snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/server/services/statusVisibility/service.spec.ts

@@ -0,0 +1,156 @@
+import { StatusVisibilityService } from './service';
+
+const getSetting = jest.fn();
+const broadcast = jest.fn();
+const findPresenceUsersByIds = jest.fn();
+const findWithStatusVisibilityConfig = jest.fn();
+
+jest.mock('@rocket.chat/core-services', () => ({
+	api: { broadcast: (...args: unknown[]) => broadcast(...args) },
+	Settings: { get: (key: string) => getSetting(key) },
+	ServiceClassInternal: class {
+		onSettingChanged() {
+			// no-op
+		}
+	},
+}));
+jest.mock('@rocket.chat/models', () => ({
+	Users: {
+		findPresenceUsersByIds: (...args: unknown[]) => findPresenceUsersByIds(...args),
+		findWithStatusVisibilityConfig: (...args: unknown[]) => findWithStatusVisibilityConfig(...args),
+	},
+}));
+
+const cursor = (users: object[]) => ({ toArray: async () => users });
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+const blocking = (id: string, blocked: string[]) => ({ _id: id, settings: { preferences: { statusVisibilityDenied: blocked } } });
+
+describe('status visibility service', () => {
+	let service: StatusVisibilityService;
+
+	beforeEach(async () => {
+		jest.resetAllMocks();
+		getSetting.mockReturnValue(true);
+		broadcast.mockResolvedValue(undefined);
+		findPresenceUsersByIds.mockReturnValue(cursor([]));
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([]));
+		service = new StatusVisibilityService();
+		await service.refresh();
+	});
+
+	it('hides a target from the viewers they blocked, and only from them', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh();
+
+		expect(await service.getHiddenFrom('bruno')).toEqual(['ana']);
+		expect(await service.getHiddenFrom('carla')).toEqual([]);
+	});
+
+	it('never hides a target from themselves nor from an anonymous viewer', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['ana', 'bruno'])]));
+		await service.refresh();
+
+		expect(await service.getHiddenFrom('ana')).toEqual([]);
+		expect(await service.getHiddenFrom(null)).toEqual([]);
+	});
+
+	it('drops an entry when a targeted refresh finds the block list gone', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh(['ana']);
+		expect(await service.getHiddenFrom('bruno')).toEqual(['ana']);
+
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([]));
+		findPresenceUsersByIds.mockReturnValue(cursor([{ _id: 'ana' }]));
+		const affected = await service.refresh(['ana']);
+
+		expect(await service.getHiddenFrom('bruno')).toEqual([]);
+		expect(affected.map(({ _id }) => _id)).toEqual(['ana']);
+	});
+
+	it('flags users with an active block list, only while the feature is on', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh();
+
+		expect(await service.hasRestrictions('ana')).toBe(true);
+		expect(await service.hasRestrictions('carla')).toBe(false);
+
+		getSetting.mockReturnValue(false);
+		await service.refresh();
+
+		expect(await service.hasRestrictions('ana')).toBe(false);
+	});
+
+	it('reports the viewers on both sides of a block list change', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh();
+
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['carla'])]));
+		await service.invalidate(['ana']);
+
+		const [, payload] = broadcast.mock.calls.at(-1) as [string, { viewers?: string[] }];
+
+		expect(payload.viewers?.sort()).toEqual(['bruno', 'carla']);
+	});
+
+	it('leaves the viewers unscoped when the whole mirror is invalidated', async () => {
+		await service.invalidate();
+
+		const [, payload] = broadcast.mock.calls.at(-1) as [string, { viewers?: string[] }];
+
+		expect(payload.viewers).toBeUndefined();
+	});
+
+	it('clears everything when the setting is off and reports who became visible', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh();
+
+		getSetting.mockReturnValue(false);
+		findPresenceUsersByIds.mockReturnValue(cursor([{ _id: 'ana' }]));
+		const affected = await service.refresh();
+
+		expect(affected.map(({ _id }) => _id)).toEqual(['ana']);
+		expect(await service.getHiddenFrom('bruno')).toEqual([]);
+	});
+
+	it('reports every user whose visibility may have changed, configured before or after', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno'])]));
+		await service.refresh();
+
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('carla', ['bruno'])]));
+		findPresenceUsersByIds.mockReturnValue(cursor([{ _id: 'ana' }]));
+		const affected = await service.refresh();
+
+		expect(affected.map(({ _id }) => _id).sort()).toEqual(['ana', 'carla']);
+	});
+
+	it('applies overlapping refreshes in order, so an older read never wins', async () => {
+		const reads: Array<(users: object[]) => void> = [];
+		findWithStatusVisibilityConfig.mockImplementation(() => ({
+			toArray: () => new Promise((resolve) => reads.push(resolve as (users: object[]) => void)),
+		}));
+
+		const stale = service.refresh();
+		const fresh = service.refresh(['ana']);
+
+		await flush();
+		expect(reads).toHaveLength(1);
+		reads[0]([]);
+		await stale;
+
+		await flush();
+		expect(reads).toHaveLength(2);
+		reads[1]([blocking('ana', ['bruno'])]);
+		await fresh;
+
+		expect(await service.getHiddenFrom('bruno')).toEqual(['ana']);
+	});
+
+	it('lists who hid their status from a given viewer', async () => {
+		findWithStatusVisibilityConfig.mockReturnValue(cursor([blocking('ana', ['bruno']), blocking('carla', ['bruno', 'diego'])]));
+		await service.refresh();
+
+		expect((await service.getHiddenFrom('bruno')).sort()).toEqual(['ana', 'carla']);
+		expect(await service.getHiddenFrom('diego')).toEqual(['carla']);
+		expect(await service.getHiddenFrom('elena')).toEqual([]);
+	});
+});

