snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/meteor-methods/integrations/incoming/addIncomingIntegration.ts

@@ -0,0 +1,197 @@
+import type { INewIncomingIntegration, IIncomingIntegration } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Integrations, Subscriptions, Users, Rooms } from '@rocket.chat/models';
+import { Random } from '@rocket.chat/random';
+import { removeEmpty } from '@rocket.chat/tools';
+import { Match, check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+
+import { hasPermissionAsync, hasAllPermissionAsync } from '../../../lib/authorization/hasPermission';
+import { methodDeprecationLogger } from '../../../lib/deprecationWarningLogger';
+import { compileIntegrationScript } from '../../../lib/integrations/lib/compileIntegrationScript';
+import { validateScriptEngine, isScriptEngineFrozen } from '../../../lib/integrations/lib/validateScriptEngine';
+import { notifyOnIntegrationChanged } from '../../../lib/notifyListener';
+
+const validChannelChars = ['@', '#'];
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		addIncomingIntegration(integration: INewIncomingIntegration): Promise<IIncomingIntegration>;
+	}
+}
+
+export const addIncomingIntegration = async (userId: string, integration: INewIncomingIntegration): Promise<IIncomingIntegration> => {
+	check(
+		integration,
+		Match.ObjectIncluding({
+			type: String,
+			name: String,
+			enabled: Boolean,
+			username: String,
+			channel: String,
+			alias: Match.Maybe(String),
+			emoji: Match.Maybe(String),
+			scriptEnabled: Boolean,
+			scriptEngine: Match.Maybe(String),
+			overrideDestinationChannelEnabled: Match.Maybe(Boolean),
+			script: Match.Maybe(String),
+			avatar: Match.Maybe(String),
+		}),
+	);
+
+	if (
+		!userId ||
+		(!(await hasPermissionAsync(userId, 'manage-incoming-integrations')) &&
+			!(await hasPermissionAsync(userId, 'manage-own-incoming-integrations')))
+	) {
+		throw new Meteor.Error('not_authorized', 'Unauthorized', {
+			method: 'addIncomingIntegration',
+		});
+	}
+
+	if (!integration.channel || typeof integration.channel.valueOf() !== 'string') {
+		throw new Meteor.Error('error-invalid-channel', 'Invalid channel', {
+			method: 'addIncomingIntegration',
+		});
+	}
+
+	if (integration.channel.trim() === '') {
+		throw new Meteor.Error('error-invalid-channel', 'Invalid channel', {
+			method: 'addIncomingIntegration',
+		});
+	}
+
+	const channels = integration.channel.split(',').map((channel) => channel.trim());
+
+	for (const channel of channels) {
+		if (!validChannelChars.includes(channel[0])) {
+			throw new Meteor.Error('error-invalid-channel-start-with-chars', 'Invalid channel. Start with @ or #', {
+				method: 'updateIncomingIntegration',
+			});
+		}
+	}
+
+	if (!integration.username || typeof integration.username.valueOf() !== 'string' || integration.username.trim() === '') {
+		throw new Meteor.Error('error-invalid-username', 'Invalid username', {
+			method: 'addIncomingIntegration',
+		});
+	}
+
+	if (integration.script?.trim()) {
+		validateScriptEngine(integration.scriptEngine ?? 'isolated-vm');
+	}
+
+	const user = await Users.findOneByUsername(integration.username, { projection: { _id: 1 } });
+
+	if (!user) {
+		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+			method: 'addIncomingIntegration',
+		});
+	}
+
+	if (!(await hasPermissionAsync(user._id, 'message-impersonate'))) {
+		throw new Meteor.Error(
+			'error-user-lacks-message-impersonate-permission',
+			"User selected for the incoming integration lacks the 'message-impersonate' permission.",
+			{
+				method: 'addIncomingIntegration',
+			},
+		);
+	}
+
+	// Default to transpiling with Babel for backwards compatibility; integrations
+	// can opt-out per-record by setting `skipTranspile: true` (removed in 9.0.0).
