snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/publications/index.ts

@@ -0,0 +1,5 @@
+import './messages';
+import './room';
+import './settings';
+import './spotlight';
+import './subscription';

apps/meteor/server/publications/messages.ts

@@ -0,0 +1,305 @@
+import type { IMessage, IRoom } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Messages } from '@rocket.chat/models';
+import { check } from 'meteor/check';
+import { Meteor } from 'meteor/meteor';
+import type { FindOptions } from 'mongodb';
+
+import { canAccessRoomIdAsync } from '../lib/authorization/canAccessRoom';
+import { getChannelHistory } from '../meteor-methods/messages/getChannelHistory';
+
+type CursorPaginationType = 'UPDATED' | 'DELETED';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'messages/get': (
+			rid: IRoom['_id'],
+			options: {
+				lastUpdate?: Date;
+				latestDate?: Date;
+				oldestDate?: Date;
+				inclusive?: boolean;
+				count?: number;
+				unreads?: boolean;
+				next?: string;
+				previous?: string;
+				type?: CursorPaginationType;
+			},
+		) => Promise<
+			| {
+					updated: IMessage[];
+					deleted: IMessage[];
+					cursor?: {
+						next: string | null;
+						previous: string | null;
+					};
+			  }
+			| boolean
+			| IMessage[]
+			| { messages: IMessage[]; firstUnread?: any; unreadNotLoaded?: number }
+		>;
+	}
+}
+
+export function extractTimestampFromCursor(cursor: string): Date {
+	const timestamp = parseInt(cursor, 10);
+
+	if (isNaN(timestamp) || new Date(timestamp).toString() === 'Invalid Date') {
+		throw new Error('Invalid Date');
+	}
+
+	return new Date(timestamp);
+}
+
+export function mountCursorQuery({ next, previous, count }: { next?: string; previous?: string; count: number }): {
+	query: { $gt: Date } | { $lt: Date };
+	options: FindOptions<IMessage>;
+} {
+	const options: FindOptions<IMessage> = {
+		sort: { _updatedAt: 1 },
+		...(next || previous ? { limit: count + 1 } : {}),
+	};
+
+	if (next) {
+		return { query: { $gt: extractTimestampFromCursor(next) }, options };
+	}
+
+	if (previous) {
+		return { query: { $lt: extractTimestampFromCursor(previous) }, options: { ...options, sort: { _updatedAt: -1 } } };
+	}
+
+	return { query: { $gt: new Date(0) }, options };
+}
+
+export function mountCursorFromMessage(message: IMessage & { _deletedAt?: Date }, type: 'UPDATED' | 'DELETED'): string {
+	if (type === 'UPDATED' && message._updatedAt) {
+		return `${message._updatedAt.getTime()}`;
+	}
+
+	if (type === 'DELETED' && message._deletedAt) {
+		return `${message._deletedAt.getTime()}`;
+	}
+
+	throw new Meteor.Error('error-cursor-not-found', 'Cursor not found', { method: 'messages/get' });
+}
+
+export function mountNextCursor(
+	messages: IMessage[],
+	count: number,
+	type: CursorPaginationType,
+	next?: string,
+	previous?: string,
+): string | null {
+	if (messages.length === 0) {
+		return null;
+	}
+
+	if (previous) {
+		return mountCursorFromMessage(messages[0], type);
+	}
+
+	if (messages.length <= count && next) {
+		return null;
+	}
+
+	if (messages.length > count && next) {
+		return mountCursorFromMessage(messages[messages.length - 2], type);
+	}
+
+	return mountCursorFromMessage(messages[messages.length - 1], type);
+}
+
+export function mountPreviousCursor(
+	messages: IMessage[],
+	count: number,
+	type: CursorPaginationType,
+	next?: string,
+	previous?: string,
+): string | null {
+	if (messages.length === 0) {
+		return null;
+	}
+
+	if (messages.length <= count && next) {
+		return mountCursorFromMessage(messages[0], type);
+	}
+
+	if (messages.length > count && next) {
+		return mountCursorFromMessage(messages[0], type);
+	}
+
+	if (messages.length <= count && previous) {
+		return null;
+	}
+
+	if (messages.length > count && previous) {
+		return mountCursorFromMessage(messages[messages.length - 2], type);
+	}
+
+	return mountCursorFromMessage(messages[0], type);
+}
+
+export async function handleWithoutPagination(rid: IRoom['_id'], lastUpdate: Date, fromTs?: Date) {
+	const options: FindOptions<IMessage> = { sort: { ts: -1 } };
+
+	const [updatedMessages, deletedMessages] = await Promise.all([
+		Messages.findForUpdates(rid, { updatedAt: { $gt: lastUpdate }, minTs: fromTs }, options).toArray(),
+		Messages.trashFindDeletedAfter(
+			lastUpdate,
+			{ rid, ...(fromTs && { ts: { $gte: fromTs } }) },
