From 2243b8ae66d7a5dd148808cf1c09b7629c672728 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Fri, 20 Mar 2026 15:35:02 +0530
Subject: [PATCH 01/43] add deprecation warning

---
 apps/meteor/app/custom-oauth/server/custom_oauth_server.js | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/meteor/app/custom-oauth/server/custom_oauth_server.js b/apps/meteor/app/custom-oauth/server/custom_oauth_server.js
index cba2e7cc035c9..9bc2c686ac331 100644
--- a/apps/meteor/app/custom-oauth/server/custom_oauth_server.js
+++ b/apps/meteor/app/custom-oauth/server/custom_oauth_server.js
@@ -23,6 +23,9 @@ const logger = new Logger('CustomOAuth');
 const Services = {};
 const BeforeUpdateOrCreateUserFromExternalService = [];
 
+/**
+ * @deprecated in favor of new Passport OAuth implementation.
+ */
 export class CustomOAuth {
 	constructor(name, options) {
 		logger.debug({ msg: 'Init CustomOAuth', name, options });

From b0cd754864a740431173d1f380c6c21b6ee1da26 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Fri, 27 Mar 2026 18:55:49 +0530
Subject: [PATCH 02/43] chore: Passport login UI (#39848)

---
 apps/meteor/client/startup/startup.ts                  |  9 +++++++--
 .../web-ui-registration/src/LoginServicesButton.tsx    | 10 +++++++++-
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/apps/meteor/client/startup/startup.ts b/apps/meteor/client/startup/startup.ts
index 45fa6c12b1bbb..30c4a381e9d85 100644
--- a/apps/meteor/client/startup/startup.ts
+++ b/apps/meteor/client/startup/startup.ts
@@ -12,8 +12,7 @@ import { watchUserId } from '../meteor/user';
 Meteor.startup(() => {
 	let status: UserStatus | undefined = undefined;
 	Tracker.autorun(async () => {
-		const uid = watchUserId();
-		if (!uid) {
+		if (Meteor.loggingOut()) {
 			removeLocalUserData();
 			return;
 		}
@@ -26,6 +25,12 @@ Meteor.startup(() => {
 			return;
 		}
 
+		const uid = watchUserId();
+
+		if (!uid) {
+			return;
+		}
+
 		const user = await synchronizeUserData(uid);
 		if (!user) {
 			return;
diff --git a/packages/web-ui-registration/src/LoginServicesButton.tsx b/packages/web-ui-registration/src/LoginServicesButton.tsx
index 7eb22ad5dbfc6..e5488a18ace07 100644
--- a/packages/web-ui-registration/src/LoginServicesButton.tsx
+++ b/packages/web-ui-registration/src/LoginServicesButton.tsx
@@ -1,4 +1,5 @@
 import { Button } from '@rocket.chat/fuselage';
+import { useLocalStorage } from '@rocket.chat/fuselage-hooks';
 import type { Keys as IconName } from '@rocket.chat/icons';
 import type { LoginService } from '@rocket.chat/ui-contexts';
 import { useLoginWithService } from '@rocket.chat/ui-contexts';
@@ -27,14 +28,21 @@ const LoginServicesButton = <T extends LoginService>({
 	const { t } = useTranslation();
 	const handler = useLoginWithService({ service, buttonLabelText, ...props });
 
+	const [isLegacyOAuthEnabled] = useLocalStorage<boolean>('useLegacyOAuth', false);
+
 	const handleOnClick = useCallback(() => {
+		if (!isLegacyOAuthEnabled) {
+			window.location.href = `/oauth/${service}`;
+			return;
+		}
+
 		handler().catch((e: { error?: LoginErrors; reason?: string }) => {
 			if (!e.error || typeof e.error !== 'string') {
 				return;
 			}
 			setError?.([e.error, e.reason]);
 		});
-	}, [handler, setError]);
+	}, [handler, setError, isLegacyOAuthEnabled, service]);
 
 	return (
 		<Button

From 68891339203d4e83de04a8841576d8f5bef95eaa Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:48:20 +0530
Subject: [PATCH 03/43] feat: Configure Passport (#39604)

---
 apps/meteor/package.json                      |   9 +
 .../server/configuration/configurePassport.ts |  50 +++++
 apps/meteor/server/configuration/index.ts     |   2 +
 .../lib/oauth/configureOAuthServices.ts       |  89 ++++++++
 .../lib/oauth/createOAuthServiceConfig.ts     |  25 +++
 .../server/lib/oauth/getOAuthServices.ts      |  33 +++
 apps/meteor/server/lib/oauth/oauthConfigs.ts  |  21 ++
 packages/core-typings/src/IUser.ts            |   2 +-
 yarn.lock                                     | 197 +++++++++++++++++-
 9 files changed, 422 insertions(+), 6 deletions(-)
 create mode 100644 apps/meteor/server/configuration/configurePassport.ts
 create mode 100644 apps/meteor/server/lib/oauth/configureOAuthServices.ts
 create mode 100644 apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
 create mode 100644 apps/meteor/server/lib/oauth/getOAuthServices.ts
 create mode 100644 apps/meteor/server/lib/oauth/oauthConfigs.ts

