snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/lib/e2e/beforeCreateRoom.ts

@@ -0,0 +1,23 @@
+import { MeteorError } from '@rocket.chat/core-services';
+
+import { settings } from '../../settings';
+import { prepareCreateRoomCallback } from '../callbacks/beforeCreateRoomCallback';
+
+prepareCreateRoomCallback.add(({ type, extraData }) => {
+	if (!settings.get<boolean>('E2E_Enable')) {
+		return;
+	}
+
+	if (
+		(type === 'd' && settings.get<boolean>('E2E_Enabled_Default_DirectRooms')) ||
+		(type === 'p' && settings.get<boolean>('E2E_Enabled_Default_PrivateRooms'))
+	) {
+		extraData.encrypted = extraData.encrypted ?? true;
+	}
+	if (type === 'p' && extraData.federated !== true && settings.get<boolean>('E2E_Force_Encryption_For_Private_Rooms')) {
+		if (extraData.encrypted === false) {
+			throw new MeteorError('error-encrypted-private-rooms-enforced', 'Workspace policy requires all private rooms to be encrypted.');
+		}
+		extraData.encrypted = true;
+	}
+});

apps/meteor/server/lib/e2e/functions/handleSuggestedGroupKey.ts

@@ -0,0 +1,48 @@
+import { Rooms, Subscriptions } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { notifyOnSubscriptionChangedById, notifyOnRoomChangedById } from '../../notifyListener';
+
+export async function handleSuggestedGroupKey(
+	handle: 'accept' | 'reject',
+	rid: string,
+	userId: string | null,
+	method: string,
+): Promise<void> {
+	if (!userId) {
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', { method });
+	}
+
+	const sub = await Subscriptions.findOneByRoomIdAndUserId(rid, userId);
+	if (!sub) {
+		throw new Meteor.Error('error-subscription-not-found', 'Subscription not found', { method });
+	}
+
+	const suggestedKey = String(sub.E2ESuggestedKey ?? '').trim();
+	if (!suggestedKey) {
+		throw new Meteor.Error('error-no-suggested-key-available', 'No suggested key available', { method });
+	}
+
+	if (handle === 'accept') {
+		// A merging process can happen here, but we're not doing that for now
+		// If a user already has oldRoomKeys, we will ignore the suggested ones
+		const oldKeys = sub.oldRoomKeys ? undefined : sub.suggestedOldRoomKeys;
+		await Subscriptions.setGroupE2EKeyAndOldRoomKeys(sub._id, suggestedKey, oldKeys);
+		const { modifiedCount } = await Rooms.removeUsersFromE2EEQueueByRoomId(sub.rid, [userId]);
+		if (modifiedCount) {
+			void notifyOnRoomChangedById(sub.rid);
+		}
+	}
+
+	if (handle === 'reject') {
+		const { modifiedCount } = await Rooms.addUserIdToE2EEQueueByRoomIds([sub.rid], userId);
+		if (modifiedCount) {
+			void notifyOnRoomChangedById(sub.rid);
+		}
+	}
+
+	const { modifiedCount } = await Subscriptions.unsetGroupE2ESuggestedKeyAndOldRoomKeys(sub._id);
+	if (modifiedCount) {
+		void notifyOnSubscriptionChangedById(sub._id);
+	}
+}

apps/meteor/server/lib/e2e/functions/provideUsersSuggestedGroupKeys.ts

@@ -0,0 +1,44 @@
+import type { IRoom, IUser, ISubscription } from '@rocket.chat/core-typings';
+import { Rooms, Subscriptions } from '@rocket.chat/models';
+
+import { canAccessRoomIdAsync } from '../../authorization/canAccessRoom';
+import { notifyOnSubscriptionChanged, notifyOnRoomChangedById } from '../../notifyListener';
+
+export const provideUsersSuggestedGroupKeys = async (
+	userId: IUser['_id'],
+	usersSuggestedGroupKeys: Record<IRoom['_id'], { _id: IUser['_id']; key: string; oldKeys?: ISubscription['oldRoomKeys'] }[]>,
+) => {
+	const roomIds = Object.keys(usersSuggestedGroupKeys);
+
+	if (!roomIds.length) {
+		return;
+	}
+
+	// Process should try to process all rooms i have access instead of dying if one is not
+	for (const roomId of roomIds) {
+		if (!(await canAccessRoomIdAsync(roomId, userId))) {
+			continue;
+		}
+
+		const usersWithSuggestedKeys = [];
+		for (const user of usersSuggestedGroupKeys[roomId]) {
+			const value = await Subscriptions.setGroupE2ESuggestedKeyAndOldRoomKeys(user._id, roomId, user.key, parseOldKeysDates(user.oldKeys));
+			if (!value) {
+				continue;
+			}
+			void notifyOnSubscriptionChanged(value);
+			usersWithSuggestedKeys.push(user._id);
+		}
+
+		await Rooms.removeUsersFromE2EEQueueByRoomId(roomId, usersWithSuggestedKeys);
+		void notifyOnRoomChangedById(roomId);
+	}
+};
+
+const parseOldKeysDates = (oldKeys: ISubscription['oldRoomKeys']) => {
+	if (!oldKeys) {
+		return;
+	}
+
+	return oldKeys.map((key) => ({ ...key, ts: new Date(key.ts) }));
+};

