snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/routes/avatar/index.ts

@@ -0,0 +1,10 @@
+import { WebApp } from 'meteor/webapp';
+
+import { roomAvatar } from './room';
+import { userAvatarByUsername, userAvatarById } from './user';
+
+import './middlewares';
+
+WebApp.connectHandlers.use('/avatar/room/', roomAvatar);
+WebApp.connectHandlers.use('/avatar/uid/', userAvatarById);
+WebApp.connectHandlers.use('/avatar/', userAvatarByUsername);

apps/meteor/server/routes/avatar/middlewares/auth.spec.ts

@@ -0,0 +1,124 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+const mocks = {
+	utils: {
+		userCanAccessAvatar: sinon.stub(),
+		renderSVGLetters: sinon.stub(),
+	},
+};
+
+const { protectAvatarsWithFallback, protectAvatars } = proxyquire.noCallThru().load('./auth.ts', {
+	'../utils': mocks.utils,
+});
+
+describe('#protectAvatarsWithFallback()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		write: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => mock.reset());
+	});
+
+	it(`should write 404 to head if no url provided`, async () => {
+		await protectAvatarsWithFallback({}, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 200 to head and write fallback to body (user avatar)`, async () => {
+		mocks.utils.renderSVGLetters.returns('fallback');
+
+		await protectAvatarsWithFallback({ url: '/jon' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+
+		expect(response.writeHead.calledWith(200, { 'Content-Type': 'image/svg+xml' })).to.be.true;
+		expect(mocks.utils.renderSVGLetters.calledWith('jon')).to.be.true;
+		expect(response.write.calledWith('fallback')).to.be.true;
+
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 200 to head and write fallback to body (room avatar)`, async () => {
+		mocks.utils.renderSVGLetters.returns('fallback');
+
+		await protectAvatarsWithFallback({ url: '/room/jon' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(200, { 'Content-Type': 'image/svg+xml' })).to.be.true;
+		expect(response.write.calledWith('fallback')).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call next if user can access avatar`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(true);
+		const request = { url: '/jon' };
+
+		await protectAvatarsWithFallback(request, response, next);
+		expect(mocks.utils.userCanAccessAvatar.calledWith(request)).to.be.true;
+		expect(next.called).to.be.true;
+	});
+});
+
+describe('#protectAvatars()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		write: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => mock.reset());
+	});
+
+	it(`should write 404 to head if no url provided`, async () => {
+		await protectAvatars({}, response, next);
+
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 404 to head if access is denied`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(false);
+
+		await protectAvatars({ url: '/room/jon' }, response, next);
+
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call next if user can access avatar`, async () => {
+		mocks.utils.userCanAccessAvatar.returns(true);
+		const request = { url: '/jon' };
+
+		await protectAvatars(request, response, next);
+		expect(mocks.utils.userCanAccessAvatar.calledWith(request)).to.be.true;
+		expect(next.called).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/middlewares/auth.ts

@@ -0,0 +1,47 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import type { NextFunction } from 'connect';
+
+import { userCanAccessAvatar, renderSVGLetters } from '../utils';
+
+const renderFallback = (req: IncomingMessage, res: ServerResponse) => {
+	if (!req.url) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	let roomOrUsername;
+
+	if (req.url.startsWith('/room')) {
+		roomOrUsername = req.url.split('/')[2] || 'Room';
+	} else {
+		roomOrUsername = req.url.split('/')[1] || 'Anonymous';
+	}
+
+	res.writeHead(200, { 'Content-Type': 'image/svg+xml' });
+	res.write(renderSVGLetters(roomOrUsername, 200));
+	res.end();
+};
+
+const getProtectAvatars = (callback?: typeof renderFallback) => async (req: IncomingMessage, res: ServerResponse, next: NextFunction) => {
+	if (!(await userCanAccessAvatar(req as IIncomingMessage))) {
+		if (callback) {
+			callback(req, res);
+			return;
+		}
+
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	return next();
+};
+
+// If unauthorized returns the SVG fallback (letter avatar)
+export const protectAvatarsWithFallback = getProtectAvatars(renderFallback);
+
+// Just returns 404
+export const protectAvatars = getProtectAvatars();

apps/meteor/server/routes/avatar/middlewares/browserVersion.spec.ts

@@ -0,0 +1,87 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+// const getCookie = sinon.stub();
+class CookiesMock {
+	public get = (_key: any, value: any) => value;
+}
+const { handleBrowserVersionCheck, isIEOlderThan11 } = proxyquire.noCallThru().load('./browserVersion', {
+	'meteor/ostrio:cookies': {
+		Cookies: CookiesMock,
+	},
+	'../../../lib/utils/getURL': {
+		getURL: () => '',
+	},
+});
+
+describe('#isIEOlderThan11()', () => {
+	it('should return false if user agent is IE11', () => {
+		const userAgent = {
+			browser: {
+				name: 'IE',
+				version: '11.0',
+			},
+		};
+		expect(isIEOlderThan11(userAgent)).to.be.false;
+	});
+
+	it('should return true if user agent is IE < 11', () => {
+		const userAgent = {
+			browser: {
+				name: 'IE',
+				version: '10.0',
+			},
+		};
+		expect(isIEOlderThan11(userAgent)).to.be.true;
+	});
+});
+
+describe('#handleBrowserVersionCheck()', () => {
+	it('should call next if browser_version_check cookie is set to "bypass"', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				cookie: 'bypass',
+			},
+		};
+		handleBrowserVersionCheck(request as any, {} as any, next);
+
+		expect(next.calledOnce).to.be.true;
+	});
+
+	it('should call next if browser_version_check cookie is not set to "force" and user agent is not IE < 11', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				'cookie': 'anything',
+				'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36',
+			},
+		};
+		handleBrowserVersionCheck(request as any, {} as any, next);
+
+		expect(next.calledOnce).to.be.true;
+	});
+
+	it('should respond with Browser not supported', async () => {
+		const next = sinon.spy();
+		const request = {
+			headers: {
+				'cookie': 'anything',
+				'user-agent': 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 7.0; InfoPath.3; .NET CLR 3.1.40767; Trident/6.0; en-IN)',
+			},
+		};
+
+		const response = {
+			setHeader: sinon.spy(),
+			write: sinon.spy(),
+			end: sinon.spy(),
+		};
+		handleBrowserVersionCheck(request as any, response as any, next);
+
+		expect(response.setHeader.calledWith('content-type', 'text/html; charset=utf-8')).to.be.true;
+		expect(response.write.calledWith(sinon.match('Browser not supported'))).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/middlewares/browserVersion.ts