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index f14a6647d08da..45b3f4d9369a6 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -201,6 +201,7 @@
 		"expiry-map": "^2.0.0",
 		"express": "^4.21.2",
 		"express-rate-limit": "^5.5.1",
+		"express-session": "^1.19.0",
 		"fastq": "^1.17.1",
 		"fflate": "^0.8.2",
 		"file-type": "^16.5.4",
@@ -256,6 +257,10 @@
 		"object-path": "^0.11.8",
 		"overlayscrollbars": "^2.11.4",
 		"overlayscrollbars-react": "^0.5.6",
+		"passport": "^0.7.0",
+		"passport-facebook": "^3.0.0",
+		"passport-facebook2": "^1.0.3",
+		"passport-github2": "^0.1.12",
 		"path": "^0.12.7",
 		"path-to-regexp": "^6.3.0",
 		"pino": "^8.21.0",
@@ -349,6 +354,7 @@
 		"@types/ejson": "^2.2.2",
 		"@types/express": "^4.17.25",
 		"@types/express-rate-limit": "^5.1.3",
+		"@types/express-session": "^1",
 		"@types/google-libphonenumber": "^7.4.30",
 		"@types/gravatar": "^1.8.6",
 		"@types/he": "^1.2.3",
@@ -378,6 +384,9 @@
 		"@types/oauth2-server": "^3.0.18",
 		"@types/object-path": "^0.11.4",
 		"@types/parseurl": "^1.3.3",
+		"@types/passport": "^1.0.17",
+		"@types/passport-facebook": "^3.0.4",
+		"@types/passport-github2": "^1.2.9",
 		"@types/prometheus-gc-stats": "^0.6.4",
 		"@types/proxy-from-env": "^1.0.4",
 		"@types/proxyquire": "^1.3.31",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
new file mode 100644
index 0000000000000..dd6e17e1fba29
--- /dev/null
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -0,0 +1,50 @@
+import { Users } from '@rocket.chat/models';
+import { Random } from '@rocket.chat/random';
+import express from 'express';
+import session from 'express-session';
+import { WebApp } from 'meteor/webapp';
+import passport from 'passport';
+
+import type { ICachedSettings } from '../../app/settings/server/CachedSettings';
+import { configureOAuthServices } from '../lib/oauth/configureOAuthServices';
+import { createOAuthServiceConfig } from '../lib/oauth/createOAuthServiceConfig';
+import { getOAuthServices } from '../lib/oauth/getOAuthServices';
+
+export const oAuthRouter = express();
+
+oAuthRouter.use(
+	session({
+		name: 'oauth',
+		secret: Random.secret(),
+		resave: false,
+		saveUninitialized: false,
+		cookie: {
+			httpOnly: true,
+			secure: process.env.NODE_ENV === 'production',
+			maxAge: 5 * 60 * 1000, // 5 minutes
+		},
+	}),
+);
+
+oAuthRouter.use(passport.initialize());
+oAuthRouter.use(passport.session());
+
+export const configurePassport = (settings: ICachedSettings) => {
+	passport.serializeUser((user: any, done) => {
+		done(null, user._id);
+	});
+
+	passport.deserializeUser(async (id, done) => {
+		const user = await Users.findOneById(id as string);
+		// we don’t actually use this user later
+		done(null, user);
+	});
+
+	settings.watchByRegex(/^(Accounts_OAuth_)[a-z0-9_]+$/i, () => {
+		const services = getOAuthServices(settings);
+		const oauthServiceConfigs = createOAuthServiceConfig(settings, services);
+		configureOAuthServices(oauthServiceConfigs);
+	});
+
+	WebApp.rawConnectHandlers.use(oAuthRouter);
+};
diff --git a/apps/meteor/server/configuration/index.ts b/apps/meteor/server/configuration/index.ts
index 491c410e26f4a..79f3160120ba1 100644
--- a/apps/meteor/server/configuration/index.ts
+++ b/apps/meteor/server/configuration/index.ts
@@ -7,6 +7,7 @@ import { configureCORS } from './configureCORS';
 import { configureDirectReply } from './configureDirectReply';
 import { configureIRC } from './configureIRC';
 import { configureLogLevel } from './configureLogLevel';
+import { configurePassport } from './configurePassport';
 import { configureSMTP } from './configureSMTP';
 import { configureLDAP } from './ldap';
 import { configureOAuth } from './oauth';
@@ -28,5 +29,6 @@ export async function configureServer(settings: ICachedSettings) {
 		configureDirectReply(settings),
 		configureSMTP(settings),
 		configureIRC(settings),
+		configurePassport(settings),
 	]);
 }
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
new file mode 100644
index 0000000000000..3be20bbe28b1b
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -0,0 +1,89 @@
+import { type IUser } from '@rocket.chat/core-typings';
+import { Users } from '@rocket.chat/models';
+import { Accounts } from 'meteor/accounts-base';
+import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
+import type { Profile, DoneCallback } from 'passport';
+
+import type { OAuthServiceConfig } from './createOAuthServiceConfig';
+import { oAuthRouter } from '../../configuration/configurePassport';
+
+export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[]) => {
+	oauthServiceConfig.forEach((config) => {
+		const Strategy = config.strategy;
+
+		passport.unuse(config.provider);
+
+		passport.use(
+			config.provider,
+			new Strategy(
+				{
+					clientID: config.clientId,
+					clientSecret: config.clientSecret,
+					callbackURL: `${Meteor.absoluteUrl()}oauth/${config.provider}/callback`,
+					state: true,
+					pkce: true,
+					scope: config.scope,
+					profileFields: ['id', 'displayName', 'emails'],
+				},
+				async (accessToken: string, refreshToken: string, profile: Profile, done: DoneCallback) => {
+					const profileWithRaw = profile as Profile & { _json?: Record<string, unknown>; _raw?: string };
+					const { _json, _raw, ...restProfile } = profileWithRaw;
+
+					// eslint-disable-next-line @typescript-eslint/await-thenable
+					const user = await Accounts.updateOrCreateUserFromExternalService(
+						config.provider,
+						{
+							accessToken,
+							refreshToken,
+							name: profile.displayName,
+							email: profile?.emails?.[0]?.value,
+							...restProfile,
+							..._json,
+						},
+						{},
+					);
+
+					if (!user?.userId || typeof user?.userId !== 'string') {
+						return done(new Error('User not found'));
+					}
+
+					const userFromDB = await Users.findOneById(user.userId);
+
+					if (!userFromDB) {
+						return done(new Error('User not found'));
+					}
+
+					return done(null, userFromDB);
+				},
+			),
+		);
+
+		oAuthRouter.get(
+			`/oauth/${config.provider}`,
+			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
+		);
+		oAuthRouter.get(
+			`/oauth/${config.provider}/callback`,
+			passport.authenticate(config.provider, { failureRedirect: '/login' }),
+			async (req, res) => {
+				const oAuthUser = req.user as IUser;
+
+				if (!oAuthUser) {
+					return res.redirect('/login');
+				}
+
+				const stampedToken = Accounts._generateStampedLoginToken();
+				Accounts._insertLoginToken(oAuthUser._id, stampedToken);
+
+				res.redirect(`/home?resumeToken=${stampedToken.token}`);
+
+				req.session.destroy((err) => {
+					if (err) {
+						console.error('Error destroying session', err);
+					}
+				});
+			},
+		);
+	});
+};
diff --git a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
new file mode 100644
index 0000000000000..723f1db7a665b
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
@@ -0,0 +1,25 @@
+import { capitalize } from '@rocket.chat/string-helpers';
+import type { Strategy } from 'passport';
+
+import { OAuthConfigs } from './oauthConfigs';
+import { type ICachedSettings } from '../../../app/settings/server/CachedSettings';
+
+export type OAuthServiceConfig = {
+	provider: string;
+	strategy: new (...args: any[]) => Strategy;
+	clientId: string;
+	clientSecret: string;
+	scope: string[];
+};
+
+export const createOAuthServiceConfig = (settings: ICachedSettings, services: string[]): OAuthServiceConfig[] => {
+	return services.map((service) => {
+		return {
+			provider: service,
+			strategy: OAuthConfigs[service].strategy,
+			clientId: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_id`),
+			clientSecret: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_secret`),
+			scope: OAuthConfigs[service].scope,
+		};
+	});
+};
diff --git a/apps/meteor/server/lib/oauth/getOAuthServices.ts b/apps/meteor/server/lib/oauth/getOAuthServices.ts
new file mode 100644
index 0000000000000..7182f6a8f0ea5
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/getOAuthServices.ts
@@ -0,0 +1,33 @@
+import { isTruthy } from '@rocket.chat/tools';
+
+import { OAuthConfigs } from './oauthConfigs';
+import { type ICachedSettings } from '../../../app/settings/server/CachedSettings';
+
+export const getOAuthServices = (settings: ICachedSettings) => {
+	const services = settings.getByRegexp(/^(Accounts_OAuth_|Accounts_OAuth_Custom-)[a-z0-9_]+$/i);
+	const filteredServices = services.filter(([, value]) => typeof value === 'boolean' && value === true);
+	return filteredServices
+		.map(([key, value]) => {
+			if (!value) {
+				return;
+			}
+
+			let serviceName = key.replace('Accounts_OAuth_', '');
+			if (serviceName === 'Meteor') {
+				serviceName = 'meteor-developer';
+			}
+			if (/Accounts_OAuth_Custom-/.test(key)) {
+				return;
+			}
+
+			const serviceKey = serviceName.toLowerCase();
+
+			const oauthConfig = OAuthConfigs[serviceKey];
+			if (!oauthConfig) {
+				return;
+			}
+
+			return serviceKey;
+		})
+		.filter(isTruthy);
+};
diff --git a/apps/meteor/server/lib/oauth/oauthConfigs.ts b/apps/meteor/server/lib/oauth/oauthConfigs.ts
new file mode 100644
index 0000000000000..eb02d955f044c
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/oauthConfigs.ts
@@ -0,0 +1,21 @@
+import type { Strategy } from 'passport';
+import { Strategy as FacebookStrategy } from 'passport-facebook';
+import { Strategy as GitHubStrategy } from 'passport-github2';
+
+export type OAuthConfig = {
+	strategy: new (...args: any[]) => Strategy;
+	scope: string[];
+};
+
+export const OAuthConfigs: Record<string, OAuthConfig> = {
+	github: {
+		strategy: GitHubStrategy,
+		scope: ['user:email'],
+	},
+	facebook: {
+		strategy: FacebookStrategy,
+		scope: ['email'],
+	},
+} as const;
+
+export type Provider = keyof typeof OAuthConfigs;
diff --git a/packages/core-typings/src/IUser.ts b/packages/core-typings/src/IUser.ts
index a018ed386b1dc..e9428742965a4 100644
--- a/packages/core-typings/src/IUser.ts
+++ b/packages/core-typings/src/IUser.ts
@@ -234,7 +234,7 @@ export interface IUser extends IRocketChatRecord {
 	isOAuthUser?: boolean; // client only field
 	__rooms?: string[];
 	inactiveReason?: 'deactivated' | 'pending_approval' | 'idle_too_long';
-
+	providerId?: string;
 	abacAttributes?: IAbacAttributeDefinition[];
 }
 
