.changeset/bump-patch-1758105326594.md (1)

5-5: Make the changelog line more descriptive

Consider including the release number and intent for clearer generated notes.

-Bump @rocket.chat/meteor version.
+Release 7.10.1: bump @rocket.chat/meteor patch version.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/meteor/client/hooks/iframe/useIframe.ts (2)

15-16: Harden the enablement check (guard against whitespace-only values).

Trim string settings to avoid accidental truthiness when values contain only whitespace.

-const enabled = Boolean(iframeEnabled && accountIframeUrl && apiUrl && apiMethod);
+const enabled = Boolean(
+  iframeEnabled &&
+  accountIframeUrl?.trim() &&
+  apiUrl?.trim() &&
+  apiMethod?.trim()
+);

---

74-77: Optional: cancel in-flight request on unmount.

Consider wiring an AbortController and aborting in the effect cleanup to avoid setting state after unmount.

Would you like a follow-up patch adding AbortController and effect cleanup?

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/meteor/app/api/server/ApiClass.ts (1)

819-823: 401 gating logic reads well; tighten typing on settings.get

Behavior matches the new contract, but add an explicit boolean generic to avoid truthy/falsey pitfalls from untyped settings.

Apply this diff:

-const shouldPreventAnonymousRead = !this.user && options.authOrAnonRequired && !settings.get('Accounts_AllowAnonymousRead');
+const shouldPreventAnonymousRead =
+  !this.user && options.authOrAnonRequired && !settings.get<boolean>('Accounts_AllowAnonymousRead');

.changeset/grumpy-berries-arrive.md (1)

5-5: Fix markdownlint: avoid bare URL

Wrap the URL to satisfy MD034 and improve readability.

Apply this diff:

-Security Hotfix (https://docs.rocket.chat/docs/security-fixes-and-updates)
+Security Hotfix ([Security fixes and updates](https://docs.rocket.chat/docs/security-fixes-and-updates))

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: CR
PR: RocketChat/Rocket.Chat#0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-09-16T22:08:51.490Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Use descriptive test names that clearly communicate expected behavior

packages/mock-providers/src/MockedAppRootBuilder.tsx (4)

64-67: Remove commented‑out legacy interface.

Keeps the file clean and avoids confusion with the new typing approach.

-// interface MockedAppRootEvents extends Record<`stream-${StreamNames}-${StreamKeys<StreamNames>}`, any> {
-// 	'update-modal': void;
-// }

---

83-86: Consider stronger event arg typing (optional).

Record<AllStreamerEventKeys, any> sacrifices callback arg types. If Emitter supports tuple arg typing, you could map each key to its StreamerCallbackArgs tuple for safer .on/.emit usage. Not required for this PR.

---

87-92: Align StreamControllerRef signatures with stream callbacks.

Use rest parameters for emit and keep has parameter typed to StreamKeys<N> for better ergonomics and type safety.

-export type StreamControllerRef<N extends StreamNames> = {
-	controller?: {
-		emit: <K extends StreamKeys<N>>(eventName: K, args: StreamerCallbackArgs<N, K>) => void;
-		has: (eventName: StreamKeys<N>) => boolean;
-	};
-};
+export type StreamControllerRef<N extends StreamNames> = {
+	controller?: {
+		emit: <K extends StreamKeys<N>>(eventName: K, ...args: StreamerCallbackArgs<N, K>) => void;
+		has: <K extends StreamKeys<N>>(eventName: K) => boolean;
+	};
+};

---

286-308: withStream: pass options through, match emit/has types, and avoid string param.

Minor fidelity/type‑safety gaps: the wrapper drops getStream options, emit takes a tuple param instead of varargs, and has accepts string. Adjust as below.

-	withStream<N extends StreamNames>(streamName: N, ref: StreamControllerRef<N>): this {
+	withStream<N extends StreamNames>(streamName: N, ref: StreamControllerRef<N>): this {
 		const innerFn = this.server.getStream;
 
-		const outerFn: ServerContextValue['getStream'] = (innerStreamName) => {
+		const outerFn: ServerContextValue['getStream'] = (innerStreamName, _options) => {
 			if (innerStreamName === (streamName as StreamNames)) {
 				ref.controller = {
-					emit: <K extends StreamKeys<N>>(eventName: K, args: StreamerCallbackArgs<N, K>) => {
-						this.events.emit(`stream-${innerStreamName}-${eventName}` as AllStreamerEventKeys, ...args);
-					},
-					has: (eventName: string) => this.events.has(`stream-${innerStreamName}-${eventName}` as AllStreamerEventKeys),
+					emit: <K extends StreamKeys<N>>(eventName: K, ...args: StreamerCallbackArgs<N, K>) => {
+						this.events.emit(`stream-${innerStreamName}-${eventName}` as AllStreamerEventKeys, ...args);
+					},
+					has: <K extends StreamKeys<N>>(eventName: K) =>
+						this.events.has(`stream-${innerStreamName}-${eventName}` as AllStreamerEventKeys),
 				};
 
 				return <K extends StreamKeys<N>>(eventName: K, callback: StreamerCallback<N, K>) =>
 					this.events.on(`stream-${innerStreamName}-${eventName}` as AllStreamerEventKeys, callback);
 			}
 
