[NEW][Enterprise] Micro services

.eslintignore

@@ -18,3 +18,4 @@ public/pdf.worker.min.js
 public/workers/**/*
 imports/client/
 !/.storybook/
+ee/server/services/dist/**

.github/workflows/build_and_test.yml

@@ -487,3 +487,40 @@ jobs:
 
         docker build -t ${IMAGE}:develop .
         docker push ${IMAGE}:develop
+
+  services-image-build:
+    runs-on: ubuntu-latest
+    needs: deploy
+    if: github.event.pull_request.head.repo.full_name == github.repository
+
+    strategy:
+      matrix:
+        service: ["account", "authorization", "ddp-streamer", "presence", "stream-hub"]
+
+    steps:
+    - uses: actions/checkout@v2
+
+    - name: Use Node.js 12.18.4
+      uses: actions/setup-node@v1
+      with:
+        node-version: "12.18.4"
+
+    - name: Login to DockerHub
+      uses: docker/login-action@v1
+      with:
+        username: ${{ secrets.DOCKER_USER }}
+        password: ${{ secrets.DOCKER_PASS }}
+
+    - name: Build Docker images
+      run: |
+        npm i
+
+        cd ./ee/server/services
+        npm i
+        npm run build
+
+        echo "Building Docker image for service: ${{ matrix.service }}"
+
+        docker build --build-arg SERVICE=${{ matrix.service }} -t rocketchat/${{ matrix.service }}-service .
+
+        docker push rocketchat/${{ matrix.service }}-service

.meteorignore

@@ -0,0 +1 @@
+ee/server/services

.scripts/start.js

@@ -19,13 +19,17 @@ const isPortTaken = (port) => new Promise((resolve, reject) => {
 		.listen(port);
 });
 
-const waitPortRelease = (port) => new Promise((resolve, reject) => {
+const waitPortRelease = (port, count = 0) => new Promise((resolve, reject) => {
 	isPortTaken(port).then((taken) => {
 		if (!taken) {
 			return resolve();
 		}
+		if (count > 60) {
+			return reject();
+		}
+		console.log('Port', port, 'not release, waiting 1s...');
 		setTimeout(() => {
-			waitPortRelease(port).then(resolve).catch(reject);
+			waitPortRelease(port, ++count).then(resolve).catch(reject);
 		}, 1000);
 	});
 });
@@ -77,7 +81,10 @@ function startProcess(opts, callback) {
 
 		processes.splice(processes.indexOf(proc), 1);
 
-		processes.forEach((p) => p.kill());
+		processes.forEach((p) => {
+			console.log('Killing process', p.pid);
+			p.kill();
+		});
 
 		if (processes.length === 0) {
 			waitPortRelease(appOptions.env.PORT).then(() => {

app/api/server/v1/settings.js

@@ -7,6 +7,7 @@ import { Settings } from '../../../models/server';
 import { hasPermission } from '../../../authorization';
 import { API } from '../api';
 import { SettingsEvents, settings } from '../../../settings/server';
+import { setValue } from '../../../settings/server/raw';
 
 const fetchSettings = (query, sort, offset, count, fields) => {
 	const settings = Settings.find(query, {
@@ -150,6 +151,7 @@ API.v1.addRoute('settings/:_id', { authRequired: true }, {
 					_id: this.urlParams._id,
 					value: this.bodyParams.value,
 				});
+				setValue(this.urlParams._id, this.bodyParams.value);
 				return API.v1.success();
 			}
 

app/apps/server/bridges/messages.js

@@ -1,9 +1,8 @@
-import { Random } from 'meteor/random';
-
 import { Messages, Users, Subscriptions } from '../../../models/server';
-import { Notifications } from '../../../notifications';
 import { updateMessage } from '../../../lib/server/functions/updateMessage';
 import { executeSendMessage } from '../../../lib/server/methods/sendMessage';
+import { api } from '../../../../server/sdk/api';
+import notifications from '../../../notifications/server/lib/Notifications';
 
 export class AppMessageBridge {
 	constructor(orch) {
@@ -52,10 +51,8 @@ export class AppMessageBridge {
 			return;
 		}
 
-		Notifications.notifyUser(user.id, 'message', {
+		api.broadcast('stream.ephemeralMessage', user.id, msg.rid, {
 			...msg,
-			_id: Random.id(),
-			ts: new Date(),
 		});
 	}
 