@@ -0,0 +1,147 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import type { NextFunction } from 'connect';
+import { Cookies } from 'meteor/ostrio:cookies';
+import parser from 'ua-parser-js';
+
+import { getURL } from '../../../lib/utils/getURL';
+
+const cookies = new Cookies();
+
+export const isIEOlderThan11 = (userAgent: ReturnType<typeof parser>) => {
+	if (!userAgent?.browser.name || !userAgent?.browser.version) {
+		return false;
+	}
+	return userAgent.browser.name === 'IE' && parseInt(userAgent.browser.version) < 11;
+};
+
+export const handleBrowserVersionCheck = (request: IncomingMessage, res: ServerResponse, next: NextFunction) => {
+	const req = request as IIncomingMessage;
+
+	const browserVersionCheck = cookies.get('browser_version_check', req.headers.cookie);
+	if (browserVersionCheck === 'bypass') {
+		next();
+		return;
+	}
+
+	const userAgent = parser(req.headers['user-agent']);
+	if (browserVersionCheck !== 'force' && !isIEOlderThan11(userAgent)) {
+		next();
+		return;
+	}
+
+	res.setHeader('content-type', 'text/html; charset=utf-8');
+
+	res.write(`
+		<style>
+			body {
+				margin: 0;
+				font-family: -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,Oxygen,Ubuntu,Cantarell,'Helvetica Neue','Apple Color Emoji','Segoe UI Emoji','Segoe UI Symbol','Meiryo UI',Arial,sans-serif;
+			}
+
+			.rcx-box--text-style-headline {
+				letter-spacing: 0rem;
+				font-family: Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, Helvetica Neue, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Meiryo UI, Arial, sans-serif;
+				font-size: 1.375rem;
+				font-weight: 400;
+				line-height: 2rem;
+			}
+
+			.not-supported-browser {
+				width: 100%;
+				min-height: 100vh;
+
+				text-align: center;
+
+				background-image: url(${getURL('/images/404.svg')});
+				background-repeat: no-repeat;
+				background-position: center;
+				background-size: cover;
+
+				display: flex;
+				justify-content: center;
+				align-items: center;
+
+				&__404 {
+					font-size: 4em;
+					font-weight: bold;
+				}
+			}
+
+			.not-supported-browser__text {
+				font-size: 4em;
+				font-weight: bold;
+			}
+
+			.rcx-box--text-color-alternative {
+				color: #ffffff;
+			}
+
+			.rcx-box, .rcx-box::before, .rcx-box::after {
+				box-sizing: border-box;
+				margin: 0;
+				padding: 0;
+				transition: all 230ms;
+				border-width: 0;
+				border-style: solid;
+				border-color: currentColor;
+				outline: none;
+				-webkit-font-smoothing: antialiased;
+				-moz-osx-font-smoothing: grayscale;
+				font-variant-numeric: tabular-nums;
+			}
+
+			.rcx-button {
+				display: inline-block;
+				text-align: center;
+				vertical-align: middle;
+				white-space: nowrap;
+				text-decoration: none;
+				cursor: pointer;
+				outline: 0;
+				letter-spacing: 0rem;
+				font-family: Inter, -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, Oxygen, Ubuntu, Cantarell, Helvetica Neue, Apple Color Emoji, Segoe UI Emoji, Segoe UI Symbol, Meiryo UI, Arial, sans-serif;
+				font-size: 0.875rem;
+				font-weight: 500;
+				line-height: 1.25rem;
+				overflow: hidden;
+				text-overflow: ellipsis;
+				padding: 7px 15px;
+				padding-top: 7px;
+				padding-bottom: 7px;
+				padding-block: 7px;
+				padding-left: 15px;
+				padding-right: 15px;
+				padding-inline: 15px;
+			}
+
+			.rcx-button--primary {
+				color: #ffffff;
+				border-width: 0.125rem;
+				border-style: solid;
+				border-color: #1d74f5;
+				border-radius: 0.125rem;
+				background-color: #1d74f5;
+				-webkit-appearance: none;
+				-moz-appearance: none;
+				appearance: none;
+			}
+
+			.rcx-box--text-color-primary {
+				color: #1d74f5;
+			}
+			.rcx-box.rcx-\@s6mi60{margin:0.75rem !important;}.rcx-box.rcx-\@19aubzx{margin:2rem !important;}.rcx-box.rcx-\@1kgm1vs{-webkit-align-items:center !important;-webkit-box-align:center !important;-ms-flex-align:center !important;align-items:center !important;-webkit-box-pack:center !important;-webkit-justify-content:center !important;-ms-flex-pack:center !important;justify-content:center !important;-webkit-flex-direction:column !important;-ms-flex-direction:column !important;flex-direction:column !important;}.rcx-box.rcx-\@1qvl0ud{display:-webkit-box !important;display:-webkit-flex !important;display:-ms-flexbox !important;display:flex !important;}
+		</style>
+
+		<section class="rcx-box not-supported-browser rcx-@1kgm1vs rcx-@1qvl0ud">
+			<div class="rcx-box">
+				<div class="rcx-box rcx-box--text-color-alternative not-supported-browser__text rcx-@s6mi60">Browser not supported</div>
+				<a class="rcx-box rcx-button rcx-button--primary" href="https://rocket.chat/docs/getting-support/#supported-browser-versions" target="_blank">Check the documentation</a>
+				<a class="rcx-box rcx-button rcx-button--primary" href="#" onclick="document.cookie = 'browser_version_check=bypass; path=/'; location.reload(true);">Proceed anyway</a>
+			</div>
+		</section>
+	`);
+
+	res.end();
+};

apps/meteor/server/routes/avatar/middlewares/index.ts

@@ -0,0 +1,8 @@
+import { WebApp } from 'meteor/webapp';
+
+import { protectAvatarsWithFallback, protectAvatars } from './auth';
+import { handleBrowserVersionCheck } from './browserVersion';
+
+WebApp.connectHandlers.use(handleBrowserVersionCheck);
+WebApp.connectHandlers.use('/avatar/uid/', protectAvatars);
+WebApp.connectHandlers.use('/avatar/', protectAvatarsWithFallback);

apps/meteor/server/routes/avatar/room.spec.ts

@@ -0,0 +1,134 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+const mocks = {
+	settingsGet: sinon.stub(),
+	findOneById: sinon.stub(),
+	utils: {
+		serveSvgAvatarInRequestedFormat: sinon.spy(),
+		wasFallbackModified: sinon.stub(),
+		setCacheAndDispositionHeaders: sinon.spy(),
+		serveAvatarFile: sinon.spy(),
+	},
+	avatarFindOneByRoomId: sinon.stub(),
+	getRoomName: sinon.stub(),
+};
+
+class CookiesMock {
+	public get = (_key: any, value: any) => value;
+}
+
+const { roomAvatar } = proxyquire.noCallThru().load('./room', {
+	'@rocket.chat/models': {
+		Rooms: {
+			findOneById: mocks.findOneById,
+		},
+		Avatars: {
+			findOneByRoomId: mocks.avatarFindOneByRoomId,
+		},
+	},
+	'./utils': mocks.utils,
+	'../../lib/rooms/roomCoordinator': {
+		roomCoordinator: {
+			getRoomName: mocks.getRoomName,
+		},
+	},
+	'meteor/ostrio:cookies': {
+		Cookies: CookiesMock,
+	},
+});
+
+describe('#roomAvatar()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		mocks.settingsGet.reset();
+		mocks.avatarFindOneByRoomId.reset();
+		mocks.findOneById.reset();
+
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => ('reset' in mock ? mock.reset() : mock.resetHistory()));
+	});
+
+	it(`should do nothing if url is not in request object`, async () => {
+		await roomAvatar({}, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.called).to.be.false;
+		expect(response.end.called).to.be.false;
+	});
+
+	it(`should write 404 if room is not found`, async () => {
+		mocks.findOneById.returns(null);
+		await roomAvatar({ url: '/' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should serve avatar file if found`, async () => {
+		const request = { url: '/roomId' };
+
+		const file = { uploadedAt: new Date(0), type: 'image/png', size: 100 };
+
+		mocks.findOneById.withArgs('roomId').returns({ _id: 'roomId' });
+		mocks.avatarFindOneByRoomId.withArgs('roomId').returns(file);
+
+		await roomAvatar(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveAvatarFile.calledWith(file, request, response, next)).to.be.true;
+	});
+
+	it(`should serve parent room avatar file if current room avatar is not found`, async () => {
+		const request = { url: '/roomId' };
+
+		const file = { uploadedAt: new Date(0), type: 'image/png', size: 100 };
+
+		mocks.findOneById.withArgs('roomId').returns({ _id: 'roomId', prid: 'roomId2' });
+		mocks.findOneById.withArgs('roomId2').returns({ _id: 'roomId2' });
+		mocks.avatarFindOneByRoomId.withArgs('roomId2').returns(file);
+
+		await roomAvatar(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveAvatarFile.calledWith(file, request, response, next)).to.be.true;
+	});
+
+	it(`should write 304 if fallback content is not modified`, async () => {
+		const request = { url: '/roomId', headers: {} };
+
+		mocks.findOneById.withArgs('roomId').returns({ _id: 'roomId' });
+		mocks.utils.wasFallbackModified.returns(false);
+		await roomAvatar(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(response.writeHead.calledWith(304)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should serve svg fallback if no file found`, async () => {
+		const request = { url: '/roomId', headers: { cookie: 'userId' } };
+
+		mocks.utils.wasFallbackModified.returns(true);
+		mocks.findOneById.withArgs('roomId').returns({ _id: 'roomId' });
+		mocks.getRoomName.returns('roomName');
+
+		await roomAvatar(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({ nameOrUsername: 'roomName', req: request, res: response })).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/room.ts