diff --git a/yarn.lock b/yarn.lock
index 6595ca80f9b55..947351bad2a54 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9207,6 +9207,7 @@ __metadata:
     "@types/ejson": "npm:^2.2.2"
     "@types/express": "npm:^4.17.25"
     "@types/express-rate-limit": "npm:^5.1.3"
+    "@types/express-session": "npm:^1"
     "@types/google-libphonenumber": "npm:^7.4.30"
     "@types/gravatar": "npm:^1.8.6"
     "@types/he": "npm:^1.2.3"
@@ -9237,6 +9238,9 @@ __metadata:
     "@types/oauth2-server": "npm:^3.0.18"
     "@types/object-path": "npm:^0.11.4"
     "@types/parseurl": "npm:^1.3.3"
+    "@types/passport": "npm:^1.0.17"
+    "@types/passport-facebook": "npm:^3.0.4"
+    "@types/passport-github2": "npm:^1.2.9"
     "@types/prometheus-gc-stats": "npm:^0.6.4"
     "@types/proxy-from-env": "npm:^1.0.4"
     "@types/proxyquire": "npm:^1.3.31"
@@ -9313,6 +9317,7 @@ __metadata:
     expiry-map: "npm:^2.0.0"
     express: "npm:^4.21.2"
     express-rate-limit: "npm:^5.5.1"
+    express-session: "npm:^1.19.0"
     fast-glob: "npm:^3.3.3"
     fastq: "npm:^1.17.1"
     fflate: "npm:^0.8.2"
@@ -9375,6 +9380,10 @@ __metadata:
     outdent: "npm:~0.8.0"
     overlayscrollbars: "npm:^2.11.4"
     overlayscrollbars-react: "npm:^0.5.6"
+    passport: "npm:^0.7.0"
+    passport-facebook: "npm:^3.0.0"
+    passport-facebook2: "npm:^1.0.3"
+    passport-github2: "npm:^0.1.12"
     path: "npm:^0.12.7"
     path-to-regexp: "npm:^6.3.0"
     pino: "npm:^8.21.0"
@@ -12842,6 +12851,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/express-session@npm:^1":
+  version: 1.18.2
+  resolution: "@types/express-session@npm:1.18.2"
+  dependencies:
+    "@types/express": "npm:*"
+  checksum: 10/c1711976d089fd6da58c0262e2b21b71ee64d508ee0f9f1b90e7658b712fc59874e03f799757843d2300c1dd127813cd16ce806c208bc4975f0f7ed700f2db94
+  languageName: node
+  linkType: hard
+
 "@types/express@npm:*":
   version: 4.17.23
   resolution: "@types/express@npm:4.17.23"
@@ -13401,6 +13419,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/oauth@npm:*":
+  version: 0.9.6
+  resolution: "@types/oauth@npm:0.9.6"
+  dependencies:
+    "@types/node": "npm:*"
+  checksum: 10/6e1d42585a77b73c607be3c50c25d6f7f772fc1f3927c2ea10c9955b4ba118dfe6cc7303538e68cd53ffe6f133cf8b8c61f703a37023175c5bbb218460732147
+  languageName: node
+  linkType: hard
+
 "@types/object-path@npm:^0.11.4":
   version: 0.11.4
   resolution: "@types/object-path@npm:0.11.4"
@@ -13424,6 +13451,48 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/passport-facebook@npm:^3.0.4":
+  version: 3.0.4
+  resolution: "@types/passport-facebook@npm:3.0.4"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/passport": "npm:*"
+    "@types/passport-oauth2": "npm:*"
+  checksum: 10/15e6787d531fbd01913bc9df1f6e7b968daae4c9ec3020516b1200baa11a39c0ae51da29aa9171663ae9cf0887c7da15efaea471f1b012f0c500d118a8570af4
+  languageName: node
+  linkType: hard
+
+"@types/passport-github2@npm:^1.2.9":
+  version: 1.2.9
+  resolution: "@types/passport-github2@npm:1.2.9"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/passport": "npm:*"
+    "@types/passport-oauth2": "npm:*"
+  checksum: 10/375b16d5ab80ff0601a56abc1a2ec1eadda0a8f38bef9c5d7406b6141751a10f6bb565890459a27ecbcb9a622771250fd5539e0842ce1b205f68dc4c3d83c235
+  languageName: node
+  linkType: hard
+
+"@types/passport-oauth2@npm:*":
+  version: 1.8.0
+  resolution: "@types/passport-oauth2@npm:1.8.0"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/oauth": "npm:*"
+    "@types/passport": "npm:*"
+  checksum: 10/f874fb3c8646a720c4ae2b7da905b9db03e19617981e42c64b1dbe3313e7df9ab66682de41538db3279e1805b146ba6fc35902462c1858d605c30bb20cac7609
+  languageName: node
+  linkType: hard
+
+"@types/passport@npm:*, @types/passport@npm:^1.0.17":
+  version: 1.0.17
+  resolution: "@types/passport@npm:1.0.17"
+  dependencies:
+    "@types/express": "npm:*"
+  checksum: 10/3db90645d58d928796dd8e9c328dec8040b71a43f3691d42a08fb4779efcbfc7dccc43ea612066a961a41be0869800096d52fd8aaa71518a89aa4483f67f5914
+  languageName: node
+  linkType: hard
+
 "@types/polka@npm:^0.5.8":
   version: 0.5.8
   resolution: "@types/polka@npm:0.5.8"
@@ -16082,6 +16151,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"base64url@npm:3.x.x":
+  version: 3.0.1
+  resolution: "base64url@npm:3.0.1"
+  checksum: 10/a77b2a3a526b3343e25be424de3ae0aa937d78f6af7c813ef9020ef98001c0f4e2323afcd7d8b2d2978996bf8c42445c3e9f60c218c622593e5fdfd54a3d6e18
+  languageName: node
+  linkType: hard
+
 "basic-auth@npm:2.0.1":
   version: 2.0.1
   resolution: "basic-auth@npm:2.0.1"
@@ -17832,7 +17908,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cookie-signature@npm:~1.0.6":
+"cookie-signature@npm:~1.0.6, cookie-signature@npm:~1.0.7":
   version: 1.0.7
   resolution: "cookie-signature@npm:1.0.7"
   checksum: 10/1a62808cd30d15fb43b70e19829b64d04b0802d8ef00275b57d152de4ae6a3208ca05c197b6668d104c4d9de389e53ccc2d3bc6bcaaffd9602461417d8c40710
@@ -17846,7 +17922,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"cookie@npm:0.7.2, cookie@npm:^0.7.2, cookie@npm:~0.7.1":
+"cookie@npm:0.7.2, cookie@npm:^0.7.2, cookie@npm:~0.7.1, cookie@npm:~0.7.2":
   version: 0.7.2
   resolution: "cookie@npm:0.7.2"
   checksum: 10/24b286c556420d4ba4e9bc09120c9d3db7d28ace2bd0f8ccee82422ce42322f73c8312441271e5eefafbead725980e5996cc02766dbb89a90ac7f5636ede608f
@@ -18715,7 +18791,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"debug@npm:2.6.9":
+"debug@npm:2.6.9, debug@npm:~2.6.9":
   version: 2.6.9
   resolution: "debug@npm:2.6.9"
   dependencies:
@@ -21150,6 +21226,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express-session@npm:^1.19.0":
+  version: 1.19.0
+  resolution: "express-session@npm:1.19.0"
+  dependencies:
+    cookie: "npm:~0.7.2"
+    cookie-signature: "npm:~1.0.7"
+    debug: "npm:~2.6.9"
+    depd: "npm:~2.0.0"
+    on-headers: "npm:~1.1.0"
+    parseurl: "npm:~1.3.3"
+    safe-buffer: "npm:~5.2.1"
+    uid-safe: "npm:~2.1.5"
+  checksum: 10/5f36b51d344ec40adb5b9cd8a915fd694cdaf64832632411d4f6e6de8e9a83d873a20389e9c3cce966fece76a18c0384c5f2763b3ac089f801e8d6e92cb543e6
+  languageName: node
+  linkType: hard
+
 "express@npm:^4.21.0, express@npm:^4.21.2":
   version: 4.21.2
   resolution: "express@npm:4.21.2"
@@ -28534,6 +28626,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"oauth@npm:0.10.x":
+  version: 0.10.2
+  resolution: "oauth@npm:0.10.2"
+  checksum: 10/b86f3c1ef35ff59d6659acc10e05b468dff4e6b5570c36d20eff1296db07565e09c3da8a009b656909c432ce0432f646664f301e5337f0dfd5a3d637c956ac2f
+  languageName: node
+  linkType: hard
+
 "object-assign@npm:^4, object-assign@npm:^4.0.1, object-assign@npm:^4.1.1":
   version: 4.1.1
   resolution: "object-assign@npm:4.1.1"
@@ -29233,6 +29332,64 @@ __metadata:
   languageName: node
   linkType: hard
 