+			{ projection: { _id: 1, _deletedAt: 1 }, ...options },
+		).toArray(),
+	]);
+
+	return {
+		updated: updatedMessages,
+		deleted: deletedMessages,
+	};
+}
+
+export async function handleCursorPagination(
+	type: CursorPaginationType,
+	rid: IRoom['_id'],
+	count: number,
+	next?: string,
+	previous?: string,
+): Promise<{
+	updated: IMessage[];
+	deleted: IMessage[];
+	cursor?: {
+		next: string | null;
+		previous: string | null;
+	};
+}> {
+	const { query, options } = mountCursorQuery({ next, previous, count });
+
+	const response =
+		type === 'UPDATED'
+			? await Messages.findForUpdates(rid, { updatedAt: query }, options).toArray()
+			: ((await Messages.trashFind(
+					{ rid, _deletedAt: query },
+					{ projection: { _id: 1, _deletedAt: 1 }, ...options },
+				)!.toArray()) as IMessage[]);
+
+	const cursor = {
+		next: mountNextCursor(response, count, type, next, previous),
+		previous: mountPreviousCursor(response, count, type, next, previous),
+	};
+
+	if (response.length > count) {
+		response.pop();
+	}
+
+	return {
+		updated: type === 'UPDATED' ? response : [],
+		deleted: type === 'DELETED' ? response : [],
+		cursor,
+	};
+}
+
+export const getMessageHistory = async (
+	rid: IRoom['_id'],
+	fromId: string,
+	{
+		lastUpdate,
+		fromTs,
+		latestDate = new Date(),
+		oldestDate,
+		inclusive = false,
+		count = 20,
+		unreads = false,
+		next,
+		previous,
+		type,
+	}: {
+		lastUpdate?: Date;
+		fromTs?: Date;
+		latestDate?: Date;
+		oldestDate?: Date;
+		inclusive?: boolean;
+		count?: number;
+		unreads?: boolean;
+		next?: string;
+		previous?: string;
+		type?: CursorPaginationType;
+	},
+): Promise<
+	| {
+			updated: IMessage[];
+			deleted: IMessage[];
+			cursor?: {
+				next: string | null;
+				previous: string | null;
+			};
+	  }
+	| false
+	| IMessage[]
+	| { messages: IMessage[]; firstUnread?: any; unreadNotLoaded?: number }
+> => {
+	if (!(await canAccessRoomIdAsync(rid, fromId))) {
+		throw new Meteor.Error('error-not-allowed', 'Not allowed', { method: 'messages/get' });
+	}
+
+	if (type && !['UPDATED', 'DELETED'].includes(type)) {
+		throw new Meteor.Error('error-type-param-not-supported', 'The "type" parameter must be either "UPDATED" or "DELETED"');
+	}
+
+	if ((next || previous) && !type) {
+		throw new Meteor.Error('error-type-param-required', 'The "type" parameter is required when using the "next" or "previous" parameters');
+	}
+
+	if (next && previous) {
+		throw new Meteor.Error('error-cursor-conflict', 'You cannot provide both "next" and "previous" parameters');
+	}
+
+	if ((next || previous) && lastUpdate) {
+		throw new Meteor.Error(
+			'error-cursor-and-lastUpdate-conflict',
+			'The attributes "next", "previous" and "lastUpdate" cannot be used together',
+		);
+	}
+
+	// `fromTs` only bounds the query on the `lastUpdate` path; neither cursor pagination nor the channel
+	// history fallback honors it, so accepting it there would silently widen the result set.
+	if (fromTs && !lastUpdate) {
+		throw new Meteor.Error('error-fromTs-requires-lastUpdate', 'The "fromTs" parameter can only be used together with "lastUpdate"');
+	}
+
+	const hasCursorPagination = !!((next || previous) && count !== null && type);
+
+	if (!hasCursorPagination && !lastUpdate) {
+		return getChannelHistory({ rid, fromUserId: fromId, latest: latestDate, oldest: oldestDate, inclusive, count, unreads });
+	}
+
+	if (lastUpdate) {
+		return handleWithoutPagination(rid, lastUpdate, fromTs);
+	}
+
+	if (!type) {
+		throw new Meteor.Error('error-param-required', 'The "type" or "lastUpdate" parameters must be provided');
+	}
+
+	return handleCursorPagination(type, rid, count, next, previous);
+};
+
+Meteor.methods<ServerMethods>({
+	async 'messages/get'(
+		rid,
+		{ lastUpdate, latestDate = new Date(), oldestDate, inclusive = false, count = 20, unreads = false, next, previous, type },
+	) {
+		check(rid, String);
+
+		const fromId = Meteor.userId();
+
+		if (!fromId) {
+			throw new Meteor.Error('error-invalid-user', 'Invalid user', { method: 'messages/get' });
+		}
+
+		if (!rid) {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', { method: 'messages/get' });
+		}
+
+		return getMessageHistory(rid, fromId, { lastUpdate, latestDate, oldestDate, inclusive, count, unreads, next, previous, type });
+	},
+});

