user;
+}
+
+oauth2server.app.disable('x-powered-by');
+
+oauth2server.app.get('/oauth/userinfo', async (req: Request, res: Response) => {
+	if (req.headers.authorization == null) {
+		return res.status(401).send('No token');
+	}
+	const accessToken = req.headers.authorization.replace('Bearer ', '');
+	const token = await getAccessToken(accessToken);
+	if (token == null) {
+		return res.status(401).send('Invalid Token');
+	}
+	const user = await Users.findOneActiveById(token.userId);
+	if (!user) {
+		return res.status(401).send('Invalid Token');
+	}
+	return res.send({
+		sub: user._id,
+		name: user.name,
+		email: user.emails?.[0].address,
+		email_verified: user.emails?.[0].verified,
+		department: '',
+		birthdate: '',
+		preffered_username: user.username,
+		updated_at: user._updatedAt,
+		picture: `${Meteor.absoluteUrl()}avatar/${user.username}`,
+	});
+});
+
+API.v1.addAuthMethod((routeContext) => {
+	const authorization = routeContext.request.headers.get('authorization') ?? undefined;
+	const query = isPlainObject(routeContext.queryParams) ? routeContext.queryParams : {};
+	const accessToken = typeof query.access_token === 'string' ? query.access_token : undefined;
+	if (routeContext.queryParams && 'access_token' in routeContext.queryParams) {
+		delete routeContext.queryParams.access_token;
+	}
+
+	return oAuth2ServerAuth({ authorization, accessToken });
+});
+
+(WebApp.connectHandlers as unknown as ReturnType<typeof express>).use(oauth2server.app);

apps/meteor/server/lib/auth/oauth2-server/parseUriList.ts

@@ -0,0 +1,17 @@
+export const parseUriList = (userUri: string) => {
+	if (userUri.indexOf('\n') < 0 && userUri.indexOf(',') < 0) {
+		return userUri;
+	}
+
+	const uriList: string[] = [];
+	userUri.split(/[,\n]/).forEach((item) => {
+		const uri = item.trim();
+		if (uri === '') {
+			return;
+		}
+
+		uriList.push(uri);
+	});
+
+	return uriList.join(','); // TODO: This is a hack because the original code was returning a string or an array of strings
+};