snapshot of https://github.com/RocketChat/Rocket.Chat.git (develop, 2026-09-16; blobs > 131072B omitted)

apps/meteor/tests/unit/server/meteor-methods/messages/deleteFileMessage.spec.ts

@@ -0,0 +1,124 @@
+import { MeteorError } from '@rocket.chat/core-services';
+import { expect } from 'chai';
+import { beforeEach, describe, it } from 'mocha';
+import p from 'proxyquire';
+import sinon from 'sinon';
+
+const checkMock = sinon.stub();
+const meteorUserIdMock = sinon.stub();
+const meteorMethodsMock = sinon.stub();
+const deleteMessageValidatingPermissionMock = sinon.stub();
+const canDeleteFileMock = sinon.stub();
+const deleteByIdMock = sinon.stub();
+const fileUploadGetStoreMock = sinon.stub().returns({ deleteById: deleteByIdMock });
+
+const modelsMock = {
+	Messages: {
+		getMessageByFileId: sinon.stub(),
+	},
+	Users: {
+		findOneById: sinon.stub(),
+	},
+	Uploads: {
+		findOneById: sinon.stub(),
+	},
+};
+
+p.noCallThru().load('../../../../../server/meteor-methods/messages/deleteFileMessage', {
+	'meteor/meteor': {
+		Meteor: {
+			userId: meteorUserIdMock,
+			Error: MeteorError,
+			methods: meteorMethodsMock,
+		},
+	},
+	'meteor/check': {
+		check: checkMock,
+	},
+	'@rocket.chat/models': modelsMock,
+	'@rocket.chat/core-services': {
+		Upload: { canDeleteFile: canDeleteFileMock },
+	},
+	'../../lib/media/file-upload': {
+		FileUpload: { getStore: fileUploadGetStoreMock },
+	},
+	'../../lib/messages/deleteMessage': {
+		deleteMessageValidatingPermission: deleteMessageValidatingPermissionMock,
+	},
+});
+
+const deleteFileMessageMethod = meteorMethodsMock.firstCall.args[0].deleteFileMessage;
+
+describe('deleteFileMessage', () => {
+	beforeEach(() => {
+		checkMock.resetHistory();
+		meteorUserIdMock.reset();
+		deleteMessageValidatingPermissionMock.reset();
+		canDeleteFileMock.reset();
+		deleteByIdMock.reset();
+		fileUploadGetStoreMock.resetHistory();
+		modelsMock.Messages.getMessageByFileId.reset();
+		modelsMock.Users.findOneById.reset();
+		modelsMock.Uploads.findOneById.reset();
+	});
+
+	it('should throw if user is not authenticated', async () => {
+		meteorUserIdMock.returns(null);
+
+		await expect(deleteFileMessageMethod('file123')).to.be.rejectedWith('Invalid user');
+	});
+
+	it('should delete message validating permission if file has an associated message', async () => {
+		meteorUserIdMock.returns('user123');
+		const mockMsg = { _id: 'msg123', file: { _id: 'file123' } };
+		modelsMock.Messages.getMessageByFileId.resolves(mockMsg);
+		deleteMessageValidatingPermissionMock.resolves();
+
+		await deleteFileMessageMethod('file123');
+
+		expect(checkMock.calledOnceWith('file123', String)).to.be.true;
+		expect(deleteMessageValidatingPermissionMock.calledOnceWith(mockMsg, 'user123')).to.be.true;
+		expect(modelsMock.Users.findOneById.called).to.be.false;
+	});
+
+	it('should throw if it is an orphan file but user is not found in DB', async () => {
+		meteorUserIdMock.returns('user123');
+		modelsMock.Messages.getMessageByFileId.resolves(null);
+		modelsMock.Users.findOneById.resolves(null);
+
+		await expect(deleteFileMessageMethod('file123')).to.be.rejectedWith('Invalid user');
+	});
+
+	it('should throw if it is an orphan file but file is not found in DB', async () => {
+		meteorUserIdMock.returns('user123');
+		modelsMock.Messages.getMessageByFileId.resolves(null);
+		modelsMock.Users.findOneById.resolves({ _id: 'user123', username: 'test' });
+		modelsMock.Uploads.findOneById.resolves(null);
+
+		await expect(deleteFileMessageMethod('file123')).to.be.rejectedWith('Invalid file');
+	});
+
+	it('should not delete orphan file if user does not have permissions', async () => {
+		meteorUserIdMock.returns('user123');
+		modelsMock.Messages.getMessageByFileId.resolves(null);
+		modelsMock.Users.findOneById.resolves({ _id: 'user123', username: 'test' });
+		modelsMock.Uploads.findOneById.resolves({ _id: 'file123', userId: 'user123' });
+		canDeleteFileMock.resolves(false);
+
+		await expect(deleteFileMessageMethod('file123')).to.be.rejectedWith('Not authorized');
+	});
+
+	it('should delete orphan file if user has permissions', async () => {
+		meteorUserIdMock.returns('user123');
+		modelsMock.Messages.getMessageByFileId.resolves(null);
+		modelsMock.Users.findOneById.resolves({ _id: 'user123', username: 'test' });
+		modelsMock.Uploads.findOneById.resolves({ _id: 'file123', userId: 'user123' });
+		canDeleteFileMock.resolves(true);
+		deleteByIdMock.resolves();
+
+		await deleteFileMessageMethod('file123');
+
+		expect(fileUploadGetStoreMock.calledOnceWith('Uploads')).to.be.true;
+		expect(deleteByIdMock.calledOnceWith('file123')).to.be.true;
+	});
+});

apps/meteor/tests/unit/server/meteor-methods/messages/loadSurroundingMessages.spec.ts

