Release 7.10.1

.changeset/bump-patch-1758105326594.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Bump @rocket.chat/meteor version.

.changeset/green-ants-shop.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Fixes login using iframe authentication.

.changeset/grumpy-berries-arrive.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)

.changeset/old-meals-pull.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/apps-engine': patch
+'@rocket.chat/meteor': patch
+---
+
+Changes a strict behavior on reporting slash commands provided by apps

apps/meteor/app/api/server/ApiClass.ts

@@ -811,12 +811,15 @@ export class APIClass<
 						if (options.authRequired || options.authOrAnonRequired) {
 							const user = await api.authenticatedRoute.call(this, this.request);
 							this.user = user!;
-							this.userId = String(this.request.headers.get('x-user-id'));
+							this.userId = this.user?._id;
 							const authToken = this.request.headers.get('x-auth-token');
 							this.token = (authToken && Accounts._hashLoginToken(String(authToken)))!;
 						}
 
-						if (!this.user && options.authRequired && !options.authOrAnonRequired && !settings.get('Accounts_AllowAnonymousRead')) {
+						const shouldPreventAnonymousRead = !this.user && options.authOrAnonRequired && !settings.get('Accounts_AllowAnonymousRead');
+						const shouldPreventUserRead = !this.user && options.authRequired;
+
+						if (shouldPreventAnonymousRead || shouldPreventUserRead) {
 							const result = api.unauthorized('You must be logged in to do this.');
 							// compatibility with the old API
 							// TODO: MAJOR

apps/meteor/client/hooks/iframe/useIframe.ts

@@ -1,5 +1,5 @@
 import { useLoginWithIframe, useLoginWithToken, useSetting } from '@rocket.chat/ui-contexts';
-import { useCallback, useState } from 'react';
+import { useCallback, useEffect, useState } from 'react';
 
 export const useIframe = () => {
 	const [iframeLoginUrl, setIframeLoginUrl] = useState<string | undefined>(undefined);
@@ -12,6 +12,8 @@ export const useIframe = () => {
 	const iframeLogin = useLoginWithIframe();
 	const tokenLogin = useLoginWithToken();
 
+	const enabled = Boolean(iframeEnabled && accountIframeUrl && apiUrl && apiMethod);
+
 	const loginWithToken = useCallback(
 		(tokenData: string | { loginToken: string } | { token: string }, callback?: (error: Error | null | undefined) => void) => {
 			if (typeof tokenData === 'string') {
@@ -31,6 +33,10 @@ export const useIframe = () => {
 
 	const tryLogin = useCallback(
 		async (callback?: (error: Error | null | undefined, result: unknown) => void) => {
+			if (!enabled) {
+				return;
+			}
+
 			let url = accountIframeUrl;
 			let separator = '?';
 			if (url.indexOf('?') > -1) {
@@ -43,9 +49,7 @@ export const useIframe = () => {
 
 			const result = await fetch(apiUrl, {
 				method: apiMethod,
-				headers: {
-					'Content-Type': 'application/json',
-				},
+				headers: undefined,
 				credentials: 'include',
 			});
 
@@ -64,11 +68,15 @@ export const useIframe = () => {
 				callback?.(error, await result.json());
 			});
 		},
-		[apiMethod, apiUrl, accountIframeUrl, loginWithToken],
+		[apiMethod, apiUrl, accountIframeUrl, loginWithToken, enabled],
 	);
 
+	useEffect(() => {
+		tryLogin();
+	}, [tryLogin]);
+
 	return {
-		enabled: Boolean(iframeEnabled && accountIframeUrl && apiUrl && apiMethod),
+		enabled,
 		tryLogin,
 		loginWithToken,
 		iframeLoginUrl,