+"passport-facebook2@npm:^1.0.3":
+  version: 1.0.3
+  resolution: "passport-facebook2@npm:1.0.3"
+  dependencies:
+    passport-oauth2: "npm:1.x.x"
+  checksum: 10/0dfc697d4db5bd55c0523f77bc4683568ffb6a5037e9d3d07275dff5007b76d1def83c9bff5f2d8414cd59ea26b3d619abae8d5dcd8bd784d6110d9ce770530d
+  languageName: node
+  linkType: hard
+
+"passport-facebook@npm:^3.0.0":
+  version: 3.0.0
+  resolution: "passport-facebook@npm:3.0.0"
+  dependencies:
+    passport-oauth2: "npm:1.x.x"
+  checksum: 10/b75df5746149f5cc9965b0bab63a10adbf8e829f85c4c2724ae4fcf3f884e088c96a814163953ac2c0d99bac04a7f2dba2bd4bc5547bf0fcdac8896c9d2cf2b4
+  languageName: node
+  linkType: hard
+
+"passport-github2@npm:^0.1.12":
+  version: 0.1.12
+  resolution: "passport-github2@npm:0.1.12"
+  dependencies:
+    passport-oauth2: "npm:1.x.x"
+  checksum: 10/cf174d1738a2b1d398ec9f4ba2e1ca229214ef65cfd05f5754303f664d5cfd6e3bacbf49ece19fcd576be43bfcc1d3795541f50692148436b9e4ddbffbe625ac
+  languageName: node
+  linkType: hard
+
+"passport-oauth2@npm:1.x.x":
+  version: 1.8.0
+  resolution: "passport-oauth2@npm:1.8.0"
+  dependencies:
+    base64url: "npm:3.x.x"
+    oauth: "npm:0.10.x"
+    passport-strategy: "npm:1.x.x"
+    uid2: "npm:0.0.x"
+    utils-merge: "npm:1.x.x"
+  checksum: 10/31af6c59686bdc0460f3099a857ae4243952b44ad1afc5a12779524711ea97266491e97f83671120f84575b2c6202f3cf0bb8500fdc5a6414e10ff45617454ca
+  languageName: node
+  linkType: hard
+
+"passport-strategy@npm:1.x.x":
+  version: 1.0.0
+  resolution: "passport-strategy@npm:1.0.0"
+  checksum: 10/5086693f2508e538dffa55a338c89fe8192fb5f4478c71f80cd5890b8573419a098f4fec88b505374f60bbe9049f6f24b9f3992678612528a3370b4dc73354a2
+  languageName: node
+  linkType: hard
+
+"passport@npm:^0.7.0":
+  version: 0.7.0
+  resolution: "passport@npm:0.7.0"
+  dependencies:
+    passport-strategy: "npm:1.x.x"
+    pause: "npm:0.0.1"
+    utils-merge: "npm:^1.0.1"
+  checksum: 10/0ebd4de8e3cba6731b1fddd09b95b8332526f316afded9c9589ff68751e10001c9f1c007170a516e8c1909f9fafdc378c12feb82820241856775005924735b29
+  languageName: node
+  linkType: hard
+
 "path-browserify@npm:^1.0.1":
   version: 1.0.1
   resolution: "path-browserify@npm:1.0.1"
@@ -29414,6 +29571,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"pause@npm:0.0.1":
+  version: 0.0.1
+  resolution: "pause@npm:0.0.1"
+  checksum: 10/e96ee581b68085e6f2ba5adbcb4d4a41fe88e5b514061e76df2fe1905f0f65f4fe5a843b538e9551122c6b9184ff4be266c2ee0ea4614702f9a3d04466d9f462
+  languageName: node
+  linkType: hard
+
 "pbkdf2@npm:^3.0.3, pbkdf2@npm:^3.1.2":
   version: 3.1.2
   resolution: "pbkdf2@npm:3.1.2"
@@ -31066,6 +31230,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"random-bytes@npm:~1.0.0":
+  version: 1.0.0
+  resolution: "random-bytes@npm:1.0.0"
+  checksum: 10/09faa256394aa2ca9754aa57e92a27c452c3e97ffb266e98bebb517332e9df7168fea393159f88d884febce949ba8bec8ddb02f03342da6c6023ecc7b155e0ae
+  languageName: node
+  linkType: hard
+
 "randombytes@npm:^2.0.0, randombytes@npm:^2.0.1, randombytes@npm:^2.0.5, randombytes@npm:^2.1.0":
   version: 2.1.0
   resolution: "randombytes@npm:2.1.0"
@@ -32617,7 +32788,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0":
+"safe-buffer@npm:5.2.1, safe-buffer@npm:>=5.1.0, safe-buffer@npm:^5.0.1, safe-buffer@npm:^5.1.0, safe-buffer@npm:^5.1.1, safe-buffer@npm:^5.1.2, safe-buffer@npm:^5.2.0, safe-buffer@npm:^5.2.1, safe-buffer@npm:~5.2.0, safe-buffer@npm:~5.2.1":
   version: 5.2.1
   resolution: "safe-buffer@npm:5.2.1"
   checksum: 10/32872cd0ff68a3ddade7a7617b8f4c2ae8764d8b7d884c651b74457967a9e0e886267d3ecc781220629c44a865167b61c375d2da6c720c840ecd73f45d5d9451
@@ -35884,6 +36055,22 @@ __metadata:
   languageName: node
   linkType: hard
 