@@ -0,0 +1,61 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IIncomingMessage, IRoom, IUpload } from '@rocket.chat/core-typings';
+import { Avatars, Rooms } from '@rocket.chat/models';
+import type { NextFunction } from 'connect';
+import { Cookies } from 'meteor/ostrio:cookies';
+
+import { serveSvgAvatarInRequestedFormat, wasFallbackModified, setCacheAndDispositionHeaders, serveAvatarFile } from './utils';
+import { roomCoordinator } from '../../lib/rooms/roomCoordinator';
+
+const cookie = new Cookies();
+const getRoomAndAvatarFile = async (roomId: IRoom['_id']): Promise<{ room: IRoom; file: IUpload | null } | void> => {
+	const room = await Rooms.findOneById(roomId);
+	if (!room) {
+		return;
+	}
+
+	const file = await Avatars.findOneByRoomId(room._id);
+
+	// if it is a discussion that doesn't have it's own avatar, returns the parent's room avatar
+	if (room.prid && !file) {
+		return getRoomAndAvatarFile(room.prid);
+	}
+
+	return { room, file };
+};
+
+export const roomAvatar = async function (request: IncomingMessage, res: ServerResponse, next: NextFunction) {
+	const req = request as IIncomingMessage;
+
+	if (!req.url) {
+		return;
+	}
+
+	const roomId = decodeURIComponent(req.url.slice(1).replace(/\?.*$/, ''));
+
+	const { room, file } = (await getRoomAndAvatarFile(roomId)) || {};
+	if (!room) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	setCacheAndDispositionHeaders(req, res);
+
+	if (file) {
+		void serveAvatarFile(file, req, res, next);
+		return;
+	}
+
+	if (!wasFallbackModified(req.headers['if-modified-since'])) {
+		res.writeHead(304);
+		res.end();
+		return;
+	}
+
+	const uid = req.headers.cookie && cookie.get('rc_uid', req.headers.cookie);
+	const roomName = await roomCoordinator.getRoomName(room.t, room, uid);
+
+	serveSvgAvatarInRequestedFormat({ nameOrUsername: roomName, req, res });
+};

apps/meteor/server/routes/avatar/user.spec.ts

@@ -0,0 +1,324 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import { Headers } from 'node-fetch';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+const mocks = {
+	settingsGet: sinon.stub(),
+	findOneByUsernameIgnoringCase: sinon.stub(),
+	findOneById: sinon.stub(),
+	utils: {
+		serveSvgAvatarInRequestedFormat: sinon.spy(),
+		wasFallbackModified: sinon.stub(),
+		setCacheAndDispositionHeaders: sinon.spy(),
+		serveAvatarFile: sinon.spy(),
+	},
+	serverFetch: sinon.stub(),
+	avatarFindOneByName: sinon.stub(),
+	avatarFindOneByUserId: sinon.stub(),
+};
+
+const { userAvatarById, userAvatarByUsername } = proxyquire.noCallThru().load('./user', {
+	'@rocket.chat/models': {
+		Users: {
+			findOneByUsernameIgnoringCase: mocks.findOneByUsernameIgnoringCase,
+			findOneById: mocks.findOneById,
+		},
+		Avatars: {
+			findOneByName: mocks.avatarFindOneByName,
+			findOneByUserId: mocks.avatarFindOneByUserId,
+		},
+	},
+	'../../settings': {
+		settings: {
+			get: mocks.settingsGet,
+		},
+	},
+	'./utils': mocks.utils,
+	'@rocket.chat/server-fetch': {
+		serverFetch: mocks.serverFetch,
+	},
+});
+
+describe('#userAvatarById()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		mocks.settingsGet.reset();
+		mocks.avatarFindOneByUserId.reset();
+
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => ('reset' in mock ? mock.reset() : mock.resetHistory()));
+	});
+
+	it(`should do nothing if url is not in request object`, async () => {
+		await userAvatarById({}, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.called).to.be.false;
+		expect(response.end.called).to.be.false;
+	});
+
+	it(`should write 404 if Id is not provided`, async () => {
+		await userAvatarById({ url: '/' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call external provider`, async () => {
+		const userId = 'xvf5Tr34';
+		const request = { url: `/${userId}` };
+
+		const pipe = sinon.spy();
+		const mockResponseHeaders = new Headers();
+		mockResponseHeaders.set('header1', 'true');
+		mockResponseHeaders.set('header2', 'false');
+
+		mocks.serverFetch.returns({
+			headers: mockResponseHeaders,
+			body: { pipe },
+		});
+
+		mocks.settingsGet.returns('test123/{username}');
+
+		mocks.findOneById.returns({ username: 'jon' });
+
+		await userAvatarById(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.findOneById.calledWith(userId)).to.be.true;
+		expect(mocks.serverFetch.calledWith('test123/jon')).to.be.true;
+		expect(response.setHeader.calledTwice).to.be.true;
+		expect(response.setHeader.getCall(0).calledWith('header1', 'true')).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('header2', 'false')).to.be.true;
+		expect(pipe.calledWith(response)).to.be.true;
+	});
+
+	it(`should serve avatar file if found`, async () => {
+		const request = { url: '/jon' };
+
+		const file = { uploadedAt: new Date(0), type: 'image/png', size: 100 };
+		mocks.avatarFindOneByUserId.returns(file);
+
+		await userAvatarById(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveAvatarFile.calledWith(file, request, response, next)).to.be.true;
+	});
+
+	it(`should write 304 to head if content is not modified`, async () => {
+		const request = { url: '/xyzabc', headers: {} };
+
+		mocks.utils.wasFallbackModified.returns(false);
+
+		await userAvatarById(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(response.writeHead.calledWith(304)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should write 404 if userId is not found`, async () => {
+		mocks.utils.wasFallbackModified.returns(true);
+		mocks.findOneById.returns(null);
+
+		const userId = 'awdasdaw';
+		const request = { url: `/${userId}`, headers: {} };
+
+		await userAvatarById(request, response, next);
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should fallback to SVG if no avatar found`, async () => {
+		const userId = '2apso9283';
+		const request = { url: `/${userId}`, headers: {} };
+
+		mocks.findOneById.returns({ username: 'jon' });
+		mocks.utils.wasFallbackModified.returns(true);
+
+		await userAvatarById(request, response, next);
+
+		expect(mocks.findOneById.calledWith(userId)).to.be.true;
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({ nameOrUsername: 'jon', req: request, res: response })).to.be.true;
+	});
+
+	it(`should fallback to SVG with user name if UI_Use_Name_Avatar is true`, async () => {
+		const userId = '2apso9283';
+		const request = { url: `/${userId}`, headers: {} };
+
+		mocks.findOneById.returns({ username: 'jon', name: 'Doe' });
+		mocks.utils.wasFallbackModified.returns(true);
+		mocks.settingsGet.withArgs('UI_Use_Name_Avatar').returns(true);
+
+		await userAvatarById(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(
+			mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({ nameOrUsername: 'Doe', req: request, res: response, useAllInitials: true }),
+		).to.be.true;
+	});
+});
+
+describe('#userAvatarByUsername()', () => {
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		mocks.settingsGet.reset();
+		mocks.avatarFindOneByName.reset();
+
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+
+		Object.values(mocks.utils).forEach((mock) => ('reset' in mock ? mock.reset() : mock.resetHistory()));
+	});
+
+	it(`should do nothing if url is not in request object`, async () => {
+		await userAvatarByUsername({}, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.called).to.be.false;
+		expect(response.end.called).to.be.false;
+	});
+
+	it(`should write 404 if username is not provided`, async () => {
+		await userAvatarByUsername({ url: '/' }, response, next);
+		expect(next.called).to.be.false;
+		expect(response.setHeader.called).to.be.false;
+		expect(response.writeHead.calledWith(404)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should call external provider`, async () => {
+		const request = { url: '/jon' };
+
+		const pipe = sinon.spy();
+		const mockResponseHeaders = new Headers();
+		mockResponseHeaders.set('header1', 'true');
+		mockResponseHeaders.set('header2', 'false');
+
+		mocks.serverFetch.returns({
+			headers: mockResponseHeaders,
+			body: { pipe },
+		});
+
+		mocks.settingsGet.returns('test123/{username}');
+
+		await userAvatarByUsername(request, response, next);
+
+		expect(mocks.serverFetch.calledWith('test123/jon')).to.be.true;
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(response.setHeader.calledTwice).to.be.true;
+		expect(response.setHeader.getCall(0).calledWith('header1', 'true')).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('header2', 'false')).to.be.true;
+		expect(pipe.calledWith(response)).to.be.true;
+	});
+
+	describe('should serve svg if requestUsername starts with @', () => {
+		it('should serve SVG and useAllInitials should be false', async () => {
+			const request = { url: '/@jon' };
+
+			mocks.settingsGet.returns(false);
+
+			await userAvatarByUsername(request, response, next);
+
+			expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+			expect(
+				mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({
+					nameOrUsername: 'jon',
+					req: request,
+					res: response,
+					useAllInitials: false,
+				}),
+			).to.be.true;
+		});
+
+		it('should serve SVG and useAllInitials should be true', async () => {
+			const request = { url: '/@baba yaga' };
+
+			mocks.settingsGet.withArgs('UI_Use_Name_Avatar').returns(true);
+
+			await userAvatarByUsername(request, response, next);
+
+			expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+			expect(
+				mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({
+					nameOrUsername: 'baba yaga',
+					req: request,
+					res: response,
+					useAllInitials: true,
+				}),
+			).to.be.true;
+		});
+	});
+
+	it(`should serve avatar file if found`, async () => {
+		const request = { url: '/jon' };
+
+		const file = { uploadedAt: new Date(0), type: 'image/png', size: 100 };
+		mocks.avatarFindOneByName.returns(file);
+
+		await userAvatarByUsername(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveAvatarFile.calledWith(file, request, response, next)).to.be.true;
+	});
+
+	it(`should write 304 to head if content is not modified`, async () => {
+		const request = { url: '/jon', headers: {} };
+
+		mocks.utils.wasFallbackModified.returns(false);
+		await userAvatarByUsername(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(response.writeHead.calledWith(304)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it(`should fallback to SVG if no avatar found`, async () => {
+		const request = { url: '/jon', headers: {} };
+
+		mocks.utils.wasFallbackModified.returns(true);
+		await userAvatarByUsername(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({ nameOrUsername: 'jon', req: request, res: response })).to.be.true;
+	});
+
+	it(`should fallback to SVG with user name if UI_Use_Name_Avatar is true`, async () => {
+		const request = { url: '/jon', headers: {} };
+
+		mocks.utils.wasFallbackModified.returns(true);
+		mocks.settingsGet.withArgs('UI_Use_Name_Avatar').returns(true);
+		mocks.findOneByUsernameIgnoringCase.returns({ name: 'Doe' });
+
+		await userAvatarByUsername(request, response, next);
+
+		expect(mocks.utils.setCacheAndDispositionHeaders.calledWith(request, response)).to.be.true;
+		expect(
+			mocks.utils.serveSvgAvatarInRequestedFormat.calledWith({ nameOrUsername: 'Doe', req: request, res: response, useAllInitials: true }),
+		).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/user.ts

