fix: App update with no permission causes invalid_installation_disabled

.changeset/shy-moles-boil.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+fixes an issue where removing the permissions of an app would cause it to never be enabled.

apps/meteor/ee/server/apps/storage/AppRealStorage.ts

@@ -1,6 +1,7 @@
 import type { IAppStorageItem } from '@rocket.chat/apps-engine/server/storage';
 import { AppMetadataStorage } from '@rocket.chat/apps-engine/server/storage';
 import type { Apps } from '@rocket.chat/models';
+import type { UpdateFilter } from 'mongodb';
 
 export class AppRealStorage extends AppMetadataStorage {
 	constructor(private db: typeof Apps) {
@@ -46,8 +47,18 @@ export class AppRealStorage extends AppMetadataStorage {
 	}
 
 	public async update(item: IAppStorageItem): Promise<IAppStorageItem> {
-		await this.db.updateOne({ id: item.id, _id: item._id }, { $set: item });
-		return this.retrieveOne(item.id);
+		const updateQuery: UpdateFilter<IAppStorageItem> = {
+			$set: item,
+		};
+
+		// Note: This is really important, since we currently store the permissionsGranted as null if none are present
+		//       in the App's manifest. So, if there was a permissionGranted and it was removed, we must see the app as having
+		//       no permissionsGranted at all (which means default permissions). So we must actively unset the field.
+		if (!item.permissionsGranted) {
+			updateQuery.$unset = { permissionsGranted: 1 };
+		}
+
+		return this.db.findOneAndUpdate({ id: item.id, _id: item._id }, updateQuery);
 	}
 
 	public async remove(id: string): Promise<{ success: boolean }> {