fix: disable deletion for federated users

.changeset/empty-toys-smell.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Federated users can no longer be deleted.

apps/meteor/app/lib/server/functions/deleteUser.ts

@@ -1,5 +1,5 @@
 import { api } from '@rocket.chat/core-services';
-import type { IUser } from '@rocket.chat/core-typings';
+import { isUserFederated, type IUser } from '@rocket.chat/core-typings';
 import {
 	Integrations,
 	FederationServers,
@@ -12,6 +12,7 @@ import {
 	ReadReceipts,
 	LivechatUnitMonitors,
 	ModerationReports,
+	MatrixBridgedUser,
 } from '@rocket.chat/models';
 import { Meteor } from 'meteor/meteor';
 
@@ -46,6 +47,19 @@ export async function deleteUser(userId: string, confirmRelinquish = false, dele
 		return;
 	}
 
+	if (isUserFederated(user)) {
+		throw new Meteor.Error('error-not-allowed', 'Deleting federated, external user is not allowed', {
+			method: 'deleteUser',
+		});
+	}
+
+	const remoteUser = await MatrixBridgedUser.getExternalUserIdByLocalUserId(userId);
+	if (remoteUser) {
+		throw new Meteor.Error('error-not-allowed', 'User participated in federation, this user can only be deactivated permanently', {
+			method: 'deleteUser',
+		});
+	}
+
 	const subscribedRooms = await getSubscribedRoomsForUserWithDetails(userId);
 
 	if (shouldRemoveOrChangeOwner(subscribedRooms) && !confirmRelinquish) {