+"uid-safe@npm:~2.1.5":
+  version: 2.1.5
+  resolution: "uid-safe@npm:2.1.5"
+  dependencies:
+    random-bytes: "npm:~1.0.0"
+  checksum: 10/07536043da9a026f4a2bc397543d0ace7587449afa1d9d2c4fd3ce76af8a5263a678788bcc429dff499ef29d45843cd5ee9d05434450fcfc19cc661229f703d1
+  languageName: node
+  linkType: hard
+
+"uid2@npm:0.0.x":
+  version: 0.0.4
+  resolution: "uid2@npm:0.0.4"
+  checksum: 10/e92325ce2e3b7be504b19e835dbb5a8b0495031f364b08ca46745468ed0ae0f202a4fdaf99a1a2715844156efc3ab410456ae24a0f7c0ae4b0a2e9f2784edfd9
+  languageName: node
+  linkType: hard
+
 "umd@npm:^3.0.0":
   version: 3.0.3
   resolution: "umd@npm:3.0.3"
@@ -36388,7 +36575,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"utils-merge@npm:1.0.1, utils-merge@npm:^1.0.0":
+"utils-merge@npm:1.0.1, utils-merge@npm:1.x.x, utils-merge@npm:^1.0.0, utils-merge@npm:^1.0.1":
   version: 1.0.1
   resolution: "utils-merge@npm:1.0.1"
   checksum: 10/5d6949693d58cb2e636a84f3ee1c6e7b2f9c16cb1d42d0ecb386d8c025c69e327205aa1c69e2868cc06a01e5e20681fbba55a4e0ed0cce913d60334024eae798

From b1b3d94d90bb1b473663e22d8f61120b18ea5497 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 8 Apr 2026 14:50:42 +0530
Subject: [PATCH 04/43] fix express user typing

---
 apps/meteor/definition/externals/express.d.ts | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/apps/meteor/definition/externals/express.d.ts b/apps/meteor/definition/externals/express.d.ts
index 1661385d94f77..145fb8a2cce7f 100644
--- a/apps/meteor/definition/externals/express.d.ts
+++ b/apps/meteor/definition/externals/express.d.ts
@@ -9,3 +9,8 @@ declare module 'express' {
 		unauthorized?: boolean;
 	}
 }
+declare global {
+	namespace Express {
+		type User = IUser;
+	}
+}

From ae49afbb75efc3e5de23c4ddfccbd2882db06268 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 8 Apr 2026 21:30:27 +0530
Subject: [PATCH 05/43] use site url instead of meteor absolute url

---
 apps/meteor/server/configuration/configurePassport.ts  |  2 +-
 apps/meteor/server/lib/oauth/configureOAuthServices.ts | 10 ++++++----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index dd6e17e1fba29..43c1889044ddd 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -43,7 +43,7 @@ export const configurePassport = (settings: ICachedSettings) => {
 	settings.watchByRegex(/^(Accounts_OAuth_)[a-z0-9_]+$/i, () => {
 		const services = getOAuthServices(settings);
 		const oauthServiceConfigs = createOAuthServiceConfig(settings, services);
-		configureOAuthServices(oauthServiceConfigs);
+		configureOAuthServices(oauthServiceConfigs, settings);
 	});
 
 	WebApp.rawConnectHandlers.use(oAuthRouter);
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 3be20bbe28b1b..86e3261cf3da7 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -1,16 +1,17 @@
 import { type IUser } from '@rocket.chat/core-typings';
 import { Users } from '@rocket.chat/models';
 import { Accounts } from 'meteor/accounts-base';
-import { Meteor } from 'meteor/meteor';
 import passport from 'passport';
 import type { Profile, DoneCallback } from 'passport';
 
 import type { OAuthServiceConfig } from './createOAuthServiceConfig';
+import type { ICachedSettings } from '../../../app/settings/server/CachedSettings';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
-export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[]) => {
+export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[], settings: ICachedSettings) => {
 	oauthServiceConfig.forEach((config) => {
 		const Strategy = config.strategy;
+		const siteUrl = settings.get<string>('Site_Url');
 
 		passport.unuse(config.provider);
 
@@ -20,7 +21,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[])
 				{
 					clientID: config.clientId,
 					clientSecret: config.clientSecret,
-					callbackURL: `${Meteor.absoluteUrl()}oauth/${config.provider}/callback`,
+					callbackURL: `${siteUrl}oauth/${config.provider}/callback`,
 					state: true,
 					pkce: true,
 					scope: config.scope,
@@ -70,7 +71,8 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[])
 				const oAuthUser = req.user as IUser;
 
 				if (!oAuthUser) {
-					return res.redirect('/login');
+					// return res.redirect('/login');
+					return res.redirect('/noOauthUser');
 				}
 
 				const stampedToken = Accounts._generateStampedLoginToken();

From ed170a8df2c9e38f281d2e7c87b1dd993b3dbc56 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 15 Apr 2026 20:14:42 +0530
Subject: [PATCH 06/43] fix async login token creation

---
 .../definition/externals/meteor/accounts-base.d.ts     |  2 +-
 apps/meteor/server/lib/oauth/configureOAuthServices.ts | 10 +++++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/apps/meteor/definition/externals/meteor/accounts-base.d.ts b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
index 39ea55788e9a7..9be29af6ded31 100644
--- a/apps/meteor/definition/externals/meteor/accounts-base.d.ts
+++ b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
@@ -23,7 +23,7 @@ declare module 'meteor/accounts-base' {
 
 		function _generateStampedLoginToken(): { token: string; when: Date };
 
-		function _insertLoginToken(userId: string, token: { token: string; when: Date }): void;
+		function _insertLoginToken(userId: string, token: { token: string; when: Date }): Promise<void>;
 
 		function _runLoginHandlers<T>(methodInvocation: T, loginRequest: Record<string, any>): Promise<LoginMethodResult>;
 
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 86e3261cf3da7..071963d68adfd 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -62,10 +62,18 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 
 		oAuthRouter.get(
 			`/oauth/${config.provider}`,
+			(req, _res, next) => {
+				console.log('authenticate', req.session, req.session.id);
+				next();
+			},
 			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
 		);
 		oAuthRouter.get(
 			`/oauth/${config.provider}/callback`,
+			(req, _res, next) => {
+				console.log('callback', req.session, req.session.id);
+				next();
+			},
 			passport.authenticate(config.provider, { failureRedirect: '/login' }),
 			async (req, res) => {
 				const oAuthUser = req.user as IUser;
@@ -76,7 +84,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 				}
 
 				const stampedToken = Accounts._generateStampedLoginToken();
-				Accounts._insertLoginToken(oAuthUser._id, stampedToken);
+				await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
 
 				res.redirect(`/home?resumeToken=${stampedToken.token}`);
 

From c558ae51872a5269d645efd55d94c25c7357d861 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 15 Apr 2026 22:33:12 +0530
Subject: [PATCH 07/43] oops

---
 apps/meteor/server/lib/oauth/configureOAuthServices.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 071963d68adfd..e00f228a271bd 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -21,7 +21,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 				{
 					clientID: config.clientId,
 					clientSecret: config.clientSecret,
-					callbackURL: `${siteUrl}oauth/${config.provider}/callback`,
+					callbackURL: `${siteUrl}/oauth/${config.provider}/callback`,
 					state: true,
 					pkce: true,
 					scope: config.scope,
@@ -76,6 +76,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 			},
 			passport.authenticate(config.provider, { failureRedirect: '/login' }),
 			async (req, res) => {
+				console.log('req -> user', req.user);
 				const oAuthUser = req.user as IUser;
 
 				if (!oAuthUser) {

From a01dcdb73367b2a4c4ed10a72d018bc981c4c7a7 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 15 Apr 2026 23:26:53 +0530
Subject: [PATCH 08/43] failure debugging

