feat(federation): add access-federation permission #37377
Conversation
|
Looks like this PR is ready to merge! 🎉 |
|
WalkthroughAdds an Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant App as AppServer
participant Auth as Authorization
participant Fed as FederationService
User->>App: Request federated action (create / join / invite)
App->>Auth: hasPermission(userId, "access-federation")?
alt allowed
Auth-->>App: allowed
App->>Fed: perform federation operation
Fed-->>App: success
App-->>User: success
else denied
Auth-->>App: denied
App-->>User: error-not-authorized-federation / 403 (NotAllowedError)
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (2)
🧰 Additional context used🧠 Learnings (9)📓 Common learnings📚 Learning: 2025-11-04T16:49:19.107ZApplied to files:
📚 Learning: 2025-09-19T15:15:04.642ZApplied to files:
📚 Learning: 2025-10-28T16:53:42.761ZApplied to files:
📚 Learning: 2025-09-25T09:59:26.461ZApplied to files:
📚 Learning: 2025-09-25T09:59:26.461ZApplied to files:
📚 Learning: 2025-09-25T09:59:26.461ZApplied to files:
📚 Learning: 2025-11-05T21:04:35.767ZApplied to files:
📚 Learning: 2025-09-15T06:21:00.139ZApplied to files:
🧬 Code graph analysis (3)ee/packages/federation-matrix/src/api/_matrix/invite.ts (2)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
apps/meteor/ee/server/hooks/federation/index.ts (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
🔇 Additional comments (7)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #37377 +/- ##
===========================================
- Coverage 67.08% 67.08% -0.01%
===========================================
Files 3419 3419
Lines 117938 117942 +4
Branches 21578 21578
===========================================
+ Hits 79114 79116 +2
- Misses 36132 36138 +6
+ Partials 2692 2688 -4
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
packages/i18n/src/locales/en.i18n.json (1)
5960-5960: Optional: align capitalization with similar labelsConsider “Access federation” to match “Access marketplace” style, unless “Federation” is a proper feature name you want capitalized.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (6)
apps/meteor/app/authorization/server/constant/permissions.ts(1 hunks)apps/meteor/app/lib/server/functions/createRoom.ts(3 hunks)apps/meteor/ee/server/hooks/federation/index.ts(2 hunks)apps/meteor/server/services/room/service.ts(1 hunks)ee/packages/federation-matrix/src/api/_matrix/invite.ts(4 hunks)packages/i18n/src/locales/en.i18n.json(2 hunks)
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
📚 Learning: 2025-10-28T16:53:42.761Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Applied to files:
apps/meteor/ee/server/hooks/federation/index.tspackages/i18n/src/locales/en.i18n.jsonapps/meteor/server/services/room/service.tsee/packages/federation-matrix/src/api/_matrix/invite.tsapps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-19T15:15:04.642Z
Learnt from: rodrigok
Repo: RocketChat/Rocket.Chat PR: 36991
File: apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts:219-221
Timestamp: 2025-09-19T15:15:04.642Z
Learning: The Federation_Matrix_homeserver_domain setting in apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts is part of the old federation system and is being deprecated/removed, so configuration issues with this setting should not be flagged for improvement.
Applied to files:
apps/meteor/ee/server/hooks/federation/index.tsapps/meteor/app/authorization/server/constant/permissions.tspackages/i18n/src/locales/en.i18n.jsonapps/meteor/server/services/room/service.tsee/packages/federation-matrix/src/api/_matrix/invite.tsapps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: UserBridge.doGetUserRoomIds in packages/apps-engine/src/server/bridges/UserBridge.ts has a bug where it implicitly returns undefined when the app lacks read permission (missing return statement in the else case of the permission check).
Applied to files:
apps/meteor/server/services/room/service.tsapps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings by mapping subscription documents to room IDs, never undefined, even when user has no room subscriptions.