+	const skipTranspile = integration.skipTranspile === true;
+
+	const integrationData: IIncomingIntegration = {
+		...integration,
+		scriptEngine: integration.scriptEngine ?? 'isolated-vm',
+		skipTranspile,
+		type: 'webhook-incoming',
+		channel: channels,
+		overrideDestinationChannelEnabled: integration.overrideDestinationChannelEnabled ?? false,
+		token: Random.id(48),
+		userId: user._id,
+		_createdAt: new Date(),
+		_createdBy: await Users.findOne({ _id: userId }, { projection: { username: 1 } }),
+	};
+
+	if (
+		!isScriptEngineFrozen(integrationData.scriptEngine) &&
+		integration.scriptEnabled === true &&
+		integration.script &&
+		integration.script.trim() !== ''
+	) {
+		const { script, error } = compileIntegrationScript(integration.script, { transpile: !skipTranspile });
+		if (error) {
+			integrationData.scriptCompiled = undefined;
+			integrationData.scriptError = error;
+		} else {
+			integrationData.scriptCompiled = script;
+			delete integrationData.scriptError;
+		}
+	}
+
+	for (let channel of channels) {
+		let record;
+		const channelType = channel[0];
+		channel = channel.substr(1);
+
+		switch (channelType) {
+			case '#':
+				record = await Rooms.findOne({
+					$or: [{ _id: channel }, { name: channel }],
+				});
+				break;
+			case '@':
+				record = await Users.findOne({
+					$or: [{ _id: channel }, { username: channel }],
+				});
+				break;
+		}
+
+		if (!record) {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
+				method: 'addIncomingIntegration',
+			});
+		}
+
+		if (
+			!(await hasAllPermissionAsync(userId, ['manage-incoming-integrations', 'manage-own-incoming-integrations'])) &&
+			!(await Subscriptions.findOneByRoomIdAndUserId(record._id, userId, { projection: { _id: 1 } }))
+		) {
+			throw new Meteor.Error('error-invalid-channel', 'Invalid Channel', {
+				method: 'addIncomingIntegration',
+			});
+		}
+	}
+
+	const strippedIntegrationData = removeEmpty(integrationData);
+
+	const { insertedId } = await Integrations.insertOne(strippedIntegrationData);
+
+	const integrationStored = await Integrations.findOne({ _id: insertedId });
+
+	if (!integrationStored) {
+		throw new Error('Error inserting integration');
+	}
+	void notifyOnIntegrationChanged({ ...integrationStored, _id: insertedId }, 'inserted');
+
+	return integrationStored as IIncomingIntegration;
+};
+
+Meteor.methods<ServerMethods>({
+	async addIncomingIntegration(integration: INewIncomingIntegration): Promise<IIncomingIntegration> {
+		methodDeprecationLogger.method('addIncomingIntegration', '9.0.0', '/v1/integrations.create');
+		const { userId } = this;
+
+		if (!userId) {
+			throw new Meteor.Error('invalid-user', 'Invalid User', {
+				method: 'addIncomingIntegration',
+			});
+		}
+
+		return addIncomingIntegration(userId, integration);
+	},
+});

apps/meteor/server/meteor-methods/integrations/incoming/deleteIncomingIntegration.ts

@@ -0,0 +1,55 @@
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Integrations } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { hasPermissionAsync } from '../../../lib/authorization/hasPermission';
+import { methodDeprecationLogger } from '../../../lib/deprecationWarningLogger';
+import { notifyOnIntegrationChanged } from '../../../lib/notifyListener';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		deleteIncomingIntegration(integrationId: string): Promise<boolean>;
+	}
+}
+
+export const deleteIncomingIntegration = async (integrationId: string, userId: string): Promise<void> => {
+	const canManageAllIntegrations = !!userId && (await hasPermissionAsync(userId, 'manage-incoming-integrations'));
+	const canManageOwnIntegrations =
+		!canManageAllIntegrations && !!userId && (await hasPermissionAsync(userId, 'manage-own-incoming-integrations'));
+
+	if (!canManageAllIntegrations && !canManageOwnIntegrations) {
+		throw new Meteor.Error('not_authorized', 'Unauthorized', {
+			method: 'deleteIncomingIntegration',
+		});
+	}
+
+	const integration = await Integrations.removeByIdAndCreatedByIfExists({
+		_id: integrationId,