apps/meteor/server/publications/room/index.ts

@@ -0,0 +1,99 @@
+import type { IOmnichannelRoom, IRoom, RoomType } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Rooms } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+import _ from 'underscore';
+
+import { roomFields } from '../../../lib/publishFields';
+import { canAccessRoomAsync } from '../../lib/authorization';
+import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
+import { roomCoordinator } from '../../lib/rooms/roomCoordinator';
+import { settings } from '../../settings';
+
+type PublicRoomField = keyof typeof roomFields;
+type PublicRoom = Pick<IRoom, PublicRoomField & keyof IRoom> & Pick<IOmnichannelRoom, PublicRoomField & keyof IOmnichannelRoom>;
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'rooms/get'(updatedAt?: Date): IRoom[] | { update: IRoom[]; remove: IRoom[] };
+		'getRoomByTypeAndName': (type: RoomType, name: string) => PublicRoom;
+	}
+}
+
+const roomMap = (record: IRoom | IOmnichannelRoom) => {
+	return _.pick(record, ...Object.keys(roomFields)) as PublicRoom;
+};
+
+export const roomsGetMethod = async (userId?: string | null, updatedAt?: Date): Promise<IRoom[] | { update: IRoom[]; remove: IRoom[] }> => {
+	const options = { projection: roomFields };
+
+	if (!userId) {
+		if (settings.get('Accounts_AllowAnonymousRead')) {
+			return Rooms.findByDefaultAndTypes(true, ['c'], options).toArray();
+		}
+		return [];
+	}
+
+	if (updatedAt instanceof Date) {
+		return {
+			update: await (await Rooms.findBySubscriptionUserIdUpdatedAfter(userId, updatedAt, options)).toArray(),
+			remove: await Rooms.trashFindDeletedAfter(updatedAt, {}, { projection: { _id: 1, _deletedAt: 1 } }).toArray(),
+		};
+	}
+
+	return (await Rooms.findBySubscriptionUserId(userId, options)).toArray();
+};
+
+Meteor.methods<ServerMethods>({
+	async 'rooms/get'(updatedAt) {
+		return roomsGetMethod(Meteor.userId(), updatedAt);
+	},
+
+	async 'getRoomByTypeAndName'(type, name) {
+		if (!type || !name) {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
+				method: 'getRoomByTypeAndName',
+			});
+		}
+
+		const user = await Meteor.userAsync();
+		const isAnonymous = !user?._id;
+
+		if (isAnonymous) {
+			const allowAnon = settings.get('Accounts_AllowAnonymousRead');
+			if (!allowAnon || type !== 'c') {
+				throw new Meteor.Error('error-invalid-user', 'Invalid user', {
+					method: 'getRoomByTypeAndName',
+				});
+			}
+		}
+
+		const roomFind = roomCoordinator.getRoomFind(type);
+
+		const room = roomFind ? await roomFind.call(this, name, user?._id) : await Rooms.findByTypeAndNameOrId(type, name);
+
+		if (!room) {
+			throw new Meteor.Error('error-invalid-room', 'Invalid room', {
+				method: 'getRoomByTypeAndName',
+			});
+		}
+
+		if (
+			user &&
+			!(await canAccessRoomAsync(room, user, {
+				includeInvitations: true,
+			}))
+		) {
+			throw new Meteor.Error('error-no-permission', 'No permission', {
+				method: 'getRoomByTypeAndName',
+			});
+		}
+
+		if (settings.get('Store_Last_Message') && user && !(await hasPermissionAsync(user, 'preview-c-room'))) {
+			delete room.lastMessage;
+		}
+
+		return roomMap(room);
+	},
+});

