snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/tests/unit/server/api/canBypassRateLimit.spec.ts

@@ -0,0 +1,40 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import mock from 'proxyquire';
+
+const userPermissions: Record<string, string[]> = {
+	bot: ['api-bypass-rate-limit', 'send-many-messages'],
+	legacyBot: ['send-many-messages'],
+	regular: [],
+};
+
+const mocks = {
+	'../lib/authorization/hasPermission': {
+		hasAtLeastOnePermissionAsync: async (userId: string, permissions: string[]): Promise<boolean> =>
+			permissions.some((permission) => userPermissions[userId].includes(permission)),
+	},
+	'../lib/deprecationWarningLogger': {
+		apiDeprecationLogger: { endpoint: () => undefined },
+	},
+};
+
+const { canBypassRateLimit } = mock.noCallThru().load('../../../../server/api/api.helpers', mocks);
+
+describe('canBypassRateLimit', () => {
+	it('should let a user holding api-bypass-rate-limit through on any route', async () => {
+		expect(await canBypassRateLimit('bot')).to.be.true;
+	});
+
+	it('should not let a regular user through', async () => {
+		expect(await canBypassRateLimit('regular')).to.be.false;
+		expect(await canBypassRateLimit('regular', ['send-many-messages'])).to.be.false;
+	});
+
+	it('should let a user holding a route specific permission through', async () => {
+		expect(await canBypassRateLimit('legacyBot', ['send-many-messages'])).to.be.true;
+	});
+
+	it('should not let a route specific permission apply to routes that do not declare it', async () => {
+		expect(await canBypassRateLimit('legacyBot')).to.be.false;
+	});
+});

apps/meteor/tests/unit/server/api/checkPermissions.spec.ts

@@ -0,0 +1,107 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import mock from 'proxyquire';
+import Sinon from 'sinon';
+
+import type { PermissionsPayload } from '../../../../server/api/api.helpers';
+
+const mocks = {
+	'../lib/deprecationWarningLogger': {
+		apiDeprecationLogger: {
+			endpoint: Sinon.stub(),
+		},
+	},
+};
+const { checkPermissions } = mock.noCallThru().load('../../../../server/api/api.helpers', mocks);
+
+describe('checkPermissions', () => {
+	it('should return false when no options.permissionsRequired key is present', () => {
+		const options = {};
+		expect(checkPermissions(options)).to.be.false;
+	});
+	it('should return false when options.permissionsRequired is of an invalid format', () => {
+		const options = {
+			permissionsRequired: 'invalid',
+		};
+		expect(checkPermissions(options)).to.be.false;
+	});
+	it('should return true and modify options.permissionsRequired when permissionsRequired key is an array (of permissions)', () => {
+		const options = {
+			permissionsRequired: ['invalid', 'invalid2'],
+		};
+		expect(checkPermissions(options)).to.be.true;
+		expect(options.permissionsRequired).to.be.an('object');
+		expect(options.permissionsRequired).to.have.property('*');
+		// @ts-expect-error -for test purposes :)
+		expect(options.permissionsRequired['*']).to.be.an('object');
+		// @ts-expect-error -for test purposes :)
+		expect(options.permissionsRequired['*'].permissions).to.be.an('array').that.includes('invalid');
+	});
+	it('should return true and modify options.permissionsRequired when permissionsRequired key is an object (of permissions)', () => {
+		const options = {
+			permissionsRequired: {
+				GET: ['invalid', 'invalid2'],
+			},
+		};
+		expect(checkPermissions(options)).to.be.true;
+		expect(options.permissionsRequired).to.be.an('object');
+		expect(options.permissionsRequired).to.have.property('GET');
+		expect(options.permissionsRequired.GET).to.be.an('object');
+		expect(options.permissionsRequired.GET).to.have.property('operation', 'hasAll');
+		expect(options.permissionsRequired.GET).to.have.property('permissions').that.is.an('array').that.includes('invalid');
+	});
+	it('should return true and not modify options.permissionsRequired when its of new format', () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAll',
+					permissions: ['invalid', 'invalid2'],
+				},
+			},
+		};
+		expect(checkPermissions(options)).to.be.true;
+		expect(options.permissionsRequired).to.be.an('object');
+		expect(options.permissionsRequired).to.have.property('GET');
+		expect(options.permissionsRequired.GET).to.be.an('object');
+		expect(options.permissionsRequired.GET).to.have.property('operation', 'hasAll');
+		expect(options.permissionsRequired.GET).to.have.property('permissions').that.is.an('array').that.includes('invalid');
+	});
+
+	it('should persist the right operation for method', () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAny',
+					permissions: ['invalid', 'invalid2'],
+				},
+			},
+		};
+		expect(checkPermissions(options)).to.be.true;
+		expect(options.permissionsRequired).to.be.an('object');
+		expect(options.permissionsRequired).to.have.property('GET');
+		expect(options.permissionsRequired.GET).to.be.an('object');
+		expect(options.permissionsRequired.GET).to.have.property('operation', 'hasAny');
+		expect(options.permissionsRequired.GET).to.have.property('permissions').that.is.an('array').that.includes('invalid');
+	});
+	it('should persist the right method keys', () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAll',
+					permissions: ['invalid', 'invalid2'],
+				},
+				POST: {
+					operation: 'hasAll',
+					permissions: ['invalid', 'invalid2'],
+				},
+			},
+		};
+		expect(checkPermissions(options)).to.be.true;
+		expect(options.permissionsRequired).to.be.an('object');
+		expect(options.permissionsRequired).to.have.property('GET');
+		expect(options.permissionsRequired).to.have.property('POST');
+		expect(options.permissionsRequired.GET).to.be.an('object');
+		expect(options.permissionsRequired.GET).to.have.property('operation', 'hasAll');
+		expect(options.permissionsRequired.GET).to.have.property('permissions').that.is.an('array').that.includes('invalid');
+	});
+});

