chore: ABAC statistics #37606
chore: ABAC statistics #37606
Conversation
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
WalkthroughAdds ABAC usage metrics to the daily Statistics pipeline: exposes ABAC fields in IStats, adds model methods to count attributes/values/rooms, and enqueues ABAC-count operations when the ABAC license module is present. Changes
Sequence Diagram(s)sequenceDiagram
participant Stats as Statistics Job
participant License as License
participant AbacAttrs as AbacAttributes Model
participant Rooms as Rooms Model
participant Promise as Promise.all
Stats->>License: hasModule('abac')
alt ABAC licensed
Stats->>AbacAttrs: estimatedDocumentCount()
Stats->>AbacAttrs: countTotalValues()
Stats->>Rooms: countAbacEnabled()
AbacAttrs-->>Stats: abacTotalAttributes / abacTotalAttributeValues
Rooms-->>Stats: abacRoomsEnrolled
Stats->>Promise: resolve([..., abacProms])
Promise-->>Stats: resolved ABAC metrics
else ABAC not licensed
Note over Stats: ABAC metrics skipped (no calls)
end
Stats->>Stats: merge metrics into IStats payload
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches✅ Passed checks (5 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
📜 Recent review detailsConfiguration used: CodeRabbit UI Review profile: CHILL Plan: Pro Disabled knowledge base sources:
📒 Files selected for processing (1)
🧰 Additional context used📓 Path-based instructions (1)**/*.{ts,tsx,js}📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
Files:
🧠 Learnings (4)📓 Common learnings📚 Learning: 2025-10-27T14:38:46.994ZApplied to files:
📚 Learning: 2025-10-24T17:32:05.348ZApplied to files:
📚 Learning: 2025-09-25T09:59:26.461ZApplied to files:
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
🔇 Additional comments (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
Disabled knowledge base sources:
- Jira integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (6)
apps/meteor/app/statistics/server/lib/statistics.ts(3 hunks)packages/core-typings/src/IStats.ts(1 hunks)packages/model-typings/src/models/IAbacAttributesModel.ts(1 hunks)packages/model-typings/src/models/IRoomsModel.ts(1 hunks)packages/models/src/models/AbacAttributes.ts(1 hunks)packages/models/src/models/Rooms.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
packages/models/src/models/AbacAttributes.tspackages/model-typings/src/models/IAbacAttributesModel.tspackages/model-typings/src/models/IRoomsModel.tspackages/models/src/models/Rooms.tsapps/meteor/app/statistics/server/lib/statistics.tspackages/core-typings/src/IStats.ts
🧠 Learnings (5)
📓 Common learnings
Learnt from: KevLehman
Repo: RocketChat/Rocket.Chat PR: 37303
File: apps/meteor/tests/end-to-end/api/abac.ts:1125-1137
Timestamp: 2025-10-27T14:38:46.994Z
Learning: In Rocket.Chat ABAC feature, when ABAC is disabled globally (ABAC_Enabled setting is false), room-level ABAC attributes are not evaluated when changing room types. This means converting a private room to public will succeed even if the room has ABAC attributes, as long as the global ABAC setting is disabled.
📚 Learning: 2025-10-27T14:38:46.994Z
Learnt from: KevLehman
Repo: RocketChat/Rocket.Chat PR: 37303
File: apps/meteor/tests/end-to-end/api/abac.ts:1125-1137
Timestamp: 2025-10-27T14:38:46.994Z
Learning: In Rocket.Chat ABAC feature, when ABAC is disabled globally (ABAC_Enabled setting is false), room-level ABAC attributes are not evaluated when changing room types. This means converting a private room to public will succeed even if the room has ABAC attributes, as long as the global ABAC setting is disabled.
Applied to files:
packages/models/src/models/Rooms.ts
📚 Learning: 2025-11-07T14:50:33.544Z
Learnt from: KevLehman
Repo: RocketChat/Rocket.Chat PR: 37423
File: packages/i18n/src/locales/en.i18n.json:18-18
Timestamp: 2025-11-07T14:50:33.544Z
Learning: Rocket.Chat settings: in apps/meteor/ee/server/settings/abac.ts, the Abac_Cache_Decision_Time_Seconds setting uses invalidValue: 0 as the fallback when ABAC is unlicensed. With a valid license, admins can still set the value to 0 to intentionally disable the ABAC decision cache.