apps/meteor/client/hooks/useAppSlashCommands.spec.tsx

@@ -0,0 +1,185 @@
+import type { SlashCommand } from '@rocket.chat/core-typings';
+import { mockAppRoot, type StreamControllerRef } from '@rocket.chat/mock-providers';
+import { renderHook, waitFor } from '@testing-library/react';
+
+import { useAppSlashCommands } from './useAppSlashCommands';
+import { slashCommands } from '../../app/utils/client/slashCommand';
+
+const mockSlashCommands: SlashCommand[] = [
+	{
+		command: '/test',
+		description: 'Test command',
+		params: 'param1 param2',
+		clientOnly: false,
+		providesPreview: false,
+		appId: 'test-app-1',
+		permission: undefined,
+	},
+	{
+		command: '/weather',
+		description: 'Get weather information',
+		params: 'city',
+		clientOnly: false,
+		providesPreview: true,
+		appId: 'weather-app',
+		permission: undefined,
+	},
+];
+
+const mockApiResponse = {
+	commands: mockSlashCommands,
+	total: mockSlashCommands.length,
+};
+
+describe('useAppSlashCommands', () => {
+	let mockGetSlashCommands: jest.Mock;
+
+	beforeEach(() => {
+		mockGetSlashCommands = jest.fn().mockResolvedValue(mockApiResponse);
+
+		slashCommands.commands = {};
+	});
+
+	afterEach(() => {
+		jest.clearAllMocks();
+	});
+
+	it('should not fetch data when user ID is not available', () => {
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot().withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands).build(),
+		});
+
+		expect(mockGetSlashCommands).not.toHaveBeenCalled();
+		expect(slashCommands.commands).toEqual({});
+	});
+
+	it('should fetch slash commands when user ID is available', async () => {
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot().withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands).withJohnDoe().build(),
+		});
+
+		await waitFor(() => {
+			expect(Object.keys(slashCommands.commands)).toHaveLength(mockSlashCommands.length);
+		});
+	});
+
+	it('should handle command/removed event by invalidating queries', async () => {
+		const streamRef: StreamControllerRef<'apps'> = {};
+
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot()
+				.withJohnDoe()
+				.withStream('apps', streamRef)
+				.withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands)
+				.build(),
+		});
+
+		expect(streamRef.controller).toBeDefined();
+
+		await waitFor(() => {
+			expect(Object.keys(slashCommands.commands)).toHaveLength(mockSlashCommands.length);
+		});
+
+		streamRef.controller?.emit('apps', [['command/removed', ['/test']]]);
+
+		expect(slashCommands.commands['/test']).toBeUndefined();
+		expect(slashCommands.commands['/weather']).toBeDefined();
+	});
+
+	it('should handle command/added event by invalidating queries', async () => {
+		const streamRef: StreamControllerRef<'apps'> = {};
+
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot()
+				.withJohnDoe()
+				.withStream('apps', streamRef)
+				.withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands)
+				.build(),
+		});
+
+		expect(streamRef.controller).toBeDefined();
+
+		await waitFor(() => {
+			expect(Object.keys(slashCommands.commands)).toHaveLength(mockSlashCommands.length);
+		});
+
+		mockGetSlashCommands.mockResolvedValue({
+			commands: [
+				...mockSlashCommands,
+				{
+					command: '/newcommand',
+					description: 'New command',
+					params: 'param1 param2',
+					clientOnly: false,
+				},
+			],
+			total: mockSlashCommands.length + 1,
+		});
+
+		streamRef.controller?.emit('apps', [['command/added', ['/newcommand']]]);
+
+		await waitFor(() => {
+			expect(slashCommands.commands['/newcommand']).toBeDefined();
+		});
+
+		expect(slashCommands.commands['/test']).toBeDefined();
+		expect(slashCommands.commands['/weather']).toBeDefined();
+	});
+
+	it('should handle command/updated event by invalidating queries', async () => {
+		const streamRef: StreamControllerRef<'apps'> = {};
+
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot()
+				.withJohnDoe()
+				.withStream('apps', streamRef)
+				.withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands)
+				.build(),
+		});
+
+		expect(streamRef.controller).toBeDefined();
+
+		await waitFor(() => {
+			expect(Object.keys(slashCommands.commands)).toHaveLength(mockSlashCommands.length);
+		});
+
+		streamRef.controller?.emit('apps', [['command/updated', ['/test']]]);
+
+		expect(slashCommands.commands['/test']).toBeUndefined();
+		expect(slashCommands.commands['/weather']).toBeDefined();
+	});
+
+	it('should ignore command/disabled event', async () => {
+		const streamRef: StreamControllerRef<'apps'> = {};
+
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot()
+				.withJohnDoe()
+				.withStream('apps', streamRef)
+				.withEndpoint('GET', '/v1/commands.list', mockGetSlashCommands)
+				.build(),
+		});
+
+		expect(streamRef.controller).toBeDefined();
+
+		await waitFor(() => {
+			expect(Object.keys(slashCommands.commands)).toHaveLength(mockSlashCommands.length);
+		});
+
+		streamRef.controller?.emit('apps', [['command/disabled', ['/test']]]);
+
+		expect(slashCommands.commands['/test']).toBeDefined();
+		expect(slashCommands.commands['/weather']).toBeDefined();
+	});
+
+	it('should not set up stream listener when user ID is not available', () => {
+		const streamRef: StreamControllerRef<'apps'> = {};
+
+		renderHook(() => useAppSlashCommands(), {
+			wrapper: mockAppRoot().withStream('apps', streamRef).build(),
+		});
+
+		expect(streamRef.controller).toBeDefined();
+		expect(streamRef.controller?.has('apps')).toBe(false);
+	});
+});