-			return innerFn(innerStreamName);
+			return innerFn(innerStreamName, _options);
 		};
 
 		this.server.getStream = outerFn;
 
 		return this;
 	}

Please confirm @rocket.chat/emitter exposes has(eventName) returning boolean. If not, we should drop has or adapt it to listenerCount(eventName) > 0.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

apps/meteor/client/hooks/useAppSlashCommands.ts (1)

17-25: Include queryClient in useDebouncedCallback dependencies to avoid stale closure.

queryClient is captured but deps are empty. It’s stable in practice, but adding it is safer.

-    100,
-    [],
+    100,
+    [queryClient],

packages/apps-engine/src/server/managers/AppSlashCommandManager.ts (1)

336-342: Good shift to explicit errors; include command context in messages.

Adding the command name improves debuggability without changing flow.

Apply:

-		if (!app) {
-			throw new Error('App not found');
-		}
-
-		if (!AppStatusUtils.isEnabled(await app.getStatus())) {
-			throw new Error('App not enabled');
+		if (!app) {
+			throw new Error(`App not found for command "${cmd}"`);
+		}
+
+		if (!AppStatusUtils.isEnabled(await app.getStatus())) {
+			throw new Error(`App not enabled for command "${cmd}"`);
 		}

packages/apps-engine/tests/server/managers/AppSlashCommandManager.spec.ts (1)

410-410: Tighten expectation by asserting the error message.

Validates the contract and guards against regressions.

Apply:

-		await Expect(() => ascm.executeCommand('failure', context)).toThrowAsync();
+		await Expect(() => ascm.executeCommand('failure', context)).toThrowErrorAsync(Error, /App not (found|enabled)/);

packages/apps-engine/src/server/AppManager.ts (3)

495-496: Risk of “ghost” slash commands while app is disabled.

Keeping slash commands registered during disable can surface commands to users that will now throw “App not enabled” at execution. Consider disabling commands at the bridge level while preserving in‑memory state.

Suggestion: add an AppSlashCommandManager API (e.g., disableCommandsForApp(appId)) that iterates touched/provided commands and calls bridge.doDisableCommand for each when keepSlashcommands is true in purge.

---

1054-1055: Registering commands during initialize may expose commands before enable.

This changes prior behavior and, combined with keepSlashcommands, increases the surface of “ghost” commands. Prefer registering on successful enable.

Apply:

-			await this.commandManager.registerCommands(app.getID());

And in enableApp (after successful enable, before releasing events):

 		if (enable) {
+			await this.commandManager.registerCommands(app.getID());
 			this.externalComponentManager.registerExternalComponents(app.getID());
 			await this.apiManager.registerApis(app.getID());
 			this.listenerManager.registerListeners(app);

---

1093-1096: If keeping slash commands, consider disabling them at the bridge.

Prevents user-visible commands from being runnable while app is disabled, without losing registration state.

Example (using a hypothetical manager API):

if (!opts.keepSlashcommands) {
  await this.commandManager.unregisterCommands(app.getID());
} else {
  await this.commandManager.disableCommandsForApp?.(app.getID());
}

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

Learnt from: CR
PR: RocketChat/Rocket.Chat#0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-09-16T22:08:51.490Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Use descriptive test names that clearly communicate expected behavior

apps/meteor/client/providers/CustomSoundProvider/lib/formatVolume.ts (1)

1-4: LGTM! Consider simplifying the precision handling.

The clamping and normalization logic is correct. The function properly handles out-of-range inputs and converts the 0-100 scale to the 0-1 range needed for audio volume.

However, the toPrecision(2) followed by Number() conversion seems overly complex for this use case. A simpler approach would be to return the normalized value directly:

 export const formatVolume = (volume: number) => {
 	const clamped = Math.max(0, Math.min(volume, 100));
-	return Number((clamped / 100).toPrecision(2));
+	return clamped / 100;
 };

This achieves the same result with clearer intent and avoids the string conversion roundtrip.

apps/meteor/client/providers/CustomSoundProvider/lib/formatVolume.spec.ts (1)

3-19: LGTM! Core functionality is well tested.

The test suite covers the essential cases: upper/lower bound clamping and mid-range normalization. The tests are clear and concise.

Optionally, consider adding tests for additional edge cases:

it('returns 0 if volume is 0', () => {
  expect(formatVolume(0)).toBe(0);
});

it('handles decimal inputs correctly', () => {
  expect(formatVolume(50.5)).toBe(0.505);
});

it('returns 0.01 if volume is 1', () => {
  expect(formatVolume(1)).toBe(0.01);
});

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.