+		...(canManageOwnIntegrations && { createdBy: userId }),
+	});
+
+	if (!integration) {
+		throw new Meteor.Error('error-invalid-integration', 'Invalid integration', {
+			method: 'deleteIncomingIntegration',
+		});
+	}
+
+	void notifyOnIntegrationChanged(integration, 'removed');
+};
+
+Meteor.methods<ServerMethods>({
+	async deleteIncomingIntegration(integrationId) {
+		methodDeprecationLogger.method('deleteIncomingIntegration', '9.0.0', '/v1/integrations.remove');
+		const userId = Meteor.userId();
+		if (!userId) {
+			throw new Meteor.Error('not_authorized', 'Unauthorized', {
+				method: 'deleteIncomingIntegration',
+			});
+		}
+
+		await deleteIncomingIntegration(integrationId, userId);
+
+		return true;
+	},
+});

apps/meteor/server/meteor-methods/integrations/incoming/updateIncomingIntegration.ts

@@ -0,0 +1,211 @@
+import type { IIntegration, INewIncomingIntegration, IUpdateIncomingIntegration } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Integrations, Subscriptions, Users, Rooms } from '@rocket.chat/models';
+import { wrapExceptions } from '@rocket.chat/tools';
+import { Meteor } from 'meteor/meteor';
+
+import { hasAllPermissionAsync, hasPermissionAsync } from '../../../lib/authorization/hasPermission';
+import { methodDeprecationLogger } from '../../../lib/deprecationWarningLogger';
+import { compileIntegrationScript } from '../../../lib/integrations/lib/compileIntegrationScript';
+import { isScriptEngineFrozen, validateScriptEngine } from '../../../lib/integrations/lib/validateScriptEngine';
+import { notifyOnIntegrationChanged } from '../../../lib/notifyListener';
+
+const validChannelChars = ['@', '#'];
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		updateIncomingIntegration(
+			integrationId: string,
+			integration: INewIncomingIntegration | IUpdateIncomingIntegration,
+		): IIntegration | null;
+	}
+}
+
+function validateChannels(channelString: string | undefined): string[] {
+	if (!channelString || typeof channelString.valueOf() !== 'string' || channelString.trim() === '') {
+		throw new Meteor.Error('error-invalid-channel', 'Invalid channel', {
+			method: 'updateIncomingIntegration',
+		});
+	}
+
+	const channels = channelString.split(',').map((channel) => channel.trim());
+
+	for (const channel of channels) {
+		if (!validChannelChars.includes(channel[0])) {
+			throw new Meteor.Error('error-invalid-channel-start-with-chars', 'Invalid channel. Start with @ or #', {
+				method: 'updateIncomingIntegration',
+			});
+		}
+	}
+
+	return channels;
+}
+
+export const updateIncomingIntegration = async (
+	userId: string,
+	integrationId: string,
+	integration: INewIncomingIntegration | IUpdateIncomingIntegration,
+): Promise<IIntegration | null> => {
+	const channels = validateChannels(integration.channel);
+
+	let currentIntegration;
+
+	if (await hasPermissionAsync(userId, 'manage-incoming-integrations')) {
+		currentIntegration = await Integrations.findOneById(integrationId);
+	} else if (await hasPermissionAsync(userId, 'manage-own-incoming-integrations')) {
+		currentIntegration = await Integrations.findOne({
+			'_id': integrationId,
+			'_createdBy._id': userId,
+		});
+	} else {
+		throw new Meteor.Error('not_authorized', 'Unauthorized', {
+			method: 'updateIncomingIntegration',
+		});
+	}
+
+	if (!currentIntegration) {
+		throw new Meteor.Error('error-invalid-integration', 'Invalid integration', {
+			method: 'updateIncomingIntegration',
+		});
+	}
+
+	const oldScriptEngine = currentIntegration.scriptEngine;
+	const scriptEngine = integration.scriptEngine ?? oldScriptEngine ?? 'isolated-vm';
+	if (
+		integration.script?.trim() &&
+		(scriptEngine !== oldScriptEngine || integration.script?.trim() !== currentIntegration.script?.trim())
+	) {
+		wrapExceptions(() => validateScriptEngine(scriptEngine)).catch((e) => {
+			throw new Meteor.Error(e.message);
+		});
+	}
+
+	const isFrozen = isScriptEngineFrozen(scriptEngine);
+
+	// Default to transpiling with Babel for backwards compatibility; integrations
+	// can opt-out per-record by setting `skipTranspile: true` (removed in 9.0.0).