@@ -67,11 +64,6 @@ export class AppMessageBridge {
 		}
 
 		const msg = this.orch.getConverters().get('messages').convertAppMessage(message);
-		const rmsg = Object.assign(msg, {
-			_id: Random.id(),
-			rid: room.id,
-			ts: new Date(),
-		});
 
 		const users = Subscriptions.findByRoomIdWhenUserIdExists(room.id, { fields: { 'u._id': 1 } })
 			.fetch()
@@ -80,14 +72,16 @@ export class AppMessageBridge {
 		Users.findByIds(users, { fields: { _id: 1 } })
 			.fetch()
 			.forEach(({ _id }) =>
-				Notifications.notifyUser(_id, 'message', rmsg),
+				api.broadcast('stream.ephemeralMessage', _id, room.id, {
+					...msg,
+				}),
 			);
 	}
 
 	async typing({ scope, id, username, isTyping }) {
 		switch (scope) {
 			case 'room':
-				Notifications.notifyRoom(id, 'typing', username, isTyping);
+				notifications.notifyRoom(id, 'typing', username, isTyping);
 				return;
 			default:
 				throw new Error('Unrecognized typing scope provided');

app/apps/server/communication/websockets.js

@@ -1,6 +1,7 @@
-import { Meteor } from 'meteor/meteor';
 import { AppStatusUtils } from '@rocket.chat/apps-engine/definition/AppStatus';
 
+import notifications from '../../../notifications/server/lib/Notifications';
+
 export const AppEvents = Object.freeze({
 	APP_ADDED: 'app/added',
 	APP_REMOVED: 'app/removed',
@@ -101,18 +102,10 @@ export class AppServerListener {
 
 export class AppServerNotifier {
 	constructor(orch) {
-		this.engineStreamer = new Meteor.Streamer('apps-engine', { retransmit: false });
-		this.engineStreamer.serverOnly = true;
-		this.engineStreamer.allowRead('none');
-		this.engineStreamer.allowEmit('all');
-		this.engineStreamer.allowWrite('none');
+		this.engineStreamer = notifications.streamAppsEngine;
 
 		// This is used to broadcast to the web clients
-		this.clientStreamer = new Meteor.Streamer('apps', { retransmit: false });
-		this.clientStreamer.serverOnly = true;
-		this.clientStreamer.allowRead('all');
-		this.clientStreamer.allowEmit('all');
-		this.clientStreamer.allowWrite('none');
+		this.clientStreamer = notifications.streamApps;
 
 		this.received = new Map();
 		this.listener = new AppServerListener(orch, this.engineStreamer, this.clientStreamer, this.received);

app/authentication/server/lib/restrictLoginAttempts.ts

@@ -18,10 +18,10 @@ export const isValidLoginAttemptByIp = async (ip: string): Promise<boolean> => {
 		return true;
 	}
 
-	const lastLogin = await Sessions.findLastLoginByIp(ip);
+	const lastLogin = await Sessions.findLastLoginByIp(ip) as {loginAt?: Date} | undefined;
 	let failedAttemptsSinceLastLogin;
 
-	if (!lastLogin) {
+	if (!lastLogin || !lastLogin.loginAt) {
 		failedAttemptsSinceLastLogin = await ServerEvents.countFailedAttemptsByIp(ip);
 	} else {
 		failedAttemptsSinceLastLogin = await ServerEvents.countFailedAttemptsByIpSince(ip, new Date(lastLogin.loginAt));

app/authorization/lib/AuthorizationUtils.ts

@@ -1,15 +1,13 @@
-import { Meteor } from 'meteor/meteor';
-
 const restrictedRolePermissions = new Map();
 
 export const AuthorizationUtils = class {
-	static addRolePermissionWhiteList(roleId: string, list: [string]): void {
+	static addRolePermissionWhiteList(roleId: string, list: string[]): void {
 		if (!roleId) {
-			throw new Meteor.Error('invalid-param');
+			throw new Error('invalid-param');
 		}
 
 		if (!list) {
-			throw new Meteor.Error('invalid-param');
+			throw new Error('invalid-param');
 		}
 
 		if (!restrictedRolePermissions.has(roleId)) {
@@ -25,7 +23,7 @@ export const AuthorizationUtils = class {
 
 	static isPermissionRestrictedForRole(permissionId: string, roleId: string): boolean {
 		if (!roleId || !permissionId) {
-			throw new Meteor.Error('invalid-param');
+			throw new Error('invalid-param');
 		}
 
 		if (!restrictedRolePermissions.has(roleId)) {
@@ -40,9 +38,9 @@ export const AuthorizationUtils = class {
 		return !rules.has(permissionId);
 	}
 
-	static isPermissionRestrictedForRoleList(permissionId: string, roleList: [string]): boolean {
+	static isPermissionRestrictedForRoleList(permissionId: string, roleList: string[]): boolean {
 		if (!roleList || !permissionId) {
-			throw new Meteor.Error('invalid-param');
+			throw new Error('invalid-param');
 		}
 
 		for (const roleId of roleList) {

app/authorization/server/functions/canAccessRoom.ts

@@ -0,0 +1,8 @@
+import { Promise } from 'meteor/promise';
+
+import { Authorization } from '../../../../server/sdk';
+import { IAuthorization } from '../../../../server/sdk/types/IAuthorization';
+
+export const canAccessRoomAsync = Authorization.canAccessRoom;
+
+export const canAccessRoom = (...args: Parameters<IAuthorization['canAccessRoom']>): boolean => Promise.await(canAccessRoomAsync(...args));

app/authorization/server/functions/hasPermission.js

@@ -1,63 +1,8 @@
-import mem from 'mem';
+import { Authorization } from '../../../../server/sdk';
 