apps/meteor/tests/unit/server/api/checkPermissionsForInvocation.spec.ts

@@ -0,0 +1,126 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+import mock from 'proxyquire';
+import Sinon from 'sinon';
+
+import type { PermissionsPayload } from '../../../../server/api/api.helpers';
+
+const userPermissions: { [k: string]: string[] } = {
+	'4r3fsadfasf': ['view-all', 'view-none'],
+	'4r3fsadfasf2': ['view-all', 'view-0'],
+	'4r3fsadfasf3': ['view-all', 'view-1'],
+	'4r3fsadfasf4': [],
+};
+
+const mocks = {
+	'../lib/authorization/hasPermission': {
+		hasAllPermissionAsync: (userId: string, permissions: string[]): boolean => {
+			return permissions.every((permission) => userPermissions[userId].includes(permission));
+		},
+		hasAtLeastOnePermissionAsync: (userId: string, permissions: string[]): boolean => {
+			return permissions.some((permission) => userPermissions[userId].includes(permission));
+		},
+	},
+	'../lib/deprecationWarningLogger': {
+		apiDeprecationLogger: {
+			endpoint: Sinon.stub(),
+		},
+	},
+};
+
+const { checkPermissionsForInvocation } = mock.noCallThru().load('../../../../server/api/api.helpers', mocks);
+
+describe('checkPermissionsForInvocation', () => {
+	it('should return false when no permissions are provided', async () => {
+		const options = {
+			permissionsRequired: {},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'GET')).to.be.false;
+	});
+
+	it('should return false when no config is provided for that specific method', async () => {
+		const options = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAll',
+					permissions: ['view-all', 'view-none'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'POST')).to.be.false;
+	});
+
+	it('should return true path is configured with empty permissions array', async () => {
+		const options = {
+			permissionsRequired: {
+				GET: { permissions: [], operation: 'hasAll' },
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'GET')).to.be.true;
+	});
+
+	it('should return true when user has all permissions', async () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAll',
+					permissions: ['view-all', 'view-none'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'GET')).to.be.true;
+	});
+
+	it('should read permissions config from * when request method provided doesnt have config', async () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				'GET': {
+					operation: 'hasAll',
+					permissions: ['view-all', 'view-none'],
+				},
+				'*': {
+					operation: 'hasAll',
+					permissions: ['view-all', 'view-none'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'PUT')).to.be.true;
+	});
+
+	it('should return false when user has no permissions', async () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAll',
+					permissions: ['view-all', 'view-none'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf4', options.permissionsRequired, 'GET')).to.be.false;
+	});
+
+	it('should return false when operation is invalid', async () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					// @ts-expect-error - for testing purposes
+					operation: 'invalid',
+					permissions: ['view-all', 'view-none'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'GET')).to.be.false;
+	});
+
+	it('should return true when operation is hasAny and user has at least one listed permission', async () => {
+		const options: { permissionsRequired: PermissionsPayload } = {
+			permissionsRequired: {
+				GET: {
+					operation: 'hasAny',
+					permissions: ['view-all', 'admin'],
+				},
+			},
+		};
+		expect(await checkPermissionsForInvocation('4r3fsadfasf', options.permissionsRequired, 'GET')).to.be.true;
+	});
+});