+	const skipTranspile = integration.skipTranspile === true;
+
+	if (!isFrozen && integration.scriptEnabled === true && integration.script && integration.script.trim() !== '') {
+		const { script, error } = compileIntegrationScript(integration.script, { transpile: !skipTranspile });
+		if (error) {
+			await Integrations.updateOne(
+				{ _id: integrationId },
+				{
+					$set: { scriptError: error, skipTranspile },
+					$unset: { scriptCompiled: 1 as const },
+				},
+			);
+		} else {
+			await Integrations.updateOne(
+				{ _id: integrationId },
+				{
+					$set: { scriptCompiled: script, skipTranspile },
+					$unset: { scriptError: 1 as const },
+				},
+			);
+		}
+	}
+
+	for (let channel of channels) {
+		const channelType = channel[0];
+		channel = channel.slice(1);
+		let record;
+
+		switch (channelType) {
+			case '#':
+				record = await Rooms.findOne({
+					$or: [{ _id: channel }, { name: channel }],
+				});
+				break;
+			case '@':
+				record = await Users.findOne({
+					$or: [{ _id: channel }, { username: channel }],
+				});
+				break;
+		}
+
+		if (!record) {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
+				method: 'updateIncomingIntegration',
+			});
+		}
+
+		if (
+			!(await hasAllPermissionAsync(userId, ['manage-incoming-integrations', 'manage-own-incoming-integrations'])) &&
+			!(await Subscriptions.findOneByRoomIdAndUserId(record._id, userId, { projection: { _id: 1 } }))
+		) {
+			throw new Meteor.Error('error-invalid-channel', 'Invalid Channel', {
+				method: 'updateIncomingIntegration',
+			});
+		}
+	}
+
+	const username = 'username' in integration ? integration.username : currentIntegration.username;
+	const user = await Users.findOneByUsername(username, { projection: { _id: 1, username: 1 } });
+
+	if (!user) {
+		throw new Meteor.Error('error-invalid-post-as-user', 'Invalid Post As User', {
+			method: 'updateIncomingIntegration',
+		});
+	}
+
+	if (!(await hasPermissionAsync(user._id, 'message-impersonate'))) {
+		throw new Meteor.Error(
+			'error-user-lacks-message-impersonate-permission',
+			"User selected for the incoming integration lacks the 'message-impersonate' permission.",
+			{
+				method: 'updateIncomingIntegration',
+			},
+		);
+	}
+
+	const updatedIntegration = await Integrations.findOneAndUpdate(
+		{ _id: integrationId },
+		{
+			$set: {
+				enabled: integration.enabled,
+				name: integration.name,
+				...(typeof integration.avatar !== 'undefined' && { avatar: integration.avatar }),
+				...(typeof integration.emoji !== 'undefined' && { emoji: integration.emoji }),
+				...(typeof integration.alias !== 'undefined' && { alias: integration.alias }),
+				...(channels && { channel: channels }),
+				...('username' in integration && { username: user.username, userId: user._id }),
+				...(isFrozen
+					? {}
+					: {
+							...(typeof integration.script !== 'undefined' && { script: integration.script }),
+							scriptEnabled: integration.scriptEnabled,
+							...(scriptEngine && { scriptEngine }),
+							skipTranspile,
+						}),
+				...(typeof integration.overrideDestinationChannelEnabled !== 'undefined' && {
+					overrideDestinationChannelEnabled: integration.overrideDestinationChannelEnabled,
+				}),
+				_updatedAt: new Date(),
+				_updatedBy: await Users.findOne({ _id: userId }, { projection: { username: 1 } }),
+			},
+		},
+		{ returnDocument: 'after' },
+	);
+
+	if (updatedIntegration) {
+		void notifyOnIntegrationChanged(updatedIntegration);
+	}
+
+	return updatedIntegration;
+};
+
+Meteor.methods<ServerMethods>({
+	async updateIncomingIntegration(integrationId, integration) {
+		methodDeprecationLogger.method('updateIncomingIntegration', '9.0.0', '/v1/integrations.update');
+		if (!this.userId) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+				method: 'updateOutgoingIntegration',
+			});
+		}
+
+		return updateIncomingIntegration(this.userId, integrationId, integration);
+	},
+});