Applied to files:
ee/packages/federation-matrix/src/api/_matrix/invite.tsapps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings (mapping subscription documents to room IDs), never undefined, even when user has no room subscriptions.
Applied to files:
ee/packages/federation-matrix/src/api/_matrix/invite.tsapps/meteor/app/lib/server/functions/createRoom.ts
🧬 Code graph analysis (3)
apps/meteor/ee/server/hooks/federation/index.ts (1)
packages/core-services/src/index.ts (1)
MeteorError(56-56)
apps/meteor/server/services/room/service.ts (1)
packages/core-services/src/index.ts (1)
Authorization(158-158)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
packages/core-typings/src/IRoom.ts (1)
isRoomNativeFederated(124-125)
🔇 Additional comments (7)
packages/i18n/src/locales/en.i18n.json (2)
5960-5961: Permission strings look goodLabels/descriptions are clear and consistent with nearby entries.
6260-6260: Verification complete — error key and permission properly integratedThe new error key
error-not-authorized-federationis correctly used across the codebase:
- Referenced in 3 error throws with matching message text
- Permission
access-federationis checked at 4 gateway points (room join, room create, federation hooks, matrix invite)- Permission properly defined with roles
['admin', 'user']- I18n entries present for both permission and error message
No inconsistencies or missing usages found.
apps/meteor/ee/server/hooks/federation/index.ts (1)
86-88: Confirm federated stub users retain access permissionThis hook also runs when we invite a remote Matrix user that we store as a local stub. Those stubs historically don’t inherit our
userrole, soAuthorization.hasPermissioncould return false and block outbound invites. Please double-check thatcreateOrUpdateFederatedUser(or the equivalent path) assigns a role carryingaccess-federation; otherwise cross-server invites will start failing.apps/meteor/app/authorization/server/constant/permissions.ts (1)
247-248: Permission wiring looks goodRegistering
access-federationfor the defaultadminanduserroles keeps existing behaviour while allowing admins to tighten access when needed.apps/meteor/server/services/room/service.ts (1)
117-119: Join flow guard in the right spotPlacing the
access-federationcheck ahead of join-code validation ensures unauthorized users fail fast with the dedicated error.ee/packages/federation-matrix/src/api/_matrix/invite.ts (1)
181-185: Invite acceptance respects the new permissionGuarding
joinRoomwithAuthorization.hasPermissionkeeps unattended backoff retries from persisting invites for users who shouldn’t federate.apps/meteor/app/lib/server/functions/createRoom.ts (1)
167-172: Creation gate aligns with federation policyThe
isRoomNativeFederatedcheck paired withhasPermissionAsynccleanly blocks users lacking federation access before we fan out to the rest of the create pipeline.
ricardogarim
force-pushed
the
feat/federation-permissions
branch
from
ea30f0e to
b9d4c21
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
279-279: Critical: Undefined variableshouldBeHandledByFederation.The variable
shouldBeHandledByFederationis used on lines 279 and 294 but is never defined in this function. According to the AI summary, the logic that computed this variable was removed. This will cause aReferenceErrorat runtime.You need to either:
- Recompute
shouldBeHandledByFederationbefore line 279, likely asconst shouldBeHandledByFederation = isRoomNativeFederated(extraData);- Or inline the check where needed
Apply this diff to fix the issue:
}); + const shouldBeHandledByFederation = isRoomNativeFederated(extraData); + await createUsersSubscriptions({ room, members, now, owner, options, shouldBeHandledByFederation });Also applies to: 294-294
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (6)
apps/meteor/app/authorization/server/constant/permissions.ts(1 hunks)apps/meteor/app/lib/server/functions/createRoom.ts(3 hunks)apps/meteor/ee/server/hooks/federation/index.ts(2 hunks)apps/meteor/server/services/room/service.ts(1 hunks)ee/packages/federation-matrix/src/api/_matrix/invite.ts(4 hunks)packages/i18n/src/locales/en.i18n.json(2 hunks)
🚧 Files skipped from review as they are similar to previous changes (3)
- apps/meteor/app/authorization/server/constant/permissions.ts
- ee/packages/federation-matrix/src/api/_matrix/invite.ts
- apps/meteor/server/services/room/service.ts
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
📚 Learning: 2025-10-28T16:53:42.761Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsapps/meteor/ee/server/hooks/federation/index.ts
📚 Learning: 2025-09-19T15:15:04.642Z
Learnt from: rodrigok
Repo: RocketChat/Rocket.Chat PR: 36991
File: apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts:219-221
Timestamp: 2025-09-19T15:15:04.642Z
Learning: The Federation_Matrix_homeserver_domain setting in apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts is part of the old federation system and is being deprecated/removed, so configuration issues with this setting should not be flagged for improvement.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsapps/meteor/ee/server/hooks/federation/index.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: UserBridge.doGetUserRoomIds in packages/apps-engine/src/server/bridges/UserBridge.ts has a bug where it implicitly returns undefined when the app lacks read permission (missing return statement in the else case of the permission check).