apps/meteor/client/hooks/useAppSlashCommands.ts

@@ -29,7 +29,7 @@ export const useAppSlashCommands = () => {
 			return;
 		}
 		return apps('apps', ([key, [command]]) => {
-			if (['command/added', 'command/updated', 'command/disabled', 'command/removed'].includes(key)) {
+			if (['command/added', 'command/updated', 'command/removed'].includes(key)) {
 				if (typeof command === 'string') {
 					delete slashCommands.commands[command];
 				}

apps/meteor/tests/end-to-end/api/channels.ts

@@ -3503,10 +3503,10 @@ describe('[Channels]', () => {
 						roomId: testChannel._id,
 					})
 					.expect('Content-Type', 'application/json')
-					.expect(400)
+					.expect(401)
 					.expect((res) => {
 						expect(res.body).to.have.a.property('success', false);
-						expect(res.body).to.have.a.property('error', 'Enable "Allow Anonymous Read" [error-not-allowed]');
+						expect(res.body).to.have.a.property('error', 'You must be logged in to do this.');
 					})
 					.end(done);
 			});

apps/meteor/tests/end-to-end/api/users.ts

@@ -681,6 +681,53 @@ describe('[Users]', () => {
 			]),
 		);
 
+		it('should fail when request is without authentication credentials', async () => {
+			await request
+				.get(api('users.info'))
+				.query({
+					userId: targetUser._id,
+				})
+				.expect('Content-Type', 'application/json')
+				.expect(401)
+				.expect((res) => {
+					expect(res.body).to.have.property('success', false);
+					expect(res.body).to.have.property('error');
+				});
+		});
+
+		describe('authentication', () => {
+			before(() => updateSetting('Accounts_AllowAnonymousRead', true));
+			after(() => updateSetting('Accounts_AllowAnonymousRead', false));
+			it('should fail when request is without authentication credentials and Anonymous Read is enabled', async () => {
+				await request
+					.get(api('users.info'))
+					.query({
+						userId: targetUser._id,
+					})
+					.expect('Content-Type', 'application/json')
+					.expect(401)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', false);
+						expect(res.body).to.have.property('error');
+					});
+			});
+
+			it('should fail when request is without token and Anonymous Read is enabled', async () => {
+				await request
+					.get(api('users.info'))
+					.query({
+						userId: targetUser._id,
+					})
+					.set({ 'X-User-Id': credentials['X-User-Id'] })
+					.expect('Content-Type', 'application/json')
+					.expect(401)
+					.expect((res) => {
+						expect(res.body).to.have.property('success', false);
+						expect(res.body).to.have.property('error');
+					});
+			});
+		});
+
 		it('should return an error when the user does not exist', (done) => {
 			void request
 				.get(api('users.info'))