@@ -0,0 +1,142 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import type { IUser } from '@rocket.chat/apps-engine/definition/users';
+import type { IIncomingMessage } from '@rocket.chat/core-typings';
+import { Avatars, Users } from '@rocket.chat/models';
+import { serverFetch as fetch } from '@rocket.chat/server-fetch';
+import type { NextFunction } from 'connect';
+
+import { serveSvgAvatarInRequestedFormat, wasFallbackModified, setCacheAndDispositionHeaders, serveAvatarFile } from './utils';
+import { settings } from '../../settings';
+
+const handleExternalProvider = async (externalProviderUrl: string, username: string, res: ServerResponse): Promise<void> => {
+	const response = await fetch(externalProviderUrl.replace('{username}', username), {
+		ignoreSsrfValidation: false,
+		allowList: settings.get<string>('SSRF_Allowlist'),
+	});
+	response.headers.forEach((value, key) => res.setHeader(key, value));
+	response.body.pipe(res);
+};
+// request /avatar/@name forces returning the svg
+export const userAvatarByUsername = async function (request: IncomingMessage, res: ServerResponse, next: NextFunction) {
+	const req = request as IIncomingMessage;
+
+	if (!req.url) {
+		return;
+	}
+
+	// replace removes the query string
+	const requestUsername = decodeURIComponent(req.url.slice(1).replace(/\?.*$/, ''));
+	if (!requestUsername) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	setCacheAndDispositionHeaders(req, res);
+
+	const externalProviderUrl = settings.get<string>('Accounts_AvatarExternalProviderUrl');
+	if (externalProviderUrl) {
+		void handleExternalProvider(externalProviderUrl, requestUsername, res);
+		return;
+	}
+
+	const file = await Avatars.findOneByName(requestUsername);
+	if (file) {
+		void serveAvatarFile(file, req, res, next);
+		return;
+	}
+
+	// if still not found and starts with @, return SVG with username without @
+	if (requestUsername[0] === '@') {
+		serveSvgAvatarInRequestedFormat({
+			nameOrUsername: requestUsername.slice(1),
+			req,
+			res,
+			useAllInitials: settings.get('UI_Use_Name_Avatar'),
+		});
+		return;
+	}
+
+	// if still using "letters fallback"
+	if (!wasFallbackModified(req.headers['if-modified-since'])) {
+		res.writeHead(304);
+		res.end();
+		return;
+	}
+
+	// Use real name for SVG letters
+	if (settings.get('UI_Use_Name_Avatar')) {
+		const user = await Users.findOneByUsernameIgnoringCase(requestUsername, {
+			projection: {
+				name: 1,
+			},
+		});
+
+		if (user?.name) {
+			serveSvgAvatarInRequestedFormat({ nameOrUsername: user.name, req, res, useAllInitials: true });
+			return;
+		}
+	}
+
+	serveSvgAvatarInRequestedFormat({ nameOrUsername: requestUsername, req, res });
+};
+
+export const userAvatarById = async function (request: IncomingMessage, res: ServerResponse, next: NextFunction) {
+	const req = request as IIncomingMessage;
+
+	if (!req.url) {
+		return;
+	}
+
+	// replace removes the query string
+	const requestUserId = decodeURIComponent(req.url.slice(1).replace(/\?.*$/, ''));
+	if (!requestUserId) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	setCacheAndDispositionHeaders(req, res);
+
+	const externalProviderUrl = settings.get<string>('Accounts_AvatarExternalProviderUrl');
+	if (externalProviderUrl) {
+		const user = await Users.findOneById<Pick<IUser, 'username'>>(requestUserId, { projection: { username: 1 } });
+
+		if (!user?.username) {
+			res.writeHead(404);
+			res.end();
+			return;
+		}
+
+		void handleExternalProvider(externalProviderUrl, user.username, res);
+		return;
+	}
+
+	const file = await Avatars.findOneByUserId(requestUserId);
+	if (file) {
+		void serveAvatarFile(file, req, res, next);
+		return;
+	}
+
+	if (!wasFallbackModified(req.headers['if-modified-since'])) {
+		res.writeHead(304);
+		res.end();
+		return;
+	}
+
+	const user = await Users.findOneById<Pick<IUser, 'name' | 'username'>>(requestUserId, { projection: { username: 1, name: 1 } });
+	if (!user?.username) {
+		res.writeHead(404);
+		res.end();
+		return;
+	}
+
+	// Use real name for SVG letters
+	if (settings.get('UI_Use_Name_Avatar') && user?.name) {
+		serveSvgAvatarInRequestedFormat({ nameOrUsername: user.name, req, res, useAllInitials: true });
+		return;
+	}
+
+	serveSvgAvatarInRequestedFormat({ nameOrUsername: user.username, req, res });
+};

