diff --git a/apps/meteor/app/api/server/default/info.ts b/apps/meteor/app/api/server/default/info.ts index 9f2a9d79e4a54..173a733d13b47 100644 --- a/apps/meteor/app/api/server/default/info.ts +++ b/apps/meteor/app/api/server/default/info.ts @@ -1,5 +1,4 @@ import { API } from '../api'; -import { getLoggedInUser } from '../helpers/getLoggedInUser'; import { getServerInfo } from '../lib/getServerInfo'; API.default.addRoute( @@ -7,8 +6,7 @@ API.default.addRoute( { authRequired: false }, { async get() { - const user = await getLoggedInUser(this.request); - return API.v1.success(await getServerInfo(user?._id)); + return API.v1.success(await getServerInfo(this.userId)); }, }, ); diff --git a/apps/meteor/app/api/server/helpers/getLoggedInUser.ts b/apps/meteor/app/api/server/helpers/getLoggedInUser.ts deleted file mode 100644 index d3fc562eeb20f..0000000000000 --- a/apps/meteor/app/api/server/helpers/getLoggedInUser.ts +++ /dev/null @@ -1,13 +0,0 @@ -import type { IUser } from '@rocket.chat/core-typings'; -import { Users } from '@rocket.chat/models'; -import { Accounts } from 'meteor/accounts-base'; - -export async function getLoggedInUser(request: Request): Promise | null> { - const token = request.headers.get('x-auth-token'); - const userId = request.headers.get('x-user-id'); - if (!token || !userId || typeof token !== 'string' || typeof userId !== 'string') { - return null; - } - - return Users.findOneByIdAndLoginToken(userId, Accounts._hashLoginToken(token), { projection: { username: 1 } }); -} diff --git a/apps/meteor/app/api/server/index.ts b/apps/meteor/app/api/server/index.ts index 59986d6e2da87..176141af83e08 100644 --- a/apps/meteor/app/api/server/index.ts +++ b/apps/meteor/app/api/server/index.ts @@ -1,6 +1,5 @@ import './ajv'; import './helpers/composeRoomWithLastMessage'; -import './helpers/getLoggedInUser'; import './helpers/getPaginationItems'; import './helpers/getUserFromParams'; import './helpers/getUserInfo'; diff --git a/apps/meteor/app/api/server/v1/channels.ts b/apps/meteor/app/api/server/v1/channels.ts index 0aa24f5097b04..5dfdc22c237ee 100644 --- a/apps/meteor/app/api/server/v1/channels.ts +++ b/apps/meteor/app/api/server/v1/channels.ts @@ -54,7 +54,6 @@ import { normalizeMessagesForUser } from '../../../utils/server/lib/normalizeMes import { API } from '../api'; import { addUserToFileObj } from '../helpers/addUserToFileObj'; import { composeRoomWithLastMessage } from '../helpers/composeRoomWithLastMessage'; -import { getLoggedInUser } from '../helpers/getLoggedInUser'; import { getPaginationItems } from '../helpers/getPaginationItems'; import { getUserFromParams, getUserListFromParams } from '../helpers/getUserFromParams'; @@ -1147,9 +1146,7 @@ API.v1.addRoute( return API.v1.failure('Channel does not exists'); } - const user = await getLoggedInUser(this.request); - - if (!room || !user || !(await canAccessRoomAsync(room, user))) { + if (!(await canAccessRoomAsync(room, this.user))) { throw new Meteor.Error('error-not-allowed', 'Not Allowed'); } diff --git a/apps/meteor/app/api/server/v1/commands.ts b/apps/meteor/app/api/server/v1/commands.ts index 59b90baafa8a1..9347536cafd52 100644 --- a/apps/meteor/app/api/server/v1/commands.ts +++ b/apps/meteor/app/api/server/v1/commands.ts @@ -8,7 +8,6 @@ import { executeSlashCommandPreview } from '../../../lib/server/methods/executeS import { getSlashCommandPreviews } from '../../../lib/server/methods/getSlashCommandPreviews'; import { slashCommands } from '../../../utils/server/slashCommand'; import { API } from '../api'; -import { getLoggedInUser } from '../helpers/getLoggedInUser'; import { getPaginationItems } from '../helpers/getPaginationItems'; API.v1.addRoute( @@ -248,7 +247,6 @@ API.v1.addRoute( // Expects these query params: command: 'giphy', params: 'mine', roomId: 'value' async get() { const query = this.queryParams; - const user = await getLoggedInUser(this.request); if (typeof query.command !== 'string') { return API.v1.failure('You must provide a command to get the previews from.'); @@ -267,7 +265,7 @@ API.v1.addRoute( return API.v1.failure('The command provided does not exist (or is disabled).'); } - if (!(await canAccessRoomIdAsync(query.roomId, user?._id))) { + if (!(await canAccessRoomIdAsync(query.roomId, this.userId))) { return API.v1.forbidden(); } diff --git a/apps/meteor/app/api/server/v1/groups.ts b/apps/meteor/app/api/server/v1/groups.ts index 3fbe9c967a8e9..c91afe561ed5d 100644 --- a/apps/meteor/app/api/server/v1/groups.ts +++ b/apps/meteor/app/api/server/v1/groups.ts @@ -34,7 +34,6 @@ import { normalizeMessagesForUser } from '../../../utils/server/lib/normalizeMes import { API } from '../api'; import { addUserToFileObj } from '../helpers/addUserToFileObj'; import { composeRoomWithLastMessage } from '../helpers/composeRoomWithLastMessage'; -import { getLoggedInUser } from '../helpers/getLoggedInUser'; import { getPaginationItems } from '../helpers/getPaginationItems'; import { getUserFromParams, getUserListFromParams } from '../helpers/getUserFromParams'; @@ -839,12 +838,7 @@ API.v1.addRoute( return API.v1.failure('Group does not exists'); } - const user = await getLoggedInUser(this.request); - if (!user) { - return API.v1.failure('User does not exists'); - } - - if (!(await canAccessRoomAsync(room, user))) { + if (!(await canAccessRoomAsync(room, this.user))) { throw new Meteor.Error('error-not-allowed', 'Not Allowed'); } diff --git a/apps/meteor/app/api/server/v1/misc.ts b/apps/meteor/app/api/server/v1/misc.ts index c679a42582924..852351a3c5ded 100644 --- a/apps/meteor/app/api/server/v1/misc.ts +++ b/apps/meteor/app/api/server/v1/misc.ts @@ -29,7 +29,6 @@ import { getBaseUserFields } from '../../../utils/server/functions/getBaseUserFi import { isSMTPConfigured } from '../../../utils/server/functions/isSMTPConfigured'; import { getURL } from '../../../utils/server/getURL'; import { API } from '../api'; -import { getLoggedInUser } from '../helpers/getLoggedInUser'; import { getPaginationItems } from '../helpers/getPaginationItems'; import { getUserFromParams } from '../helpers/getUserFromParams'; import { getUserInfo } from '../helpers/getUserInfo'; @@ -244,7 +243,7 @@ API.v1.addRoute( text = `#${channel}`; break; case 'user': - if (settings.get('API_Shield_user_require_auth') && !(await getLoggedInUser(this.request))) { + if (settings.get('API_Shield_user_require_auth') && !this.user) { return API.v1.failure('You must be logged in to do this.'); } const user = await getUserFromParams(this.queryParams);