snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/cloud/getWorkspaceAccessToken.ts

@@ -0,0 +1,122 @@
+import type { IWorkspaceCredentials } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
+import { WorkspaceCredentials } from '@rocket.chat/models';
+
+import { getWorkspaceAccessTokenWithScope } from './getWorkspaceAccessTokenWithScope';
+import { workspaceScopes } from './oauthScopes';
+import { retrieveRegistrationStatus } from './retrieveRegistrationStatus';
+import { SystemLogger } from '../logger/system';
+
+const hasWorkspaceAccessTokenExpired = (credentials: IWorkspaceCredentials): boolean => new Date() >= credentials.expirationDate;
+
+/**
+ * Returns the access token for the workspace, if it is expired or forceNew is true, it will get a new one
+ * and save it to the database, therefore if this function does not throw an error, it will always return a valid token.
+ *
+ * @param {boolean} forceNew - If true, it will get a new token even if the current one is not expired
+ * @param {string} scope - The scope of the token to get
+ * @param {boolean} save - If true, it will save the new token to the database
+ * @throws {CloudWorkspaceAccessTokenError} If the workspace is not registered (no credentials in the database)
+ *
+ * @returns string - A valid access token for the workspace
+ */
+export async function getWorkspaceAccessToken(forceNew = false, scope = '', save = true, throwOnError = false): Promise<string> {
+	const { workspaceRegistered } = await retrieveRegistrationStatus();
+
+	if (!workspaceRegistered) {
+		return '';
+	}
+
+	if (License.hasOfflineLicense()) {
+		return '';
+	}
+
+	// Note: If no scope is given, it means we should assume the default scope, we store the default scopes
+	//       in the global variable workspaceScopes.
+	if (scope === '') {
+		scope = workspaceScopes.join(' ');
+	}
+
+	const workspaceCredentials = await WorkspaceCredentials.getCredentialByScope(scope);
+	if (workspaceCredentials && !hasWorkspaceAccessTokenExpired(workspaceCredentials) && !forceNew) {
+		SystemLogger.debug({
+			msg: 'Workspace credentials cache hit. Avoiding generating a new access token from cloud services.',
+			scope,
+		});
+		return workspaceCredentials.accessToken;
+	}
+
+	SystemLogger.debug({
+		msg: 'Workspace credentials cache miss, fetching new access token from cloud services.',
+		scope,
+	});
+
+	const accessToken = await getWorkspaceAccessTokenWithScope({ scope, throwOnError });
+
+	if (save) {
+		await WorkspaceCredentials.updateCredentialByScope({
+			scope: accessToken.scope,
+			accessToken: accessToken.token,
+			expirationDate: accessToken.expiresAt,
+		});
+	}
+
+	return accessToken.token;
+}
+
+export class CloudWorkspaceAccessTokenError extends Error {
+	constructor() {
+		super('Could not get workspace access token');
+	}
+}
+
+export const isAbortError = (error: unknown): error is { type: 'AbortError' } => {
+	if (typeof error !== 'object' || error === null) {
+		return false;
+	}
+
+	return 'type' in error && error.type === 'AbortError';
+};
+
+export class CloudWorkspaceAccessTokenEmptyError extends Error {
+	constructor() {
+		super('Workspace access token is empty');
+	}
+}
+
+export async function getWorkspaceAccessTokenOrThrow(forceNew = false, scope = '', save = true): Promise<string> {
+	const token = await getWorkspaceAccessToken(forceNew, scope, save, true);
+
+	if (!token) {
+		throw new CloudWorkspaceAccessTokenEmptyError();
+	}
+
+	return token;
+}
+
+export const generateWorkspaceBearerHttpHeaderOrThrow = async (
+	forceNew = false,
+	scope = '',
+	save = true,
+): Promise<{ Authorization: string }> => {
+	const token = await getWorkspaceAccessTokenOrThrow(forceNew, scope, save);
+	return {
+		Authorization: `Bearer ${token}`,
+	};
+};
+
+export const generateWorkspaceBearerHttpHeader = async (
+	forceNew = false,
+	scope = '',
+	save = true,
+): Promise<{ Authorization: string } | undefined> => {
+	const token = await getWorkspaceAccessToken(forceNew, scope, save);
+
+	if (!token) {
+		return undefined;
+	}
+
+	return {
+		Authorization: `Bearer ${token}`,
+	};
+};