---
 .../lib/oauth/configureOAuthServices.ts       | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index e00f228a271bd..1629879e0a7e6 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -1,5 +1,6 @@
 import { type IUser } from '@rocket.chat/core-typings';
 import { Users } from '@rocket.chat/models';
+import type { Request, Response, NextFunction } from 'express';
 import { Accounts } from 'meteor/accounts-base';
 import passport from 'passport';
 import type { Profile, DoneCallback } from 'passport';
@@ -70,12 +71,12 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 		);
 		oAuthRouter.get(
 			`/oauth/${config.provider}/callback`,
-			(req, _res, next) => {
+			(req: Request, _res: Response, next: NextFunction) => {
 				console.log('callback', req.session, req.session.id);
 				next();
 			},
-			passport.authenticate(config.provider, { failureRedirect: '/login' }),
-			async (req, res) => {
+			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true }),
+			async (req: Request, res: Response) => {
 				console.log('req -> user', req.user);
 				const oAuthUser = req.user as IUser;
 
@@ -95,6 +96,18 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					}
 				});
 			},
+			(err: any, req: Request, res: Response, _next: NextFunction) => {
+				res.send(
+					JSON.stringify(
+						{
+							error: err.message,
+							req: req.user,
+						},
+						null,
+						2,
+					),
+				);
+			},
 		);
 	});
 };

From 3ad63c7d4cb020a505c37564c05e8606fec6f8be Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Thu, 16 Apr 2026 00:03:53 +0530
Subject: [PATCH 09/43] use flash for error debugging

---
 apps/meteor/package.json                      |  2 ++
 .../server/configuration/configurePassport.ts |  2 ++
 yarn.lock                                     | 27 +++++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 180bb52ccc597..80275e748d35d 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -203,6 +203,7 @@
 		"exif-be-gone": "^1.5.1",
 		"expiry-map": "^2.0.0",
 		"express": "^4.21.2",
+		"express-flash": "^0.0.2",
 		"express-rate-limit": "^5.5.1",
 		"express-session": "^1.19.0",
 		"fastq": "^1.17.1",
@@ -357,6 +358,7 @@
 		"@types/cssom": "^0.4.3",
 		"@types/ejson": "^2.2.2",
 		"@types/express": "^4.17.25",
+		"@types/express-flash": "^0",
 		"@types/express-rate-limit": "^5.1.3",
 		"@types/express-session": "^1",
 		"@types/google-libphonenumber": "^7.4.30",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 43c1889044ddd..b4a12beb44848 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,6 +1,7 @@
 import { Users } from '@rocket.chat/models';
 import { Random } from '@rocket.chat/random';
 import express from 'express';
+import flash from 'express-flash';
 import session from 'express-session';
 import { WebApp } from 'meteor/webapp';
 import passport from 'passport';
@@ -28,6 +29,7 @@ oAuthRouter.use(
 
 oAuthRouter.use(passport.initialize());
 oAuthRouter.use(passport.session());
+oAuthRouter.use(flash());
 
 export const configurePassport = (settings: ICachedSettings) => {
 	passport.serializeUser((user: any, done) => {
diff --git a/yarn.lock b/yarn.lock
index 748ec4a5cbc31..8b86424b767cd 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9909,6 +9909,7 @@ __metadata:
     "@types/cssom": "npm:^0.4.3"
     "@types/ejson": "npm:^2.2.2"
     "@types/express": "npm:^4.17.25"
+    "@types/express-flash": "npm:^0"
     "@types/express-rate-limit": "npm:^5.1.3"
     "@types/express-session": "npm:^1"
     "@types/google-libphonenumber": "npm:^7.4.30"
@@ -10018,6 +10019,7 @@ __metadata:
     exif-be-gone: "npm:^1.5.1"
     expiry-map: "npm:^2.0.0"
     express: "npm:^4.21.2"
+    express-flash: "npm:^0.0.2"
     express-rate-limit: "npm:^5.5.1"
     express-session: "npm:^1.19.0"
     fast-glob: "npm:^3.3.3"
@@ -14116,6 +14118,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/express-flash@npm:^0":
+  version: 0.0.5
+  resolution: "@types/express-flash@npm:0.0.5"
+  dependencies:
+    "@types/express": "npm:*"
+  checksum: 10/0985a1c73f6ad0fd95902495f5a8cad757476c64cce3b75109c4a0875f569e97b1184cc358ffb646da335145c9a4ebaa993739c68f7ead8457ffd1269ee2a9da
+  languageName: node
+  linkType: hard
+
 "@types/express-rate-limit@npm:^5.1.3":
   version: 5.1.3
   resolution: "@types/express-rate-limit@npm:5.1.3"
@@ -18920,6 +18931,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"connect-flash@npm:0.1.x":
+  version: 0.1.1
+  resolution: "connect-flash@npm:0.1.1"
+  checksum: 10/243e103ec1fdf056e33eccdb3ccad20abe50b3c6e9b8a2a6391708cb0fcc550d116cdc2208fedd04be338ac0a45f8e7af2300042d8190c4342658f738b4d4e3a
+  languageName: node
+  linkType: hard
+
 "connect-history-api-fallback@npm:^2.0.0":
   version: 2.0.0
   resolution: "connect-history-api-fallback@npm:2.0.0"
@@ -22192,6 +22210,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"express-flash@npm:^0.0.2":
+  version: 0.0.2
+  resolution: "express-flash@npm:0.0.2"
+  dependencies:
+    connect-flash: "npm:0.1.x"
+  checksum: 10/2979158276da72fa5b68d6b370183ae756dcd7ffd038885ca099706c147cf0b4b1e25387ae36691eab2ed7211c07fad3450a3c31dc2c8b15c0f057043ed33bb5
+  languageName: node
+  linkType: hard
+
 "express-rate-limit@npm:^5.5.1":
   version: 5.5.1
   resolution: "express-rate-limit@npm:5.5.1"

From be66f9351eb1770a9724f8bb98a62203b706df60 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Mon, 20 Apr 2026 23:58:40 +0530
Subject: [PATCH 10/43] lint

---
 apps/meteor/app/lib/server/methods/createToken.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/meteor/app/lib/server/methods/createToken.ts b/apps/meteor/app/lib/server/methods/createToken.ts
index 63de5b98f4210..6e8e2538ab522 100644
--- a/apps/meteor/app/lib/server/methods/createToken.ts
+++ b/apps/meteor/app/lib/server/methods/createToken.ts
@@ -16,7 +16,7 @@ export async function generateAccessToken(userId: string, secret: string) {
 	}
 
 	const token = Accounts._generateStampedLoginToken();
-	Accounts._insertLoginToken(userId, token);
+	await Accounts._insertLoginToken(userId, token);
 
 	await User.ensureLoginTokensLimit(userId);
 

From 4e185c8a41ee992cab832d0b3892bd0646268c21 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 21 Apr 2026 20:10:49 +0530
Subject: [PATCH 11/43] chore: Passport Google OAuth (#40222)

---
 apps/meteor/package.json                     |  2 ++
 apps/meteor/server/lib/oauth/oauthConfigs.ts |  5 +++++
 yarn.lock                                    | 22 ++++++++++++++++++++
 3 files changed, 29 insertions(+)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 33f6b8f6334a1..afd3c5ac512e8 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -266,6 +266,7 @@
 		"passport-facebook": "^3.0.0",
 		"passport-facebook2": "^1.0.3",
 		"passport-github2": "^0.1.12",
+		"passport-google-oauth20": "^2.0.0",
 		"path": "^0.12.7",
 		"path-to-regexp": "^6.3.0",
 		"pino": "10.3.1",
@@ -395,6 +396,7 @@
 		"@types/passport": "^1.0.17",
 		"@types/passport-facebook": "^3.0.4",
 		"@types/passport-github2": "^1.2.9",
+		"@types/passport-google-oauth20": "^2",
 		"@types/prometheus-gc-stats": "^0.6.4",
 		"@types/proxy-from-env": "^1.0.4",
 		"@types/proxyquire": "^1.3.31",
diff --git a/apps/meteor/server/lib/oauth/oauthConfigs.ts b/apps/meteor/server/lib/oauth/oauthConfigs.ts
index eb02d955f044c..55b2c607cbdcd 100644
--- a/apps/meteor/server/lib/oauth/oauthConfigs.ts
+++ b/apps/meteor/server/lib/oauth/oauthConfigs.ts
@@ -1,6 +1,7 @@
 import type { Strategy } from 'passport';
 import { Strategy as FacebookStrategy } from 'passport-facebook';
 import { Strategy as GitHubStrategy } from 'passport-github2';
+import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
 