-import { Permissions, Users, Subscriptions } from '../../../models/server/raw';
-import { AuthorizationUtils } from '../../lib/AuthorizationUtils';
-
-const rolesHasPermission = mem(async (permission, roles) => {
-	if (AuthorizationUtils.isPermissionRestrictedForRoleList(permission, roles)) {
-		return false;
-	}
-
-	const result = await Permissions.findOne({ _id: permission, roles: { $in: roles } }, { projection: { _id: 1 } });
-	return !!result;
-}, {
-	cacheKey: JSON.stringify,
-	...process.env.TEST_MODE === 'true' && { maxAge: 1 },
-});
-
-const getRoles = mem(async (uid, scope) => {
-	const { roles: userRoles = [] } = await Users.findOne({ _id: uid }, { projection: { roles: 1 } });
-	const { roles: subscriptionsRoles = [] } = (scope && await Subscriptions.findOne({ rid: scope, 'u._id': uid }, { projection: { roles: 1 } })) || {};
-	return [...userRoles, ...subscriptionsRoles].sort((a, b) => a.localeCompare(b));
-}, { maxAge: 1000, cacheKey: JSON.stringify });
-
-export const clearCache = () => {
-	mem.clear(getRoles);
-	mem.clear(rolesHasPermission);
-};
-
-async function atLeastOne(uid, permissions = [], scope) {
-	const sortedRoles = await getRoles(uid, scope);
-	for (const permission of permissions) {
-		if (await rolesHasPermission(permission, sortedRoles)) { // eslint-disable-line
-			return true;
-		}
-	}
-
-	return false;
-}
-
-async function all(uid, permissions = [], scope) {
-	const sortedRoles = await getRoles(uid, scope);
-	for (const permission of permissions) {
-		if (!await rolesHasPermission(permission, sortedRoles)) { // eslint-disable-line
-			return false;
-		}
-	}
-
-	return true;
-}
-
-function _hasPermission(userId, permissions, scope, strategy) {
-	if (!userId) {
-		return false;
-	}
-	return strategy(userId, [].concat(permissions), scope);
-}
-
-export const hasAllPermissionAsync = async (userId, permissions, scope) => _hasPermission(userId, permissions, scope, all);
-export const hasPermissionAsync = async (userId, permissionId, scope) => _hasPermission(userId, permissionId, scope, all);
-export const hasAtLeastOnePermissionAsync = async (userId, permissions, scope) => _hasPermission(userId, permissions, scope, atLeastOne);
+export const hasAllPermissionAsync = async (userId, permissions, scope) => Authorization.hasAllPermission(userId, permissions, scope);
+export const hasPermissionAsync = async (userId, permissionId, scope) => Authorization.hasPermission(userId, permissionId, scope);
+export const hasAtLeastOnePermissionAsync = async (userId, permissions, scope) => Authorization.hasAtLeastOnePermission(userId, permissions, scope);
 
 export const hasAllPermission = (userId, permissions, scope) => Promise.await(hasAllPermissionAsync(userId, permissions, scope));
 export const hasPermission = (userId, permissionId, scope) => Promise.await(hasPermissionAsync(userId, permissionId, scope));

app/authorization/server/index.js

@@ -1,6 +1,5 @@
 import { addUserRoles } from './functions/addUserRoles';
 import {
-	addRoomAccessValidator,
 	canAccessRoom,
 	roomAccessValidators,
 } from './functions/canAccessRoom';
@@ -32,7 +31,6 @@ export {
 	removeUserFromRoles,
 	canSendMessage,
 	validateRoomMessagePermissions,
-	addRoomAccessValidator,
 	roomAccessValidators,
 	addUserRoles,
 	canAccessRoom,

app/authorization/server/methods/addUserToRole.js

@@ -3,8 +3,8 @@ import _ from 'underscore';
 
 import { Users, Roles } from '../../../models/server';
 import { settings } from '../../../settings/server';
-import { Notifications } from '../../../notifications/server';
 import { hasPermission } from '../functions/hasPermission';
+import { api } from '../../../../server/sdk/api';
 
 Meteor.methods({
 	'authorization:addUserToRole'(roleName, username, scope) {
@@ -50,7 +50,7 @@ Meteor.methods({
 		const add = Roles.addUserRoles(user._id, roleName, scope);
 
 		if (settings.get('UI_DisplayRoles')) {
-			Notifications.notifyLogged('roles-change', {
+			api.broadcast('user.roleUpdate', {
 				type: 'added',
 				_id: roleName,
 				u: {