upstream-rocketchat/apps/meteor/server/meteor-methods/messages/createDirectMessage.ts

import type { ICreateRoomParams } from '@rocket.chat/core-services';
import type { ICreatedRoom, IUser } from '@rocket.chat/core-typings';
import type { ServerMethods } from '@rocket.chat/ddp-client';
import { Rooms, Users } from '@rocket.chat/models';
import { check, Match } from 'meteor/check';
import { Meteor } from 'meteor/meteor';

import { RateLimiterClass as RateLimiter } from '../../lib/RateLimiter';
import { hasPermissionAsync } from '../../lib/authorization/hasPermission';
import { callbacks } from '../../lib/callbacks';
import { createRoom } from '../../lib/rooms/createRoom';
import { settings } from '../../settings';

export async function createDirectMessage(
	usernames: IUser['username'][],
	userId: IUser['_id'] | null,
	excludeSelf = false,
): Promise<Omit<ICreatedRoom, '_id' | 'inserted'>> {
	check(usernames, [String]);
	check(userId, String);
	check(excludeSelf, Match.Optional(Boolean));

	if (!userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'createDirectMessage',
		});
	}

	const me = await Users.findOneById(userId, { projection: { username: 1, name: 1 } });
	if (!me?.username) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'createDirectMessage',
		});
	}

	if (settings.get('Message_AllowDirectMessagesToYourself') === false && usernames.length === 1 && me.username === usernames[0]) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'createDirectMessage',
		});
	}

	const users = await Promise.all(usernames.filter((username) => username !== me.username));
	const options: Exclude<ICreateRoomParams['options'], undefined> = { creator: me._id };
	const roomUsers = excludeSelf ? users : [me, ...users];

	// allow self-DMs
	if (roomUsers.length === 1 && roomUsers[0] !== undefined && typeof roomUsers[0] !== 'string' && roomUsers[0]._id !== me._id) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'createDirectMessage',
		});
	}

	if (!(await hasPermissionAsync(userId, 'create-d'))) {
		// If the user can't create DMs but can access already existing ones
		if ((await hasPermissionAsync(userId, 'view-d-room')) && !Object.keys(roomUsers).some((user) => typeof user === 'string')) {
			// Check if the direct room already exists, then return it
			const uids = (roomUsers as IUser[]).map(({ _id }) => _id).sort();
			// No projection: the full room is spread into the ICreatedRoom-shaped return below.
			const room = await Rooms.findOneDirectRoomContainingAllUserIDs(uids);
			if (room) {
				return {
					...room,
					t: 'd',
					rid: room._id,
				};
			}
		}

		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'createDirectMessage',
		});
	}

	if (excludeSelf && (await hasPermissionAsync(userId, 'view-room-administration'))) {
		options.subscriptionExtra = { open: true };
	}

	const extraData = {};

	try {
		await callbacks.run('federation.beforeCreateDirectMessage', roomUsers, extraData);
	} catch (error) {
		throw new Meteor.Error((error as any)?.message);
	}
	const {
		_id: rid,
		inserted,
		...room
	} = await createRoom<'d'>('d', undefined, undefined, roomUsers as IUser[], false, undefined, extraData, options);

	return {
		// @ts-expect-error - room type is already defined in the `createRoom` return type
		t: 'd',
		// @ts-expect-error - room id is not defined in the `createRoom` return type
		rid,
		...room,
	};
}

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		createDirectMessage(...usernames: Exclude<IUser['username'], undefined>[]): Omit<ICreatedRoom, '_id' | 'inserted'>;
	}
}

Meteor.methods<ServerMethods>({
	async createDirectMessage(...usernames) {
		return createDirectMessage(usernames, Meteor.userId());
	},
});

RateLimiter.limitMethod('createDirectMessage', 10, 60000, {
	async userId(userId: IUser['_id']) {
		return !(await hasPermissionAsync(userId, 'send-many-messages'));
	},
});