 export type OAuthConfig = {
 	strategy: new (...args: any[]) => Strategy;
@@ -16,6 +17,10 @@ export const OAuthConfigs: Record<string, OAuthConfig> = {
 		strategy: FacebookStrategy,
 		scope: ['email'],
 	},
+	google: {
+		strategy: GoogleStrategy,
+		scope: ['email', 'profile'],
+	},
 } as const;
 
 export type Provider = keyof typeof OAuthConfigs;
diff --git a/yarn.lock b/yarn.lock
index b3e3f7711f0dc..4cfed891e35bf 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9956,6 +9956,7 @@ __metadata:
     "@types/passport": "npm:^1.0.17"
     "@types/passport-facebook": "npm:^3.0.4"
     "@types/passport-github2": "npm:^1.2.9"
+    "@types/passport-google-oauth20": "npm:^2"
     "@types/prometheus-gc-stats": "npm:^0.6.4"
     "@types/proxy-from-env": "npm:^1.0.4"
     "@types/proxyquire": "npm:^1.3.31"
@@ -10100,6 +10101,7 @@ __metadata:
     passport-facebook: "npm:^3.0.0"
     passport-facebook2: "npm:^1.0.3"
     passport-github2: "npm:^0.1.12"
+    passport-google-oauth20: "npm:^2.0.0"
     path: "npm:^0.12.7"
     path-to-regexp: "npm:^6.3.0"
     pino: "npm:10.3.1"
@@ -14792,6 +14794,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/passport-google-oauth20@npm:^2":
+  version: 2.0.17
+  resolution: "@types/passport-google-oauth20@npm:2.0.17"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/passport": "npm:*"
+    "@types/passport-oauth2": "npm:*"
+  checksum: 10/534b10d00347f74014205485a96bbf80ba357de8293847cf3e1df67e7b10197fc4128f4c64be6ddf41ede61451e40627810323c26117c863cf244179dc59ee9f
+  languageName: node
+  linkType: hard
+
 "@types/passport-oauth2@npm:*":
   version: 1.8.0
   resolution: "@types/passport-oauth2@npm:1.8.0"
@@ -30405,6 +30418,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"passport-google-oauth20@npm:^2.0.0":
+  version: 2.0.0
+  resolution: "passport-google-oauth20@npm:2.0.0"
+  dependencies:
+    passport-oauth2: "npm:1.x.x"
+  checksum: 10/bfd1316ec7cbef5c25f41daa752eade509dffd3016cc962bf2935d577b3dcfa379d8f0d177e28dd1af03b443cc04382108956a505c0134973f85c155adfd8101
+  languageName: node
+  linkType: hard
+
 "passport-oauth2@npm:1.x.x":
   version: 1.8.0
   resolution: "passport-oauth2@npm:1.8.0"

From c8743722912dbc8ea89827f4d16182b4134e3509 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 21 Apr 2026 23:08:24 +0530
Subject: [PATCH 12/43] trust proxy

---
 apps/meteor/server/configuration/configurePassport.ts | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index b4a12beb44848..3a23aeeaba004 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -27,6 +27,9 @@ oAuthRouter.use(
 	}),
 );
 
+oAuthRouter.enable('trust proxy');
+oAuthRouter.set('trust proxy', true);
+
 oAuthRouter.use(passport.initialize());
 oAuthRouter.use(passport.session());
 oAuthRouter.use(flash());

From 500e00879a36477442b7a3101dbfbabafbc3e7e2 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Fri, 15 May 2026 18:44:37 +0530
Subject: [PATCH 13/43] feat: Custom OAuth using Passport (#40203)

---
 apps/meteor/app/apple/server/loginHandler.ts  |   4 +-
 .../app/custom-oauth/server/customOAuth.ts    | 387 ++++++++++++++++++
 apps/meteor/definition/externals/express.d.ts |   3 +-
 .../externals/meteor/accounts-base.d.ts       |   2 +-
 apps/meteor/package.json                      |   2 +
 .../server/configuration/configurePassport.ts |   8 +-
 .../lib/oauth/addPassportCustomOAuth.ts       |  55 +++
 .../lib/oauth/configureOAuthServices.ts       |  29 +-
 .../server/lib/oauth/getOAuthServices.ts      |   1 +
 .../server/lib/oauth/updateOAuthServices.ts   |  10 +-
 .../meteor/server/lib/oauth/verifyFunction.ts |  39 ++
 yarn.lock                                     |   6 +-
 12 files changed, 511 insertions(+), 35 deletions(-)
 create mode 100644 apps/meteor/app/custom-oauth/server/customOAuth.ts
 create mode 100644 apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
 create mode 100644 apps/meteor/server/lib/oauth/verifyFunction.ts

diff --git a/apps/meteor/app/apple/server/loginHandler.ts b/apps/meteor/app/apple/server/loginHandler.ts
index 18ac7ddd75268..dcb17fa06aff9 100644
--- a/apps/meteor/app/apple/server/loginHandler.ts
+++ b/apps/meteor/app/apple/server/loginHandler.ts
@@ -29,10 +29,10 @@ Accounts.registerLoginHandler('apple', async (loginRequest) => {
 			profile.name = `${givenName} ${familyName}`;
 		}
 
-		const result = Accounts.updateOrCreateUserFromExternalService('apple', serviceData, { profile });
+		const result = await Accounts.updateOrCreateUserFromExternalService('apple', serviceData, { profile });
 