apps/meteor/server/routes/avatar/utils.spec.ts

@@ -0,0 +1,252 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import proxyquire from 'proxyquire';
+import sinon from 'sinon';
+
+class CookiesMock {
+	public get = (_key: any, value: any) => value;
+}
+
+const mocks = {
+	settingsGet: sinon.stub(),
+	findOneByIdAndLoginToken: sinon.stub(),
+	fileUploadGet: sinon.spy(),
+};
+
+const {
+	getAvatarSizeFromRequest,
+	MIN_SVG_AVATAR_SIZE,
+	MAX_SVG_AVATAR_SIZE,
+	renderSVGLetters,
+	setCacheAndDispositionHeaders,
+	userCanAccessAvatar,
+	wasFallbackModified,
+	serveSvgAvatarInRequestedFormat,
+	serveAvatarFile,
+} = proxyquire.noCallThru().load('./utils', {
+	'meteor/ostrio:cookies': {
+		Cookies: CookiesMock,
+	},
+	'@rocket.chat/models': {
+		Users: {
+			findOneByIdAndLoginToken: mocks.findOneByIdAndLoginToken,
+		},
+	},
+	'../../lib/media/file-upload': {
+		FileUpload: {
+			get: mocks.fileUploadGet,
+		},
+	},
+	'../../settings': {
+		settings: {
+			get: mocks.settingsGet,
+		},
+	},
+	'sharp': () => ({ toFormat: (format: any) => ({ pipe: (res: any) => res.write(format) }) }),
+});
+
+describe('#serveAvatarFile()', () => {
+	const file = { uploadedAt: new Date(0), type: 'image/png', size: 100 };
+	const response = {
+		setHeader: sinon.spy(),
+		writeHead: sinon.spy(),
+		end: sinon.spy(),
+	};
+	const next = sinon.spy();
+
+	afterEach(() => {
+		response.setHeader.resetHistory();
+		response.writeHead.resetHistory();
+		response.end.resetHistory();
+		next.resetHistory();
+	});
+
+	it(`should return code 304 if avatar was not modified`, () => {
+		serveAvatarFile(file, { headers: { 'if-modified-since': new Date(0).toUTCString() } }, response, next);
+		expect(response.setHeader.getCall(0).calledWith('Content-Security-Policy', "default-src 'none'")).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('Last-Modified', new Date(0).toUTCString())).to.be.true;
+		expect(response.writeHead.calledWith(304)).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+
+	it('should serve avatar', () => {
+		const request = { headers: { 'if-modified-since': new Date(200000).toUTCString() } };
+		serveAvatarFile(file, request, response, next);
+		expect(response.setHeader.getCall(0).calledWith('Content-Security-Policy', "default-src 'none'")).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('Last-Modified', new Date(0).toUTCString())).to.be.true;
+		expect(response.setHeader.getCall(2).calledWith('Content-Type', file.type)).to.be.true;
+		expect(response.setHeader.getCall(3).calledWith('Content-Length', file.size)).to.be.true;
+		expect(mocks.fileUploadGet.calledWith(file, request, response, next)).to.be.true;
+	});
+});
+
+describe('#serveSvgAvatarInRequestedFormat()', () => {
+	it('should serve SVG avatar in requested format', () => {
+		['png', 'jpg', 'jpeg'].forEach((format) => {
+			const response = {
+				setHeader: sinon.spy(),
+				write: sinon.spy(),
+				end: sinon.spy(),
+			};
+			serveSvgAvatarInRequestedFormat({ req: { query: { format, size: 100 } }, res: response, nameOrUsername: 'name' });
+
+			expect(response.setHeader.getCall(0).calledWith('Last-Modified', 'Thu, 01 Jan 2015 00:00:00 GMT')).to.be.true;
+			expect(response.setHeader.getCall(1).calledWith('Content-Type', `image/${format}`)).to.be.true;
+			expect(response.write.calledWith(format)).to.be.true;
+		});
+	});
+	it(`should serve avatar in SVG format if requested format is not png, jpg or jpeg`, () => {
+		const response = {
+			setHeader: sinon.spy(),
+			write: sinon.spy(),
+			end: sinon.spy(),
+		};
+		serveSvgAvatarInRequestedFormat({ req: { query: { format: 'anythingElse', size: 100 } }, res: response, nameOrUsername: 'name' });
+
+		expect(response.setHeader.getCall(0).calledWith('Last-Modified', 'Thu, 01 Jan 2015 00:00:00 GMT')).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('Content-Type', 'image/svg+xml')).to.be.true;
+		expect(response.write.called).to.be.true;
+		expect(response.end.calledOnce).to.be.true;
+	});
+	it(`should default size to 200 if not provided in query`, () => {
+		const response = {
+			setHeader: sinon.spy(),
+			write: sinon.spy(),
+			end: sinon.spy(),
+		};
+		serveSvgAvatarInRequestedFormat({ req: { query: {} }, res: response, nameOrUsername: 'name' });
+
+		expect(response.setHeader.getCall(0).calledWith('Last-Modified', 'Thu, 01 Jan 2015 00:00:00 GMT')).to.be.true;
+		expect(response.setHeader.getCall(1).calledWith('Content-Type', 'image/svg+xml')).to.be.true;
+		expect(response.write.called).to.be.true;
+		expect(response.write.getCall(0).args[0]).to.include('viewBox="0 0 200 200"');
+		expect(response.end.calledOnce).to.be.true;
+	});
+});
+
+describe('#getAvatarSizeFromRequest()', () => {
+	it('should return undefined if size is not provided', () => {
+		expect(getAvatarSizeFromRequest({ query: {} })).to.equal(undefined);
+	});
+	it('should return value passed in the request if it falls in the range limit', () => {
+		expect(getAvatarSizeFromRequest({ query: { size: 100 } })).to.equal(100);
+	});
+	it(`should return ${MIN_SVG_AVATAR_SIZE} if requested size is smaller than the limit`, () => {
+		expect(getAvatarSizeFromRequest({ query: { size: 2 } })).to.equal(16);
+	});
+	it(`should return ${MAX_SVG_AVATAR_SIZE} if requested size is bigger than the limit`, () => {
+		expect(getAvatarSizeFromRequest({ query: { size: 2000 } })).to.equal(1024);
+	});
+});
+
+describe('#wasFallbackModified()', () => {
+	it('should return true if reqModifiedHeader is different from FALLBACK_LAST_MODIFIED', () => {
+		expect(wasFallbackModified('')).to.equal(true);
+	});
+	it('should false if reqModifiedHeader is the same as FALLBACK_LAST_MODIFIED', () => {
+		expect(wasFallbackModified('Thu, 01 Jan 2015 00:00:00 GMT')).to.equal(false);
+	});
+});
+
+describe('#renderSvgLetters', () => {
+	it('should show capitalized initial letter in the svg', () => {
+		expect(renderSVGLetters('arthur', 16)).to.include('>\nA\n</text>');
+		expect(renderSVGLetters('Bob', 16)).to.include('>\nB\n</text>');
+		expect(renderSVGLetters('yan', 16)).to.include('>\nY\n</text>');
+		expect(renderSVGLetters('山田 太郎', 16)).to.include('>\n山\n</text>');
+	});
+	it('should render question mark with color #000', () => {
+		expect(renderSVGLetters('?', 16)).to.include('>\n?\n</text>').and.to.include('fill="#000"');
+	});
+	it('should include size in viewBox property', () => {
+		expect(renderSVGLetters('arthur', 16)).to.include('viewBox="0 0 16 16"');
+		expect(renderSVGLetters('Bob', 32)).to.include('viewBox="0 0 32 32"');
+		expect(renderSVGLetters('yan', 64)).to.include('viewBox="0 0 64 64"');
+	});
+	it('should return a default size of 125 for a single letter', () => {
+		expect(renderSVGLetters('a', 200)).to.include('font-size="125"');
+	});
+	it('should render a single letter when useAllInitials is false', () => {
+		expect(renderSVGLetters('arthur', 16, false)).to.include('>\nA\n');
+	});
+	it('should render a single letter when useAllInitials is true but username has no spaces', () => {
+		expect(renderSVGLetters('arthur', 16, true)).to.include('>\nA\n');
+	});
+	it('should render more than one letter when useAllInitials is true', () => {
+		expect(renderSVGLetters('arthur void', 16, true)).to.include('>\nAV\n');
+		expect(renderSVGLetters('arthur void jackson', 16, true)).to.include('>\nAVJ\n');
+	});
+	it('should cap generated avatar to 3 letters at most', () => {
+		expect(renderSVGLetters('arthur void jackson billie', 16, true)).to.include('>\nAVJ\n');
+		expect(renderSVGLetters('arthur void jackson billie jean', 16, true)).to.include('>\nAVJ\n');
+	});
+	it('should decrease the font size when username has more than 1 word', () => {
+		expect(renderSVGLetters('arthur void', 200, true)).to.include('font-size="100"');
+	});
+	it('should decrease the font size when username has 3 words', () => {
+		expect(renderSVGLetters('this is three_words', 200, true)).to.include('font-size="80"');
+	});
+});
+
+describe('#setCacheAndDispositionHeaders', () => {
+	it('should set the Cache-Control header based on the query cacheTime', () => {
+		const request = {
+			query: {
+				cacheTime: 100,
+			},
+		};
+
+		const response = {
+			setHeader: sinon.spy(),
+		};
+		setCacheAndDispositionHeaders(request as any, response as any);
+		expect(response.setHeader.calledWith('Cache-Control', 'public, max-age=100')).to.be.true;
+		expect(response.setHeader.calledWith('Content-Disposition', 'inline')).to.be.true;
+	});
+
+	it('should set the Cache-Control header based on the setting if the query cacheTime is not set', () => {
+		const request = {
+			query: {},
+		};
+
+		const response = {
+			setHeader: sinon.spy(),
+		};
+
+		mocks.settingsGet.returns(100);
+		setCacheAndDispositionHeaders(request as any, response as any);
+		expect(response.setHeader.calledWith('Cache-Control', 'public, max-age=100')).to.be.true;
+		expect(response.setHeader.calledWith('Content-Disposition', 'inline')).to.be.true;
+	});
+});
+
+describe('#userCanAccessAvatar()', async () => {
+	beforeEach(() => {
+		mocks.findOneByIdAndLoginToken.reset();
+		mocks.settingsGet.reset();
+	});
+	it('should return true if setting is set to not block avatars', async () => {
+		await expect(userCanAccessAvatar({})).to.eventually.equal(true);
+	});
+	it('should return true if user is authenticated', async () => {
+		mocks.settingsGet.returns(true);
+		mocks.findOneByIdAndLoginToken.returns({ _id: 'id' });
+
+		await expect(userCanAccessAvatar({ query: { rc_token: 'token', rc_uid: 'id' } })).to.eventually.equal(true);
+		await expect(userCanAccessAvatar({ headers: { cookie: 'rc_token=token; rc_uid=id' } })).to.eventually.equal(true);
+	});
+	it('should return false and warn if user is unauthenticated', async () => {
+		console.warn = sinon.spy();
+		mocks.findOneByIdAndLoginToken.returns(undefined);
+		mocks.settingsGet.returns(true);
+
+		await expect(userCanAccessAvatar({})).to.eventually.equal(false);
+		expect((console.warn as sinon.SinonSpy).calledWith(sinon.match('unauthenticated'))).to.be.true;
+
+		await expect(userCanAccessAvatar({ headers: { cookie: 'rc_token=token; rc_uid=id' } })).to.eventually.equal(false);
+		expect((console.warn as sinon.SinonSpy).calledWith(sinon.match('unauthenticated'))).to.be.true;
+
+		await expect(userCanAccessAvatar({ query: { rc_token: 'token', rc_uid: 'id' } })).to.eventually.equal(false);
+		expect((console.warn as sinon.SinonSpy).calledWith(sinon.match('unauthenticated'))).to.be.true;
+	});
+});

