feat: Prevent ABAC managed rooms becoming public while ABAC is active #37303
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
Contributor
WalkthroughThis PR enforces ABAC protection by preventing ABAC-managed private rooms and team rooms from being converted to public. It adds validation logic in Changes
Sequence DiagramsequenceDiagram
participant User
participant API as saveRoomSettings API
participant Room DB
participant Validation
User->>API: Request room type change (private → public)
API->>Room DB: Fetch room & ABAC status
Room DB-->>API: Return room data
alt ABAC enabled AND has ABAC attributes
API->>Validation: Check if converting away from private
Validation-->>API: Validation fails
API-->>User: ❌ Error: Cannot convert ABAC room to public
else ABAC disabled OR no ABAC attributes
API->>Room DB: Update room type
Room DB-->>API: Success
API-->>User: ✅ Room type changed
end
Estimated code review effort🎯 2 (Simple) | ⏱️ ~15 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning, 1 inconclusive)
✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feat/abac #37303 +/- ##
=============================================
- Coverage 70.08% 70.04% -0.04%
=============================================
Files 3032 3032
Lines 103981 103987 +6
Branches 18488 18490 +2
=============================================
- Hits 72875 72841 -34
- Misses 29151 29196 +45
+ Partials 1955 1950 -5
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
apps/meteor/tests/end-to-end/api/abac.ts (3)
1113-1123: Assert structured error code and 403 (not 400).Change expectation to match API requirement and new error code.
- .expect(400) - .expect((res) => { - expect(res.body).to.have.property('success', false); - expect(res.body).to.have.property('error').to.include('Changing an ABAC managed private room to public is not allowed'); - }); + .expect(403) + .expect((res) => { + expect(res.body).to.have.property('success', false); + expect(res.body).to.have.property('error', 'error-abac-room-cannot-be-public'); + });If the REST layer currently maps Meteor.Error to 400, adjust server to emit 403 (statusCode: 403) as proposed, or update the REST mapping accordingly.
1196-1232: Team main room conversion: apply same spec (403 + code; block even when globally disabled).Mirror the room flow: first fail while ABAC disabled, then succeed after deleting attributes from the main room.
- it('should allow converting private team (main room) with ABAC attributes to public when ABAC disabled', async () => { - await updateSetting('ABAC_Enabled', false); - await request.post(`${v1}/rooms.saveRoomSettings`).set(credentials).send({ rid: mainRoomIdWithAttrAbacDisabled, roomType: 'c' }) - .expect(200) - .expect((res) => { expect(res.body.success).to.be.true; }); - }); + it('should still fail while ABAC disabled (attributes present), then succeed after removing attributes (team main room)', async () => { + await updateSetting('ABAC_Enabled', false); + await request + .post(`${v1}/rooms.saveRoomSettings`) + .set(credentials) + .send({ rid: mainRoomIdWithAttrAbacDisabled, roomType: 'c' }) + .expect(403) + .expect((res) => { expect(res.body.error).to.equal('error-abac-room-cannot-be-public'); }); + await request.delete(`${v1}/abac/room/${mainRoomIdWithAttrAbacDisabled}/attributes`).set(credentials).expect(200); + await request + .post(`${v1}/rooms.saveRoomSettings`) + .set(credentials) + .send({ rid: mainRoomIdWithAttrAbacDisabled, roomType: 'c' }) + .expect(200) + .expect((res) => { expect(res.body.success).to.be.true; }); + });
1059-1137: Add missing coverage: public/DM/discussion rooms cannot receive ABAC; enabling ABAC on non-private must fail.Add a small case creating a public room and asserting POST /abac/room/:rid/attributes/:key fails with error-abac-requires-private-room.
Example:
it('should fail adding ABAC attribute to public room (requires private)', async () => { const pub = (await createRoom({ type: 'c', name: `abac-public-${Date.now()}` })).body.channel; await request .post(`${v1}/abac/room/${pub._id}/attributes/${attrKey}`) .set(credentials) .send({ values: ['val1'] }) .expect(422) .expect((res) => { expect(res.body.error).to.equal('error-abac-requires-private-room'); }); await deleteRoom({ type: 'c', roomId: pub._id }); });Happy to send a patch.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
apps/meteor/app/channel-settings/server/methods/saveRoomSettings.ts(2 hunks)apps/meteor/tests/end-to-end/api/abac.ts(1 hunks)
🧰 Additional context used
🧠 Learnings (2)
📓 Common learnings
Learnt from: KevLehman
PR: RocketChat/Rocket.Chat#37299
File: apps/meteor/ee/server/lib/ldap/Manager.ts:438-454
Timestamp: 2025-10-24T17:32:05.338Z
Learning: In Rocket.Chat, ABAC attributes can only be set on private rooms and teams (type 'p'), not on public rooms (type 'c'). Therefore, when checking for ABAC-protected rooms/teams during LDAP sync or similar operations, it's sufficient to query only private rooms using methods like `findPrivateRoomsByIdsWithAbacAttributes`.
📚 Learning: 2025-10-24T17:32:05.338Z
Learnt from: KevLehman
PR: RocketChat/Rocket.Chat#37299
File: apps/meteor/ee/server/lib/ldap/Manager.ts:438-454
Timestamp: 2025-10-24T17:32:05.338Z
Learning: In Rocket.Chat, ABAC attributes can only be set on private rooms and teams (type 'p'), not on public rooms (type 'c'). Therefore, when checking for ABAC-protected rooms/teams during LDAP sync or similar operations, it's sufficient to query only private rooms using methods like `findPrivateRoomsByIdsWithAbacAttributes`.
Applied to files:
apps/meteor/app/channel-settings/server/methods/saveRoomSettings.ts
🧬 Code graph analysis (1)
apps/meteor/tests/end-to-end/api/abac.ts (2)
apps/meteor/tests/data/api-data.ts (2)
request(10-10)credentials(39-42)apps/meteor/tests/e2e/utils/create-target-channel.ts (2)
deleteRoom(48-50)deleteTeam(66-68)
tassoevan
approved these changes
Oct 27, 2025
KevLehman
added a commit
that referenced
this pull request
Oct 30, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 5, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 6, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 12, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 18, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 24, 2025
KevLehman
added a commit
that referenced
this pull request
Nov 27, 2025
KevLehman
added a commit
that referenced
this pull request
Dec 1, 2025
KevLehman
added a commit
that referenced
this pull request
Dec 2, 2025
KevLehman
added a commit
that referenced
this pull request
Dec 8, 2025
Merged
KevLehman
added a commit
that referenced
this pull request
Dec 10, 2025
Merged
KevLehman
added a commit
that referenced
this pull request
Dec 15, 2025
MartinSchoeler
pushed a commit
that referenced
this pull request
Dec 17, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Proposed changes (including videos or screenshots)
Issue(s)
https://rocketchat.atlassian.net/browse/ABAC-10
Steps to test or reproduce
Further comments
Summary by CodeRabbit