apps/meteor/server/publications/settings/index.ts

@@ -0,0 +1,114 @@
+import type { ISetting, RocketChatRecordDeleted } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Settings } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+import type { WithId } from 'mongodb';
+
+import { getSettingPermissionId } from '../../../app/authorization/lib';
+import { hasPermissionAsync, hasAtLeastOnePermissionAsync } from '../../lib/authorization/hasPermission';
+import { SettingsEvents } from '../../settings';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'public-settings/get'(
+			updatedSince?: Date,
+		): Promise<ISetting[] | { update: ISetting[]; remove: WithId<RocketChatRecordDeleted<ISetting>>[] }>;
+		'private-settings/get'(
+			updatedSince?: Date,
+		): Promise<ISetting[] | { update: ISetting[]; remove: WithId<RocketChatRecordDeleted<ISetting>>[] }>;
+	}
+}
+
+Meteor.methods<ServerMethods>({
+	async 'public-settings/get'(updatedAt) {
+		if (updatedAt instanceof Date) {
+			const records = await Settings.findNotHiddenPublicUpdatedAfter(updatedAt).toArray();
+			SettingsEvents.emit('fetch-settings', records);
+
+			return {
+				update: records,
+				remove: await Settings.trashFindDeletedAfter(
+					updatedAt,
+					{
+						hidden: {
+							$ne: true,
+						},
+						public: true,
+					},
+					{
+						projection: {
+							_id: 1,
+							_deletedAt: 1,
+						},
+					},
+				).toArray(),
+			};
+		}
+
+		const publicSettings = (await Settings.findNotHiddenPublic().toArray()) as ISetting[];
+		SettingsEvents.emit('fetch-settings', publicSettings);
+
+		return publicSettings;
+	},
+	async 'private-settings/get'(updatedAfter) {
+		const uid = Meteor.userId();
+
+		if (!uid) {
+			return [];
+		}
+
+		const privilegedSetting = await hasAtLeastOnePermissionAsync(uid, ['view-privileged-setting', 'edit-privileged-setting']);
+		const manageSelectedSettings = privilegedSetting || (await hasPermissionAsync(uid, 'manage-selected-settings'));
+
+		if (!manageSelectedSettings) {
+			return [];
+		}
+
+		const bypass = async <T>(settings: T): Promise<T> => settings;
+
+		const applyFilter = <T extends any[], U>(fn: (args: T) => Promise<U>, args: T): Promise<U> => fn(args);
+
+		const getAuthorizedSettingsFiltered = async (settings: ISetting[]): Promise<ISetting[]> =>
+			(
+				await Promise.all(
+					settings.map(async (record) => {
+						if (await hasPermissionAsync(uid, getSettingPermissionId(record._id))) {
+							return record;
+						}
+					}),
+				)
+			).filter(Boolean) as ISetting[];
+
+		const getAuthorizedSettings = async (updatedAfter: Date | undefined, privilegedSetting: boolean): Promise<ISetting[]> =>
+			applyFilter(
+				privilegedSetting ? bypass : getAuthorizedSettingsFiltered,
+				await Settings.findNotHidden(updatedAfter && { updatedAfter }).toArray(),
+			);
+
+		if (!(updatedAfter instanceof Date)) {
+			// this does not only imply an unfiltered setting range, it also identifies the caller's context:
+			// If called *with* filter (see below), the user wants a collection as a result.
+			// in this case, it shall only be a plain array
+			return getAuthorizedSettings(updatedAfter, privilegedSetting);
+		}
+
+		return {
+			update: await getAuthorizedSettings(updatedAfter, privilegedSetting),
+			remove: await Settings.trashFindDeletedAfter(
+				updatedAfter,
+				{
+					hidden: {
+						$ne: true,
+					},
+				},
+				{
+					projection: {
+						_id: 1,
+						_deletedAt: 1,
+					},
+				},
+			).toArray(),
+		};
+	},
+});