apps/meteor/server/routes/avatar/utils.ts

@@ -0,0 +1,157 @@
+import type { ServerResponse } from 'node:http';
+
+import { hashLoginToken } from '@rocket.chat/account-utils';
+import type { IIncomingMessage, IUpload } from '@rocket.chat/core-typings';
+import { Users } from '@rocket.chat/models';
+import type { NextFunction } from 'connect';
+import { Cookies } from 'meteor/ostrio:cookies';
+import sanitizeHtml from 'sanitize-html';
+import sharp from 'sharp';
+import { throttle } from 'underscore';
+
+import { FileUpload } from '../../lib/media/file-upload';
+import { getAvatarColor } from '../../lib/utils/lib/getAvatarColor';
+import { settings } from '../../settings';
+
+const FALLBACK_LAST_MODIFIED = 'Thu, 01 Jan 2015 00:00:00 GMT';
+
+const cookie = new Cookies();
+
+export const MAX_SVG_AVATAR_SIZE = 1024;
+export const MIN_SVG_AVATAR_SIZE = 16;
+const MAX_SVG_AVATAR_INITIALS = 3;
+
+export const serveAvatarFile = (file: IUpload, req: IIncomingMessage, res: ServerResponse, next: NextFunction) => {
+	res.setHeader('Content-Security-Policy', "default-src 'none'");
+	const reqModifiedHeader = req.headers['if-modified-since'];
+
+	if (reqModifiedHeader && reqModifiedHeader === file.uploadedAt?.toUTCString()) {
+		res.setHeader('Last-Modified', reqModifiedHeader);
+		res.writeHead(304);
+		res.end();
+		return;
+	}
+
+	if (file.uploadedAt) {
+		res.setHeader('Last-Modified', file.uploadedAt?.toUTCString());
+	}
+
+	if (file.type) {
+		res.setHeader('Content-Type', file.type);
+	}
+
+	if (file.size) {
+		res.setHeader('Content-Length', file.size);
+	}
+
+	return FileUpload.get(file, req, res, next);
+};
+
+export const getAvatarSizeFromRequest = (req: IIncomingMessage) => {
+	const requestSize = req.query.size && parseInt(req.query.size);
+	if (!requestSize) {
+		return;
+	}
+	return Math.min(Math.max(requestSize, MIN_SVG_AVATAR_SIZE), MAX_SVG_AVATAR_SIZE);
+};
+export const serveSvgAvatarInRequestedFormat = ({
+	nameOrUsername,
+	req,
+	res,
+	useAllInitials = false,
+}: {
+	nameOrUsername: string;
+	req: IIncomingMessage;
+	res: ServerResponse;
+	useAllInitials?: boolean;
+}) => {
+	const size = getAvatarSizeFromRequest(req);
+	const avatar = renderSVGLetters(nameOrUsername, size, useAllInitials);
+	res.setHeader('Last-Modified', FALLBACK_LAST_MODIFIED);
+
+	const { format } = req.query;
+
+	if (['png', 'jpg', 'jpeg'].includes(format)) {
+		res.setHeader('Content-Type', `image/${format}`);
+		sharp(Buffer.from(avatar)).toFormat(format).pipe(res);
+		return;
+	}
+	res.setHeader('Content-Type', 'image/svg+xml');
+
+	res.write(avatar);
+	res.end();
+};
+
+export const wasFallbackModified = (reqModifiedHeader?: string) => {
+	if (!reqModifiedHeader || reqModifiedHeader !== FALLBACK_LAST_MODIFIED) {
+		return true;
+	}
+	return false;
+};
+
+async function isUserAuthenticated({ headers, query }: Pick<IIncomingMessage, 'headers' | 'query'>) {
+	let { rc_uid, rc_token } = query;
+
+	if (!rc_uid && headers.cookie) {
+		rc_uid = cookie.get('rc_uid', headers.cookie);
+		rc_token = cookie.get('rc_token', headers.cookie);
+	}
+
+	if (rc_uid == null || rc_token == null) {
+		return false;
+	}
+
+	const userFound = await Users.findOneByIdAndLoginToken(rc_uid, hashLoginToken(rc_token), { projection: { _id: 1 } }); // TODO memoize find
+
+	return !!userFound;
+}
+
+const warnUnauthenticatedAccess = throttle(() => {
+	console.warn('The server detected an unauthenticated access to an user avatar. This type of request will soon be blocked by default.');
+}, 60000 * 30); // 30 minutes
+
+export async function userCanAccessAvatar({ headers = {}, query = {} }: IIncomingMessage) {
+	if (!settings.get('Accounts_AvatarBlockUnauthenticatedAccess')) {
+		return true;
+	}
+
+	const isAuthenticated = await isUserAuthenticated({ headers, query });
+	if (!isAuthenticated) {
+		warnUnauthenticatedAccess();
+	}
+
+	return isAuthenticated;
+}
+
+const getFirstLetter = (name: string) => {
+	const sanitizedName = sanitizeHtml(name);
+	return sanitizedName.substring(0, 1).toUpperCase();
+};
+
+const getInitials = (name: string) => name.split(' ').slice(0, MAX_SVG_AVATAR_INITIALS).map(getFirstLetter).join('');
+
+export const renderSVGLetters = (name: string, viewSize = 200, useAllInitials = false) => {
+	let color = '';
+	let initials = '';
+
+	if (name === '?') {
+		color = '#000';
+		initials = name;
+	} else {
+		color = getAvatarColor(name);
+		initials = !useAllInitials ? getFirstLetter(name) : getInitials(name);
+	}
+
+	const reductionFactor = initials.length > 1 ? Math.pow(initials.length, 2) / 10 : 0;
+	const fontSize = viewSize / (1.6 + reductionFactor);
+
+	return `<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 ${viewSize} ${viewSize}\">\n<rect width=\"100%\" height=\"100%\" fill=\"${color}\"/>\n<text x=\"50%\" y=\"50%\" dy=\"0.36em\" text-anchor=\"middle\" pointer-events=\"none\" fill=\"#ffffff\" font-family=\"'Helvetica', 'Arial', 'Lucida Grande', 'sans-serif'\" font-size="${fontSize}">\n${initials}\n</text>\n</svg>`;
+};
+
+const getCacheTime = (cacheTime: number) => cacheTime || settings.get('Accounts_AvatarCacheTime');
+
+export function setCacheAndDispositionHeaders(req: IIncomingMessage, res: ServerResponse) {
+	const cacheTime = getCacheTime(req.query.cacheTime);