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings (mapping subscription documents to room IDs), never undefined, even when user has no room subscriptions.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings by mapping subscription documents to room IDs, never undefined, even when user has no room subscriptions.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.ts
🧬 Code graph analysis (2)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
packages/core-typings/src/IRoom.ts (1)
isRoomNativeFederated(124-125)
apps/meteor/ee/server/hooks/federation/index.ts (1)
packages/core-services/src/index.ts (1)
MeteorError(56-56)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (6)
- GitHub Check: 🔨 Test Storybook / Test Storybook
- GitHub Check: 🔨 Test Unit / Unit Tests
- GitHub Check: 🔎 Code Check / TypeScript
- GitHub Check: 📦 Meteor Build - coverage
- GitHub Check: CodeQL-Build
- GitHub Check: CodeQL-Build
🔇 Additional comments (5)
packages/i18n/src/locales/en.i18n.json (1)
5960-5961: Permission strings and references verified — all consistent.The new i18n keys are used correctly across the codebase with exact matching in all 5 permission checks. The permission is properly registered with appropriate roles and error handling is in place. No issues found.
apps/meteor/ee/server/hooks/federation/index.ts (1)
1-1: LGTM!The import additions correctly bring in
AuthorizationandMeteorErrorneeded for the permission check.apps/meteor/app/lib/server/functions/createRoom.ts (3)
6-6: LGTM!The import of
isRoomNativeFederatedis necessary for the federation permission check.
17-17: LGTM!The import of
hasPermissionAsyncis necessary for checking the federation permission.
167-171: LGTM!The permission check correctly gates federation room creation, ensuring only users with the
access-federationpermission can create federated rooms. The error message is clear and includes the method context.
ricardogarim
force-pushed
the
feat/federation-permissions
branch
from
408bdfe to
6daa046
Compare
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
ee/packages/federation-matrix/src/api/_matrix/invite.ts (1)
152-155: Adjust log level for expected NotAllowed errors.These denials are the new, expected outcome when a user lacks
access-federation, so logging them as errors will create unnecessary noise. Dropping this toinfo(orwarn) keeps the signal clean while still capturing the context.Apply this diff:
- logger.error('Authorization error, not retrying:', e); + logger.info('Authorization check failed, not retrying:', e);
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (2)
apps/meteor/app/lib/server/functions/createRoom.ts(3 hunks)ee/packages/federation-matrix/src/api/_matrix/invite.ts(4 hunks)
🧰 Additional context used
🧠 Learnings (7)
📓 Common learnings
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37377
File: apps/meteor/ee/server/hooks/federation/index.ts:86-88
Timestamp: 2025-11-04T16:49:19.097Z
Learning: In Rocket.Chat's federation system (apps/meteor/ee/server/hooks/federation/), permission checks follow two distinct patterns: (1) User-initiated federation actions (creating rooms, adding users to federated rooms, joining from invites) should throw MeteorError to inform users they lack 'access-federation' permission. (2) Remote server-initiated federation events should silently skip/ignore when users lack permission. The beforeAddUserToRoom hook only executes for local user-initiated actions, so throwing an error there is correct. Remote federation events are handled separately by the federation Matrix package with silent skipping logic.