apps/meteor/tests/unit/server/api/lib/isValidQuery.spec.ts

@@ -0,0 +1,226 @@
+import { expect } from 'chai';
+import { describe, it } from 'mocha';
+
+import { isValidQuery } from '../../../../../server/api/lib/isValidQuery';
+
+describe('isValidQuery', () => {
+	describe('shallow keys', () => {
+		it('should return false if the query contains an operation that is not in the props array', () => {
+			const props = ['_id', 'name'];
+			const query = {
+				$or: [
+					{
+						_id: '123',
+					},
+					{
+						name: '456',
+					},
+				],
+			};
+			expect(isValidQuery(query, props, [])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+
+		it('should return true if the query contains operation and the attributes are set in the props array ', () => {
+			const props = ['_id', 'name'];
+			const query = {
+				$or: [
+					{
+						_id: '123',
+					},
+					{
+						name: '456',
+					},
+				],
+			};
+			expect(isValidQuery(query, props, ['$or'])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+
+		it('should return false if the query contains operations allowed but some attributes are not set in the props array ', () => {
+			const props = ['name'];
+			const query = {
+				$or: [
+					{
+						_id: '123',
+					},
+					{
+						name: '456',
+					},
+				],
+			};
+			expect(isValidQuery(query, props, ['$or'])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+
+		it('should return true if the query contains only attributes set in the props array ', () => {
+			const props = ['_id', 'name'];
+			const query = {
+				_id: '123',
+				name: '456',
+			};
+			expect(isValidQuery(query, props, [])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+
+		it('should return false if the query contains an attribute that is not in the props array ', () => {
+			const props = ['_id'];
+			const query = {
+				_id: '123',
+				name: '456',
+			};
+			expect(isValidQuery(query, props, [])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+	});
+
+	describe('deep keys', () => {
+		it('should return false if the query contains deep attributes that are not set on allowed keys', () => {
+			const props = ['_id', 'name'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+
+		it('should return false if the query contains deep attributes that are and are not set as allowed', () => {
+			const props = ['user', '_id', 'name'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+
+		it('should return true if the query contains deep attributes that are set on allowed keys', () => {
+			const props = ['user', 'user._id', 'user.name'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+
+		it('should return true if the query contains deep attributes that are set on allowed keys even for many layers', () => {
+			const props = ['user', 'user._id', 'user.name', 'user.address', 'user.address.city'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+					address: {
+						city: 'New York',
+					},
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+	});
+
+	describe('using .* for match keys', () => {
+		it('should return true if the query contains attributes and * are being used', () => {
+			const props = ['user', 'user.*'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+	});
+
+	describe('using * for match keys', () => {
+		it('should return true if the query contains attributes and * are being used', () => {
+			const props = ['user', '*'];
+			const query = {
+				user: {
+					_id: '123',
+					name: '456',
+				},
+			};
+			expect(isValidQuery(query, props, [])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+		it('should return false if query uses * but the operation is not allowed', () => {
+			const props = ['user', '*'];
+			const query = {
+				$or: [{ user: '123' }, { user: '456' }],
+			};
+			expect(isValidQuery(query, props, [])).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+	});
+
+	describe('testing $regex', () => {
+		it('should return true if the query contains attributes and * are being used', () => {
+			const props = ['user.*'];
+			const query = {
+				user: {
+					_id: '123',
+					name: {
+						$regex: '*',
+					},
+				},
+			};
+			expect(isValidQuery(query, props, ['$or', '$regex'])).to.be.true;
+			expect(isValidQuery.errors.length).to.be.equals(0);
+		});
+
+		it('should return false for services.password.reset.token', () => {
+			const query = {
+				$or: [
+					{ 'emails.address': { $regex: '', $options: 'i' } },
+					{ username: { $regex: '', $options: 'i' } },
+					{ name: { $regex: '', $options: 'i' } },
+				],
+				$and: [{ username: 'g1' }, { 'services.password.reset.token': { $regex: '.*' } }],
+			};
+			expect(
+				isValidQuery(
+					query,
+					['name', 'username', 'emails', 'roles', 'status', 'active', 'avatarETag', 'lastLogin', 'email.address.*', 'username.*', 'name.*'],
+					['$or', '$and'],
+				),
+			).to.be.false;
+		});
+		it('should return false for services.totp.secret', () => {
+			const query = {
+				$or: [
+					{ 'emails.address': { $regex: '', $options: 'i' } },
+					{ username: { $regex: '', $options: 'i' } },
+					{ name: { $regex: '', $options: 'i' } },
+				],
+				$and: [{ username: 'g1' }, { 'services.totp.secret': { $regex: '.*' } }],
+			};
+			expect(
+				isValidQuery(
+					query,
+					['name', 'username', 'emails', 'roles', 'status', 'active', 'avatarETag', 'lastLogin', 'email.address.*', 'username.*', 'name.*'],
+					['$or', '$and'],
+				),
+			).to.be.false;
+		});
+
+		it('should return false if the query contains nested conditions with disallowed operators', () => {
+			const props = ['username'];
+			const allowedOps = ['$and', '$ne'];
+			const query = {
+				$and: [{ username: { $exists: true } }, { username: { $ne: '1000' } }],
+			};
+			expect(isValidQuery(query, props, allowedOps)).to.be.false;
+			expect(isValidQuery.errors.length).to.be.equals(1);
+		});
+	});
+});