apps/meteor/server/lib/e2e/functions/resetRoomKey.ts

@@ -0,0 +1,123 @@
+import type { ISubscription, IUser, IRoom } from '@rocket.chat/core-typings';
+import { Rooms, Subscriptions, Users } from '@rocket.chat/models';
+import type { AnyBulkWriteOperation } from 'mongodb';
+
+import { notifyOnRoomChanged, notifyOnSubscriptionChanged } from '../../notifyListener';
+
+export async function resetRoomKey(roomId: string, userId: string, newRoomKey: string, newRoomKeyId: string) {
+	const user = await Users.findOneById<Pick<IUser, 'e2e'>>(userId, { projection: { e2e: 1 } });
+	if (!user) {
+		throw new Error('error-user-not-found');
+	}
+
+	if (!user.e2e?.private_key || !user.e2e?.public_key) {
+		throw new Error('error-user-has-no-keys');
+	}
+
+	const room = await Rooms.findOneById<Pick<IRoom, 'e2eKeyId'>>(roomId, { projection: { e2eKeyId: 1 } });
+	if (!room) {
+		throw new Error('error-room-not-found');
+	}
+
+	if (!room.e2eKeyId) {
+		throw new Error('error-room-not-encrypted');
+	}
+
+	// We will update the subs of everyone who has a key for the room. For the ones that don't have, we will do nothing
+	const notifySubs = [];
+	const updateOps: AnyBulkWriteOperation<ISubscription>[] = [];
+	const e2eQueue: IRoom['usersWaitingForE2EKeys'] = [];
+
+	for await (const sub of Subscriptions.find({
+		rid: roomId,
+		$or: [{ E2EKey: { $exists: true } }, { E2ESuggestedKey: { $exists: true } }],
+	})) {
+		// This replicates the oldRoomKeys array modifications allowing us to have the changes locally without finding them again
+		// which allows for quicker notifying
+		const keys = replicateMongoSlice(room.e2eKeyId, sub);
+		delete sub.E2ESuggestedKey;
+		delete sub.E2EKey;
+		delete sub.suggestedOldRoomKeys;
+
+		const updateSet = {
+			$set: {
+				...(keys && { oldRoomKeys: keys }),
+			},
+		};
+		updateOps.push({
+			updateOne: {
+				filter: { _id: sub._id },
+				update: {
+					$unset: { E2EKey: 1, E2ESuggestedKey: 1, suggestedOldRoomKeys: 1 },
+					...(Object.keys(updateSet.$set).length && updateSet),
+				},
+			},
+		});
+
+		if (userId !== sub.u._id) {
+			// Avoid notifying requesting user as notify will happen at the end
+			notifySubs.push({
+				...sub,
+				...(keys && { oldRoomKeys: keys }),
+			});
+
+			// This is for allowing the key distribution process to start inmediately
+			pushToLimit(e2eQueue, { userId: sub.u._id, ts: new Date() });
+		}
+
+		if (updateOps.length >= 100) {
+			await writeAndNotify(updateOps, notifySubs);
+		}
+	}
+
+	if (updateOps.length > 0) {
+		await writeAndNotify(updateOps, notifySubs);
+	}
+
+	// after the old keys have been moved to the new prop, store room key on room + the e2e queue so key can be exchanged
+	// todo move to model method
+	const roomResult = await Rooms.resetRoomKeyAndSetE2EEQueueByRoomId(roomId, newRoomKeyId, e2eQueue);
+	// And set the new key to the user that called the func
+	const result = await Subscriptions.setE2EKeyByUserIdAndRoomId(userId, roomId, newRoomKey);
+
+	if (result) {
+		void notifyOnSubscriptionChanged(result);
+	}
+	if (roomResult) {
+		void notifyOnRoomChanged(roomResult);
+	}
+}
+
+export function pushToLimit(
+	arr: NonNullable<IRoom['usersWaitingForE2EKeys']>,
+	item: NonNullable<IRoom['usersWaitingForE2EKeys']>[number],
+	limit = 50,
+) {
+	if (arr.length < limit) {
+		arr.push(item);
+	}
+}
+
+async function writeAndNotify(updateOps: AnyBulkWriteOperation<ISubscription>[], notifySubs: ISubscription[]) {
+	await Subscriptions.col.bulkWrite([...updateOps]);
+	notifySubs.forEach((sub) => {
+		void notifyOnSubscriptionChanged(sub);
+	});
+	notifySubs.length = 0;
+	updateOps.length = 0;
+}
+
+export function replicateMongoSlice(keyId: string, sub: ISubscription) {
+	if (!sub.E2EKey) {
+		return;
+	}
+
+	if (!sub.oldRoomKeys) {
+		return [{ e2eKeyId: keyId, ts: new Date(), E2EKey: sub.E2EKey }];
+	}
+
+	const sortedKeys = sub.oldRoomKeys.toSorted((a, b) => b.ts.getTime() - a.ts.getTime());
+	sortedKeys.unshift({ e2eKeyId: keyId, ts: new Date(), E2EKey: sub.E2EKey });
+
+	return sortedKeys.slice(0, 10);
+}

apps/meteor/server/lib/e2e/index.ts

@@ -0,0 +1,14 @@
+import { api } from '@rocket.chat/core-services';
+
+import { callbacks } from '../callbacks';
+
+import './beforeCreateRoom';
+
+callbacks.add(
+	'afterJoinRoom',
+	(_user, room) => {
+		void api.broadcast('notify.e2e.keyRequest', room._id, room.e2eKeyId);
+	},
+	callbacks.priority.MEDIUM,
+	'e2e',
+);