Applied to files:
apps/meteor/app/statistics/server/lib/statistics.ts
📚 Learning: 2025-10-28T16:53:42.761Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.
Applied to files:
apps/meteor/app/statistics/server/lib/statistics.ts
📚 Learning: 2025-10-24T17:32:05.348Z
Learnt from: KevLehman
Repo: RocketChat/Rocket.Chat PR: 37299
File: apps/meteor/ee/server/lib/ldap/Manager.ts:438-454
Timestamp: 2025-10-24T17:32:05.348Z
Learning: In Rocket.Chat, ABAC attributes can only be set on private rooms and teams (type 'p'), not on public rooms (type 'c'). Therefore, when checking for ABAC-protected rooms/teams during LDAP sync or similar operations, it's sufficient to query only private rooms using methods like `findPrivateRoomsByIdsWithAbacAttributes`.
Applied to files:
apps/meteor/app/statistics/server/lib/statistics.ts
🧬 Code graph analysis (1)
apps/meteor/app/statistics/server/lib/statistics.ts (2)
packages/core-services/src/index.ts (1)
License(164-164)packages/models/src/index.ts (1)
AbacAttributes(231-231)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (4)
- GitHub Check: 🔨 Test Unit / Unit Tests
- GitHub Check: 🔎 Code Check / Code Lint
- GitHub Check: 🔎 Code Check / TypeScript
- GitHub Check: 📦 Meteor Build (coverage)
🔇 Additional comments (6)
packages/model-typings/src/models/IRoomsModel.ts (1)
128-129: LGTM!The interface addition is clean and follows the existing pattern.
packages/model-typings/src/models/IAbacAttributesModel.ts (1)
9-9: LGTM!Clean interface addition for counting total attribute values.
packages/models/src/models/AbacAttributes.ts (1)
19-38: LGTM!The aggregation correctly sums the size of all values arrays across documents, handling missing fields with
$ifNulland returning 0 when no documents exist.packages/core-typings/src/IStats.ts (1)
274-277: LGTM!The ABAC statistics fields are properly typed and align with the PR objectives. The optional nature of these fields is appropriate since they're only populated when the ABAC module is licensed.
apps/meteor/app/statistics/server/lib/statistics.ts (2)
7-7: LGTM!The License and AbacAttributes imports are correctly added to enable ABAC statistics collection.
Also applies to: 29-29
614-632: Approve ABAC statistics collection with one dependency.The ABAC statistics implementation follows the existing patterns in this file correctly:
- License gating is appropriate
- Async operations are properly pushed to
statsPms- Uses
estimatedDocumentCount()for performance (acceptable for statistics)The accuracy of
abacRoomsEnrolleddepends on fixing theRooms.countAbacEnabled()method to exclude archived rooms as flagged in my other comment.
📦 Docker Image Size Report📈 Changes
📊 Historical Trend---
config:
theme: "dark"
xyChart:
width: 900
height: 400
---
xychart
title "Image Size Evolution by Service (Last 30 Days + This PR)"
x-axis ["11/15 22:28", "11/16 01:28", "11/17 23:50", "11/18 22:53", "11/19 23:02", "11/21 16:49", "11/24 17:34", "11/25 17:50 (PR)"]
y-axis "Size (GB)" 0 --> 0.5
line "account-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
line "authorization-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
line "ddp-streamer-service" [0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12, 0.12]
line "omnichannel-transcript-service" [0.14, 0.14, 0.14, 0.14, 0.14, 0.13, 0.13, 0.13]
line "presence-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
line "queue-worker-service" [0.14, 0.14, 0.14, 0.14, 0.14, 0.13, 0.13, 0.13]
line "rocketchat" [0.36, 0.36, 0.35, 0.35, 0.35, 0.34, 0.34, 0.35]
line "stream-hub-service" [0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11, 0.11]
Statistics (last 7 days):
ℹ️ About this reportThis report compares Docker image sizes from this build against the
Updated: Tue, 25 Nov 2025 17:50:06 GMT |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## feat/abac #37606 +/- ##
============================================
Coverage ? 54.21%
============================================
Files ? 2661
Lines ? 50149
Branches ? 11213
============================================
Hits ? 27188
Misses ? 20813
Partials ? 2148
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
Proposed changes (including videos or screenshots)
Issue(s)
https://rocketchat.atlassian.net/browse/ABAC-58
Steps to test or reproduce
Further comments
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.