+	res.setHeader('Cache-Control', `public, max-age=${cacheTime}`);
+	res.setHeader('Content-Disposition', 'inline');
+}

apps/meteor/server/routes/fileDecrypt.ts

@@ -0,0 +1,7 @@
+import { WebApp } from 'meteor/webapp';
+
+WebApp.connectHandlers.use('/file-decrypt/', (_, res) => {
+	// returns 404
+	res.writeHead(404);
+	res.end('Not found');
+});

apps/meteor/server/routes/health.ts

@@ -0,0 +1,151 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import { monitorEventLoopDelay } from 'node:perf_hooks';
+import { getHeapStatistics } from 'node:v8';
+
+import { MongoInternals } from 'meteor/mongo';
+import { WebApp } from 'meteor/webapp';
+
+import { SystemLogger } from '../lib/logger/system';
+
+const { mongo } = MongoInternals.defaultRemoteCollectionDriver();
+
+export function pingMongo() {
+	return mongo.db.command({ ping: 1 });
+}
+
+function setDefaultHeaders(res: ServerResponse) {
+	// Set headers to prevent any caching of the health check response.
+	res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+	res.setHeader('Pragma', 'no-cache');
+	res.setHeader('Expires', '0');
+	res.setHeader('Content-Type', 'application/json');
+}
+
+/**
+ * DEPRECATED Liveness Probe (`/health`)
+ * Maintained for backward compatibility. Behaves like a simple liveness probe.
+ * @deprecated Update infrastructure to use /livez and /readyz.
+ */
+WebApp.rawHandlers.use('/health', (_req: IncomingMessage, res: ServerResponse) => {
+	setDefaultHeaders(res);
+
+	res.writeHead(200);
+	res.end(JSON.stringify({ status: 'ok' }));
+});
+
+/**
+ * Readiness Probe Configuration
+ * Defines tunable thresholds for readiness checks.
+ */
+
+const eventLoopHistogramLiveness = monitorEventLoopDelay();
+eventLoopHistogramLiveness.enable();
+
+const eventLoopHistogramReadiness = monitorEventLoopDelay();
+eventLoopHistogramReadiness.enable();
+
+const READINESS_THRESHOLDS = {
+	EVENT_LOOP_LAG_MS: Number.parseFloat(process.env.EVENT_LOOP_LAG_MS ?? '') || 70,
+	HEAP_USAGE_PERCENT: Number.parseFloat(process.env.HEAP_USAGE_PERCENT ?? '') || 0.85, // 85%
+} as const;
+
+/**
+ * Checks event loop lag using the provided histogram. Can optionally reset the histogram after reading.
+ * @param histogram - The event loop histogram to use.
+ * @returns The status and p99 lag.
+ */
+function checkEventLoopLag(histogram: ReturnType<typeof monitorEventLoopDelay>) {
+	const lagInNs = histogram.percentile(99);
+	const lagInMs = lagInNs / 1_000_000;
+
+	histogram.reset();
+
+	const lagValue = Number.parseFloat(lagInMs.toFixed(2));
+
+	if (lagInMs > READINESS_THRESHOLDS.EVENT_LOOP_LAG_MS) {
+		return { status: 'degraded', lagMs: lagValue };
+	}
+	return { status: 'ok', lagMs: lagValue };
+}
+
+/**
+ * Checks heap memory usage against a configured threshold.
+ * @returns The status and memory usage percentage.
+ */
+function checkMemoryUsage() {
+	const { heap_size_limit, used_heap_size } = getHeapStatistics();
+	const usageRatio = used_heap_size / heap_size_limit;
+	const usageValue = Number.parseFloat((usageRatio * 100).toFixed(2));
+
+	if (usageRatio > READINESS_THRESHOLDS.HEAP_USAGE_PERCENT) {
+		return { status: 'degraded', percentile: usageValue };
+	}
+	return { status: 'ok', percentile: usageValue };
+}
+
+async function checkMongo() {
+	try {
+		await pingMongo();
+		return { status: 'ok' };
+	} catch (err) {
+		return { status: 'degraded', error: err instanceof Error ? err.message : String(err) };
+	}
+}
+
+/**
+ * Performs the core health checks (memory, event loop) and returns the result.
+ * @param shouldResetHistogram - Controls whether the event loop histogram is reset.
+ */
+async function performHealthChecks(histogram: ReturnType<typeof monitorEventLoopDelay>) {
+	const checks = {
+		memory: checkMemoryUsage(),
+		eventLoop: checkEventLoopLag(histogram),
+		mongo: await checkMongo(),
+	};
+
+	const isHealthy = checks.memory.status === 'ok' && checks.eventLoop.status === 'ok' && checks.mongo.status === 'ok';
+	const statusCode = isHealthy ? 200 : 503;
+
+	const body = {
+		status: isHealthy ? 'ok' : 'unavailable',
+		checks,
+	};
+
+	return { statusCode, body, isHealthy };
+}
+
+/**
+ * Liveness Probe (`/livez`)
+ * Performs a non-destructive health check. A failure here indicates a pod is
+ * unrecoverable and should be restarted.
+ */
+WebApp.rawHandlers.use('/livez', async (_req: IncomingMessage, res: ServerResponse) => {
+	const { statusCode, body, isHealthy } = await performHealthChecks(eventLoopHistogramLiveness);
+
+	if (!isHealthy) {
+		SystemLogger.error({ msg: 'Liveness check failed', details: body });
+	}
+
+	setDefaultHeaders(res);
+
+	res.writeHead(statusCode);
+	res.end(JSON.stringify(body));
+});
+
+/**
+ * Readiness Probe Endpoint (`/readyz`)
+ * Performs a destructive health check, resetting the histogram for the next interval.
+ * A failure tells the orchestrator to stop sending traffic to this instance.
+ */
+WebApp.rawHandlers.use('/readyz', async (_req: IncomingMessage, res: ServerResponse) => {
+	const { statusCode, body, isHealthy } = await performHealthChecks(eventLoopHistogramReadiness);
+
+	if (!isHealthy) {
+		SystemLogger.warn({ msg: 'Readiness check failed', details: body });
+	}
+
+	setDefaultHeaders(res);
+
+	res.writeHead(statusCode);
+	res.end(JSON.stringify(body));
+});