@@ -0,0 +1,106 @@
+import { MeteorError } from '@rocket.chat/core-services';
+import { expect } from 'chai';
+import { beforeEach, describe, it } from 'mocha';
+import p from 'proxyquire';
+import sinon from 'sinon';
+
+const checkMock = sinon.stub();
+const meteorUserIdMock = sinon.stub();
+const meteorMethodsMock = sinon.stub();
+const canAccessRoomIdMock = sinon.stub();
+const normalizeMessagesForUserMock = sinon.stub();
+const settingsGetMock = sinon.stub();
+
+// the method pushes into the array it gets back, so each call needs a fresh one
+const emptyCursor = () => ({ toArray: async () => [] });
+
+const modelsMock = {
+	Messages: {
+		findOneById: sinon.stub(),
+		findVisibleByRoomIdBeforeTimestamp: sinon.stub().callsFake(emptyCursor),
+		findVisibleByRoomIdAfterTimestamp: sinon.stub().callsFake(emptyCursor),
+	},
+};
+
+p.noCallThru().load('../../../../../server/meteor-methods/messages/loadSurroundingMessages', {
+	'meteor/meteor': {
+		Meteor: {
+			userId: meteorUserIdMock,
+			Error: MeteorError,
+			methods: meteorMethodsMock,
+		},
+	},
+	'meteor/check': {
+		check: checkMock,
+	},
+	'@rocket.chat/models': modelsMock,
+	'../../lib/authorization/canAccessRoom': {
+		canAccessRoomIdAsync: canAccessRoomIdMock,
+	},
+	'../../lib/deprecationWarningLogger': {
+		methodDeprecationLogger: { method: sinon.stub() },
+	},
+	'../../lib/utils/lib/normalizeMessagesForUser': {
+		normalizeMessagesForUser: normalizeMessagesForUserMock,
+	},
+	'../../settings': {
+		settings: { get: settingsGetMock },
+	},
+});
+
+const loadSurroundingMessagesMethod = meteorMethodsMock.firstCall.args[0].loadSurroundingMessages;
+
+const mainMessage = { _id: 'msg123', rid: 'room123', ts: new Date('2024-01-01T00:00:00Z') };
+
+describe('loadSurroundingMessages', () => {
+	beforeEach(() => {
+		checkMock.resetHistory();
+		meteorUserIdMock.reset();
+		canAccessRoomIdMock.reset();
+		normalizeMessagesForUserMock.reset();
+		settingsGetMock.reset();
+		modelsMock.Messages.findOneById.reset();
+	});
+
+	it('should throw for an anonymous user when anonymous read is disabled', async () => {
+		meteorUserIdMock.returns(null);
+		settingsGetMock.withArgs('Accounts_AllowAnonymousRead').returns(false);
+
+		await expect(loadSurroundingMessagesMethod({ _id: 'msg123', rid: 'room123' })).to.be.rejectedWith('Invalid user');
+	});
+
+	it('should load the surrounding messages for an anonymous user when anonymous read is enabled', async () => {
+		meteorUserIdMock.returns(null);
+		settingsGetMock.withArgs('Accounts_AllowAnonymousRead').returns(true);
+		modelsMock.Messages.findOneById.resolves(mainMessage);
+		canAccessRoomIdMock.resolves(true);
+
+		const result = await loadSurroundingMessagesMethod({ _id: 'msg123', rid: 'room123' });
+
+		expect(result).to.not.be.false;
+		expect(result.messages).to.deep.equal([mainMessage]);
+		expect(canAccessRoomIdMock.calledOnceWith('room123', undefined)).to.be.true;
+		expect(normalizeMessagesForUserMock.called).to.be.false;
+	});
+
+	it('should not load the surrounding messages when the room is out of reach', async () => {
+		meteorUserIdMock.returns(null);
+		settingsGetMock.withArgs('Accounts_AllowAnonymousRead').returns(true);
+		modelsMock.Messages.findOneById.resolves(mainMessage);
+		canAccessRoomIdMock.resolves(false);
+
+		expect(await loadSurroundingMessagesMethod({ _id: 'msg123', rid: 'room123' })).to.be.false;
+	});
+
+	it('should normalize the messages for a logged in user', async () => {
+		meteorUserIdMock.returns('user123');
+		modelsMock.Messages.findOneById.resolves(mainMessage);
+		canAccessRoomIdMock.resolves(true);
+		normalizeMessagesForUserMock.resolves([mainMessage]);
+
+		await loadSurroundingMessagesMethod({ _id: 'msg123', rid: 'room123' });
+
+		expect(settingsGetMock.called).to.be.false;
+		expect(normalizeMessagesForUserMock.calledOnceWith([mainMessage], 'user123')).to.be.true;
+	});
+});