apps/meteor/server/publications/spotlight.ts

@@ -0,0 +1,92 @@
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { DDPRateLimiter } from 'meteor/ddp-rate-limiter';
+import { Meteor } from 'meteor/meteor';
+
+import { methodDeprecationLogger } from '../lib/deprecationWarningLogger';
+import { Spotlight } from '../lib/spotlight';
+import { getUsersHiddenFrom, redactHiddenUsers } from '../lib/statusVisibility/hiddenUsers';
+
+type SpotlightType = {
+	users?: boolean;
+	rooms?: boolean;
+	mentions?: boolean;
+	includeFederatedRooms?: boolean;
+};
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		spotlight(
+			text: string,
+			usernames?: string[],
+			type?: SpotlightType,
+			rid?: string,
+		): {
+			rooms: { _id: string; name: string; t: string; uids?: string[] }[];
+			users: {
+				_id: string;
+				status: 'offline' | 'online' | 'busy' | 'away';
+				name: string;
+				username: string;
+				outside: boolean;
+				avatarETag?: string;
+				nickname?: string;
+			}[];
+		};
+	}
+}
+
+export const spotlightMethod = async ({
+	text,
+	usernames = [],
+	type = { users: true, rooms: true, mentions: false, includeFederatedRooms: false },
+	rid,
+	userId,
+}: {
+	text: string;
+	usernames?: string[];
+	type?: SpotlightType;
+	rid?: string;
+	userId?: string | null;
+}) => {
+	const spotlight = new Spotlight();
+	const { mentions, includeFederatedRooms } = type;
+
+	if (text.startsWith('#')) {
+		type.users = false;
+		text = text.slice(1);
+	}
+
+	if (text.startsWith('@')) {
+		type.rooms = false;
+		text = text.slice(1);
+	}
+
+	const [users, rooms] = await Promise.all([
+		type.users ? spotlight.searchUsers({ userId, rid, text, usernames, mentions }) : [],
+		type.rooms ? spotlight.searchRooms({ userId, text, includeFederatedRooms }) : [],
+	]);
+
+	const hidden = await getUsersHiddenFrom(userId);
+
+	return { users: redactHiddenUsers(users, hidden), rooms };
+};
+
+Meteor.methods<ServerMethods>({
+	async spotlight(text, usernames = [], type = { users: true, rooms: true, mentions: false, includeFederatedRooms: false }, rid) {
+		methodDeprecationLogger.method('spotlight', '9.0.0', '/v1/spotlight');
+		return spotlightMethod({ text, usernames, type, rid, userId: this.userId });
+	},
+});
+
+DDPRateLimiter.addRule(
+	{
+		type: 'method',
+		name: 'spotlight',
+		userId(/* userId*/) {
+			return true;
+		},
+	},
+	100,
+	100000,
+);

apps/meteor/server/publications/subscription/index.ts

@@ -0,0 +1,55 @@
+import type { ISubscription } from '@rocket.chat/core-typings';
+import type { ServerMethods } from '@rocket.chat/ddp-client';
+import { Subscriptions } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { subscriptionFields } from '../../../lib/publishFields';
+
+declare module '@rocket.chat/ddp-client' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention
+	interface ServerMethods {
+		'subscriptions/get'(updatedAt?: Date): ISubscription[] | { update: ISubscription[]; remove: { _id: string; _deletedAt: Date }[] };
+	}
+}
+
+export const getSubscriptions = async (
+	uid: string,
+	updatedAt?: Date,
+): Promise<ISubscription[] | { update: ISubscription[]; remove: { _id: string; _deletedAt: Date }[] }> => {
+	const options = { projection: subscriptionFields };
+
+	const records: ISubscription[] = await Subscriptions.findByUserId(uid, options).toArray();
+
+	if (updatedAt instanceof Date) {
+		return {
+			update: records.filter((record) => {
+				return record._updatedAt > updatedAt;
+			}),
+			remove: await Subscriptions.trashFindDeletedAfter(
+				updatedAt,
+				{
+					'u._id': uid,
+				},
+				{
+					projection: {
+						_id: 1,
+						_deletedAt: 1,
+					},
+				},
+			).toArray(),
+		};
+	}
+
+	return records;
+};
+
+Meteor.methods<ServerMethods>({
+	async 'subscriptions/get'(updatedAt) {
+		const uid = Meteor.userId();
+		if (!uid) {
+			return [];
+		}
+
+		return getSubscriptions(uid, updatedAt);
+	},
+});