apps/meteor/server/routes/i18n.ts

@@ -0,0 +1,37 @@
+import type { ServerResponse } from 'node:http';
+
+import type { IncomingMessage } from 'connect';
+import { WebApp } from 'meteor/webapp';
+import { match } from 'path-to-regexp';
+
+const matchRoute = match<{ lng: string }>('/:lng.json', { decode: decodeURIComponent });
+
+const i18nHandler = async function (req: IncomingMessage, res: ServerResponse) {
+	const url = new URL(req.url ?? '/', `https://${req.headers.host}`);
+	const match = matchRoute(url.pathname);
+
+	if (match === false) {
+		res.writeHead(400);
+		res.end();
+		return;
+	}
+
+	const { lng } = match.params;
+
+	try {
+		const data = await Assets.getTextAsync(`i18n/${lng}.i18n.json`);
+		if (!data) {
+			throw new Error();
+		}
+
+		res.setHeader('Content-Type', 'application/json');
+		res.setHeader('Content-Length', data.length);
+		res.writeHead(200);
+		res.end(data);
+	} catch (e) {
+		res.writeHead(400);
+		res.end();
+	}
+};
+
+WebApp.connectHandlers.use('/i18n/', i18nHandler);

apps/meteor/server/routes/index.ts

@@ -0,0 +1,6 @@
+import './avatar';
+import './health';
+import './i18n';
+import './timesync';
+import './fileDecrypt';
+import './userDataDownload';

apps/meteor/server/routes/timesync.ts

@@ -0,0 +1,18 @@
+import { WebApp } from 'meteor/webapp';
+// Use rawConnectHandlers so we get a response as quickly as possible
+// https://github.com/meteor/meteor/blob/devel/packages/webapp/webapp_server.js
+
+const syncUrl = `${(global as any)?.ROOT_URL_PATH_PREFIX || ''}/_timesync`;
+
+WebApp.rawConnectHandlers.use(syncUrl, (_req, res) => {
+	// Never ever cache this, otherwise weird times are shown on reload
+	// http://stackoverflow.com/q/18811286/586086
+	res.setHeader('Cache-Control', 'no-cache, no-store, must-revalidate');
+	res.setHeader('Pragma', 'no-cache');
+	res.setHeader('Expires', 0);
+
+	// Avoid MIME type warnings in browsers
+	res.setHeader('Content-Type', 'text/plain');
+
+	res.end(Date.now().toString());
+});

apps/meteor/server/routes/userDataDownload.ts

@@ -0,0 +1,88 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+
+import { hashLoginToken } from '@rocket.chat/account-utils';
+import type { IIncomingMessage, IUser, IUserDataFile } from '@rocket.chat/core-typings';
+import { UserDataFiles, Users } from '@rocket.chat/models';
+import { Cookies } from 'meteor/ostrio:cookies';
+import { WebApp } from 'meteor/webapp';
+import { match } from 'path-to-regexp';
+
+import { FileUpload } from '../lib/media/file-upload';
+import { settings } from '../settings';
+
+const cookies = new Cookies();
+
+const matchUID = async (uid: string | undefined, token: string | undefined, ownerUID: string) => {
+	return (
+		uid &&
+		token &&
+		uid === ownerUID &&
+		Boolean(await Users.findOneByIdAndLoginToken(uid, hashLoginToken(token), { projection: { _id: 1 } }))
+	);
+};
+
+const isRequestFromOwner = async (req: IIncomingMessage, ownerUID: IUser['_id']) => {
+	if (await matchUID(req.query.rc_uid, req.query.rc_token, ownerUID)) {
+		return true;
+	}
+
+	if (
+		req.headers.cookie &&
+		(await matchUID(cookies.get('rc_uid', req.headers.cookie), cookies.get('rc_token', req.headers.cookie), ownerUID))
+	) {
+		return true;
+	}
+
+	for await (const uid of [req.headers['x-user-id']].flat()) {
+		for await (const token of [req.headers['x-auth-token']].flat()) {
+			if (await matchUID(uid, token, ownerUID)) {
+				return true;
+			}
+		}
+	}
+
+	return false;
+};
+
+const sendUserDataFile = (file: IUserDataFile) => (req: IncomingMessage, res: ServerResponse, next: () => void) => {
+	const userDataStore = FileUpload.getStore('UserDataFiles');
+	if (!userDataStore?.get) {
+		res.writeHead(403).end(); // @todo: maybe we should return a better error?
+		return;
+	}
+
+	res.setHeader('Content-Security-Policy', "default-src 'none'");
+	res.setHeader('Cache-Control', 'max-age=31536000');
+	void userDataStore.get(file, req, res, next);
+};
+
+const matchFileRoute = match<{ fileID: string }>('/:fileID', { decode: decodeURIComponent });
+
+const userDataDownloadHandler = async (req: IncomingMessage, res: ServerResponse, next: () => void) => {
+	const downloadEnabled = settings.get<boolean>('UserData_EnableDownload');
+	if (!downloadEnabled) {
+		res.writeHead(403).end();
+		return;
+	}
+
+	const match = matchFileRoute(req.url ?? '/');
+	if (match === false) {
+		res.writeHead(404).end();
+		return;
+	}
+
+	const file = await UserDataFiles.findOneById(match.params.fileID);
+	if (!file) {
+		res.writeHead(404).end();
+		return;
+	}
+
+	if (!file.userId || !(await isRequestFromOwner(req as IIncomingMessage, file.userId))) {
+		res.writeHead(403).end();
+		return;
+	}
+
+	sendUserDataFile(file)(req, res, next);
+};
+
+WebApp.connectHandlers.use('/data-export/', userDataDownloadHandler);