📚 Learning: 2025-11-04T16:49:19.097Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37377
File: apps/meteor/ee/server/hooks/federation/index.ts:86-88
Timestamp: 2025-11-04T16:49:19.097Z
Learning: In Rocket.Chat's federation system (apps/meteor/ee/server/hooks/federation/), permission checks follow two distinct patterns: (1) User-initiated federation actions (creating rooms, adding users to federated rooms, joining from invites) should throw MeteorError to inform users they lack 'access-federation' permission. (2) Remote server-initiated federation events should silently skip/ignore when users lack permission. The beforeAddUserToRoom hook only executes for local user-initiated actions, so throwing an error there is correct. Remote federation events are handled separately by the federation Matrix package with silent skipping logic.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsee/packages/federation-matrix/src/api/_matrix/invite.ts
📚 Learning: 2025-10-28T16:53:42.761Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsee/packages/federation-matrix/src/api/_matrix/invite.ts
📚 Learning: 2025-09-19T15:15:04.642Z
Learnt from: rodrigok
Repo: RocketChat/Rocket.Chat PR: 36991
File: apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts:219-221
Timestamp: 2025-09-19T15:15:04.642Z
Learning: The Federation_Matrix_homeserver_domain setting in apps/meteor/server/services/federation/infrastructure/rocket-chat/adapters/Settings.ts is part of the old federation system and is being deprecated/removed, so configuration issues with this setting should not be flagged for improvement.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsee/packages/federation-matrix/src/api/_matrix/invite.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: UserBridge.doGetUserRoomIds in packages/apps-engine/src/server/bridges/UserBridge.ts has a bug where it implicitly returns undefined when the app lacks read permission (missing return statement in the else case of the permission check).
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings (mapping subscription documents to room IDs), never undefined, even when user has no room subscriptions.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsee/packages/federation-matrix/src/api/_matrix/invite.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings by mapping subscription documents to room IDs, never undefined, even when user has no room subscriptions.
Applied to files:
apps/meteor/app/lib/server/functions/createRoom.tsee/packages/federation-matrix/src/api/_matrix/invite.ts
🧬 Code graph analysis (1)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
packages/core-typings/src/IRoom.ts (1)
isRoomNativeFederated(124-125)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: CodeQL-Build
🔇 Additional comments (1)
apps/meteor/app/lib/server/functions/createRoom.ts (1)
168-172: Federation permission guard looks correct.Great to see the create-room path enforcing
access-federationup front and surfacing the Meteor error to the caller. This aligns with the documented pattern for user-initiated federation flows. Based on learnings
ggazzo
left a comment
ggazzo
left a comment
There was a problem hiding this comment.
missing the logic behind the auto accept
ricardogarim
force-pushed
the
feat/federation-permissions
branch
from
6daa046 to
d2e735c
Compare
ggazzo
added
the
stat: QA assured
dionisio-bot
bot
added
the
stat: ready to merge
Proposed changes (including videos or screenshots)
As per FDR-251, this change introduces a new permission called
access-federation. This permission controls whether a user is allowed to perform federation-related actions — specifically creating or joining a federated room, which are the main entry points for users interacting with federation resources.If a user does not have this permission, an error indicating a lack of permission will be displayed. For users without the permission who receive an invite, the system will return controller level error. Implementing a rejection response would require refactoring parts of the code, so for now, the invite will remain open without a response.
Issue(s)
Steps to test or reproduce
Screen.Recording.2025-11-06.at.08.27.53.mov
Summary by CodeRabbit
New Features
Bug Fixes / Security
Documentation