feat(apps): enable configuring which hidden settings are available for the apps

apps/meteor/app/apps/server/bridges/settings.ts

@@ -1,4 +1,5 @@
-import type { IAppServerOrchestrator } from '@rocket.chat/apps';
+import { Apps, type IAppServerOrchestrator } from '@rocket.chat/apps';
+import type { IReadSettingPermission } from '@rocket.chat/apps-engine/definition/permissions/IPermission';
 import type { ISetting } from '@rocket.chat/apps-engine/definition/settings';
 import { ServerSettingBridge } from '@rocket.chat/apps-engine/server/bridges/ServerSettingBridge';
 import { Settings } from '@rocket.chat/models';
@@ -47,7 +48,27 @@ export class AppSettingBridge extends ServerSettingBridge {
 	protected async isReadableById(id: string, appId: string): Promise<boolean> {
 		this.orch.debugLog(`The App ${appId} is checking if they can read the setting ${id}.`);
 		const setting = await Settings.findOneById(id);
-		return Boolean(setting && !setting.secret);
+
+		if (!setting) {
+			return false;
+		}
+
+		// Get the server-setting.read permission
+		const app = Apps.self?.getManager().getOneById(appId);
+		if (!app) {
+			return false;
+		}
+
+		const settingsPerms = app?.getInfo().permissions?.find((perm) => perm.name === 'server-setting.read');
+		if (!settingsPerms) {
+			return false;
+		}
+
+		if ((setting.secret || setting.hidden) && (settingsPerms as IReadSettingPermission).hiddenSettings?.includes(id)) {
+			return true;
+		}
+
+		return !setting.secret;
 	}
 
 	protected async updateOne(setting: ISetting & { id: string }, appId: string): Promise<void> {

apps/meteor/app/apps/server/converters/settings.js

@@ -7,7 +7,7 @@ export class AppSettingsConverter {
 	}
 
 	async convertById(settingId) {
-		const setting = await Settings.findOneNotHiddenById(settingId);
+		const setting = await Settings.findOneById(settingId);
 
 		return this.convertToApp(setting);
 	}

apps/meteor/server/settings/setup-wizard.ts

@@ -1223,6 +1223,13 @@ export const createSetupWSettings = () =>
 				secret: true,
 			});
 
+			await this.add('Omnigateway_Url', 'https://omni-gateway.rocket.chat', {
+				type: 'string',
+				hidden: true,
+				secret: true,
+				readonly: true,
+			});
+
 			await this.add('Cloud_Service_Agree_PrivacyTerms', false, {
 				type: 'boolean',
 			});

packages/apps-engine/src/definition/permissions/IPermission.ts

@@ -10,3 +10,7 @@ export interface INetworkingPermission extends IPermission {
 export interface IWorkspaceTokenPermission extends IPermission {
     scopes: Array<string>;
 }
+
+export interface IReadSettingPermission extends IPermission {
+    hiddenSettings: Array<string>;
+}

packages/apps-engine/src/server/permissions/AppPermissions.ts

@@ -1,4 +1,4 @@
-import type { INetworkingPermission, IPermission, IWorkspaceTokenPermission } from '../../definition/permissions/IPermission';
+import type { INetworkingPermission, IPermission, IReadSettingPermission, IWorkspaceTokenPermission } from '../../definition/permissions/IPermission';
 
 /**
  * @description
@@ -33,7 +33,7 @@ export const AppPermissions = {
         registerButtons: { name: 'ui.registerButtons' },
     },
     setting: {
-        read: { name: 'server-setting.read' },
+        read: { name: 'server-setting.read', hiddenSettings: [] } as IReadSettingPermission,
         write: { name: 'server-setting.write' },
     },
     room: {