apps/meteor/server/services/statusVisibility/service.ts

@@ -0,0 +1,113 @@
+import type { IStatusVisibilityService } from '@rocket.chat/core-services';
+import { api, ServiceClassInternal, Settings } from '@rocket.chat/core-services';
+import type { IUser, UserPresence } from '@rocket.chat/core-typings';
+import { Logger } from '@rocket.chat/logger';
+import { Users } from '@rocket.chat/models';
+
+const logger = new Logger('StatusVisibility');
+
+const PRESENCE_FIELDS = { username: 1, status: 1, statusText: 1, statusSource: 1, statusExpiresAt: 1 } as const;
+
+export class StatusVisibilityService extends ServiceClassInternal implements IStatusVisibilityService {
+	protected name = 'status-visibility';
+
+	private enabled = false;
+
+	private hiddenFromByUser = new Map<IUser['_id'], Set<IUser['_id']>>();
+
+	private lock: Promise<unknown> = Promise.resolve();
+
+	constructor() {
+		super();
+
+		this.onSettingChanged('Accounts_StatusVisibility_Enabled', async () => {
+			await this.invalidate();
+		});
+	}
+
+	override async started(): Promise<void> {
+		await this.refresh();
+	}
+
+	async getHiddenFrom(viewerId: IUser['_id'] | null | undefined): Promise<IUser['_id'][]> {
+		if (!this.enabled || !viewerId) {
+			return [];
+		}
+
+		return [...this.hiddenFromByUser]
+			.filter(([targetId, viewers]) => targetId !== viewerId && viewers.has(viewerId))
+			.map(([targetId]) => targetId);
+	}
+
+	async hasRestrictions(targetId: IUser['_id']): Promise<boolean> {
+		return this.enabled && this.hiddenFromByUser.has(targetId);
+	}
+
+	async getRestrictedUsers(): Promise<IUser['_id'][]> {
+		return [...this.hiddenFromByUser.keys()];
+	}
+
+	async refresh(targets?: IUser['_id'][]): Promise<UserPresence[]> {
+		const result = this.lock.then(() => this.rebuildHiddenUsers(targets));
+		this.lock = result.catch(() => undefined);
+		return result;
+	}
+
+	private async rebuildHiddenUsers(targets?: IUser['_id'][]): Promise<UserPresence[]> {
+		this.enabled = (await Settings.get<boolean>('Accounts_StatusVisibility_Enabled')) === true;
+
+		if (!this.enabled) {
+			const previous = [...this.hiddenFromByUser.keys()];
+			this.hiddenFromByUser.clear();
+			return previous.length ? Users.findPresenceUsersByIds(previous, { projection: PRESENCE_FIELDS }).toArray() : [];
+		}
+
+		const previous = targets ?? [...this.hiddenFromByUser.keys()];
+
+		const users = await Users.findWithStatusVisibilityConfig(targets).toArray();
+
+		if (targets) {
+			targets.forEach((uid) => this.hiddenFromByUser.delete(uid));
+		} else {
+			this.hiddenFromByUser.clear();
+		}
+
+		for (const { _id, settings: userSettings } of users) {
+			const viewers = userSettings?.preferences?.statusVisibilityDenied;
+
+			if (viewers?.length) {
+				this.hiddenFromByUser.set(_id, new Set(viewers));
+			}
+		}
+
+		const dropped = previous.filter((uid) => !this.hiddenFromByUser.has(uid));
+
+		if (dropped.length) {
+			users.push(...(await Users.findPresenceUsersByIds(dropped, { projection: PRESENCE_FIELDS }).toArray()));
+		}
+
+		return users;
+	}
+
+	private viewersOf(targets: IUser['_id'][]): IUser['_id'][] {
+		const viewers = new Set<IUser['_id']>();
+
+		for (const target of targets) {
+			this.hiddenFromByUser.get(target)?.forEach((viewer) => viewers.add(viewer));
+		}
+
+		return [...viewers];
+	}
+
+	async invalidate(targets?: IUser['_id'][]): Promise<UserPresence[]> {
+		const previousViewers = targets && this.viewersOf(targets);
+		const affected = await this.refresh(targets);
+		const viewers = previousViewers && [...new Set([...previousViewers, ...this.viewersOf(targets)])];
+
+		void api
+			.broadcast('presence.invalidateVisibility', { targets, viewers })
+			.catch((err) => logger.error({ msg: 'Status visibility invalidation failed', err, targets }));
+
+		return affected;
+	}
+}