 		// Ensure processing succeeded
-		if (result === undefined || result.userId === undefined) {
+		if (result?.userId === undefined) {
 			return {
 				type: 'apple',
 				error: new Meteor.Error(Accounts.LoginCancelledError.numericError, 'User creation failed from Apple response token'),
diff --git a/apps/meteor/app/custom-oauth/server/customOAuth.ts b/apps/meteor/app/custom-oauth/server/customOAuth.ts
new file mode 100644
index 0000000000000..5c8a3a902b0db
--- /dev/null
+++ b/apps/meteor/app/custom-oauth/server/customOAuth.ts
@@ -0,0 +1,387 @@
+import { LDAP } from '@rocket.chat/core-services';
+import type { IUser, OAuthConfiguration } from '@rocket.chat/core-typings';
+import { Logger } from '@rocket.chat/logger';
+import { Users } from '@rocket.chat/models';
+import { isAbsoluteURL } from '@rocket.chat/tools';
+import { Accounts } from 'meteor/accounts-base';
+import type { DoneCallback } from 'passport';
+import type { VerifyFunction, StrategyOptions } from 'passport-oauth2';
+import { Strategy } from 'passport-oauth2';
+
+import { normalizers, fromTemplate, renameInvalidProperties } from './transform_helpers';
+import { client } from '../../../server/database/utils';
+import { callbacks } from '../../../server/lib/callbacks';
+import { saveUserIdentity } from '../../lib/server/functions/saveUserIdentity';
+import { notifyOnUserChange } from '../../lib/server/lib/notifyListener';
+import { settings } from '../../settings/server/cached';
+
+const logger = new Logger('CustomOAuth');
+const BeforeUpdateOrCreateUserFromExternalService: ((serviceName: string, serviceData: Record<string, any>) => Promise<void>)[] = [];
+
+export class CustomOAuthStrategy extends Strategy {
+	options: StrategyOptions;
+
+	config: OAuthConfiguration & { clientSecret: string };
+
+	identityPath: string;
+
+	emailPath: string;
+
+	tokenSentVia: string;
+
+	identityTokenSentVia: string;
+
+	keyField: string;
+
+	usernameField: string;
+
+	emailField: string;
+
+	nameField: string;
+
+	avatarField: string;
+
+	mergeUsers: boolean;
+
+	mergeUsersDistinctServices: boolean;
+
+	rolesClaim: string;
+
+	accessTokenParam: string;
+
+	serverURL: string;
+
+	tokenPath: string;
+
+	constructor(name: string, config: OAuthConfiguration & { clientSecret: string }, verify: VerifyFunction) {
+		if (!config.serverURL || typeof config.serverURL !== 'string') {
+			throw new Meteor.Error('customOAuth: serverURL is required and must be String');
+		}
+
+		const options: StrategyOptions = {
+			authorizationURL: config.serverURL + config.authorizePath,
+			tokenURL: config.serverURL + config.tokenPath,
+			clientID: config.clientId,
+			clientSecret: config.clientSecret,
+			callbackURL: `${settings.get<string>('Site_Url')}/oauth/${name}/callback`,
+			state: true,
+			pkce: true,
+			scope: config.scope,
+		};
+
+		super(options, verify);
+
+		this.serverURL = config.serverURL;
+		this.tokenPath = config.tokenPath || '/oauth/token';
+		this.identityPath = config.identityPath || '/me';
+		this.tokenSentVia = config.tokenSentVia;
+		this.identityTokenSentVia = config.identityTokenSentVia;
+		this.keyField = config.keyField;
+		this.usernameField = config.usernameField?.trim();
+		this.emailField = config.emailField?.trim();
+		this.nameField = config.nameField?.trim();
+		this.avatarField = config.avatarField?.trim();
+		this.mergeUsers = !!config.mergeUsers;
+		this.mergeUsersDistinctServices = !!config.mergeUsersDistinctServices;
+		this.rolesClaim = config.rolesClaim || 'roles';
+		this.accessTokenParam = config.accessTokenParam || 'access_token';
+
+		if (this.identityTokenSentVia == null || this.identityTokenSentVia === 'default') {
+			this.identityTokenSentVia = this.tokenSentVia;
+		}
+
+		if (!isAbsoluteURL(this.tokenPath)) {
+			this.tokenPath = this.serverURL + this.tokenPath;
+		}
+
+		if (!isAbsoluteURL(this.identityPath)) {
+			this.identityPath = this.serverURL + this.identityPath;
+		}
+
+		if (this.emailPath && !isAbsoluteURL(this.emailPath)) {
+			this.emailPath = this.serverURL + this.emailPath;
+		}
+
+		if (config.tokenSentVia === 'header') {
+			this._oauth2.useAuthorizationHeaderforGET(true);
+		}
+
+		if (config.accessTokenParam && config.accessTokenParam !== 'access_token') {
+			this._oauth2.setAccessTokenName(config.accessTokenParam);
+		}
+
+		this.name = name;
+		this.options = options;
+		this.config = config;
+
+		this.addHookToProcessUser();
+	}
+
+	getUsername(data: Record<string, any>) {
+		try {
+			const value = fromTemplate(this.usernameField, data);
+
+			if (!value) {
+				logger.debug({ msg: 'Username field not found in data', usernameField: this.usernameField, data });
+				throw new Meteor.Error('field_not_found', `Username field "${this.usernameField}" not found in data`);
+			}
+
+			return value as string;
+		} catch (error) {
+			throw new Error('CustomOAuth: Failed to extract username', { cause: error });
+		}
+	}
+
+	getEmail(data: Record<string, any>) {
+		try {
+			const value = fromTemplate(this.emailField, data);
+
+			if (!value) {
+				logger.debug({ msg: 'Email field not found in data', emailField: this.emailField, data });
+				throw new Meteor.Error('field_not_found', `Email field "${this.emailField}" not found in data`);
+			}
+			return value as string;
+		} catch (error) {
+			throw new Error('CustomOAuth: Failed to extract email', { cause: error });
+		}
+	}
+
+	getCustomName(data: Record<string, any>) {
+		try {
+			const value = fromTemplate(this.nameField, data);
+
+			if (!value) {
+				return this.getName(data);
+			}
+
+			return value as string;
+		} catch (error) {
+			throw new Error('CustomOAuth: Failed to extract custom name', { cause: error });
+		}
+	}
+
+	getAvatarUrl(data: Record<string, any>) {
+		try {
+			const value = fromTemplate(this.avatarField, data);
+
+			if (!value) {
+				logger.debug({ msg: 'Avatar field not found in data', avatarField: this.avatarField, data });
+			}
+			return value as string;
+		} catch (error) {
+			throw new Error('CustomOAuth: Failed to extract avatar url', { cause: error });
+		}
+	}
+
+	getName(identity: Record<string, any>): string {
+		const name = (identity.name ||
+			identity.username ||
+			identity.nickname ||
+			identity.CharacterName ||
+			identity.userName ||
+			identity.preferred_username ||
+			identity.user?.name) as string;
+		return name;
+	}
+
+	normalizeIdentity(identity: Record<string, any>) {
+		if (identity) {
+			for (const normalizer of Object.values(normalizers)) {
+				const result = normalizer(identity);
+				if (result) {
+					identity = result;
+				}
+			}
+		}
+
+		if (this.usernameField) {
+			identity.username = this.getUsername(identity);
+		}
+
+		if (this.emailField) {
+			identity.email = this.getEmail(identity);
+		}
+
+		if (this.avatarField) {
+			identity.avatarUrl = this.getAvatarUrl(identity);
+		}
+
+		if (this.nameField) {
+			identity.name = this.getCustomName(identity);
+		} else {
+			identity.name = this.getName(identity);
+		}
+
+		return renameInvalidProperties(identity);
+	}
+
+	override userProfile(accessToken: string, done: DoneCallback) {
+		if (!this.identityPath) {
+			return done(new Error(`identityPath is required for ${this.name} custom oauth`));
+		}
+
+		this._oauth2.get(this.identityPath, accessToken, (err, body, res) => {
+			if (err) {
+				return done(err);
+			}
+
+			if ((res && res.statusCode !== 200) || !body) {
+				return done(new Error(`Failed to fetch identity from ${this.name} at ${this.identityPath}}`));
+			}
+
+			try {
+				const result = JSON.parse(typeof body === 'string' ? body : body.toString());
+				const normalizedIdentity = this.normalizeIdentity(result);
+				return done(null, normalizedIdentity);
+			} catch (e) {
+				return done(new Error(`Failed to parse identity from ${this.name} at ${this.identityPath}. ${e}`));
+			}
+		});
+	}
+
+	addHookToProcessUser() {
+		BeforeUpdateOrCreateUserFromExternalService.push(async (serviceName, serviceData) => {
+			if (serviceName !== this.name) {
+				return;
+			}
+
+			if (serviceData.username) {
+				let user: IUser | null = null;
+
+				if (this.keyField === 'username') {
+					user = this.mergeUsersDistinctServices
+						? await Users.findOneByUsernameIgnoringCase(serviceData.username)
+						: await Users.findOneByUsernameAndServiceNameIgnoringCase(serviceData.username, serviceData.id, serviceName);
+				} else if (this.keyField === 'email') {
+					user = this.mergeUsersDistinctServices
+						? await Users.findOneByEmailAddress(serviceData.email)
+						: await Users.findOneByEmailAddressAndServiceNameIgnoringCase(serviceData.email, serviceData.id, serviceName);
+				}
+
+				if (!user) {
+					return;
+				}
+
+				await callbacks.run('afterProcessOAuthUser', { serviceName, serviceData, user });
+				// User already created or merged and has identical name as before
+				if (
+					user.services?.[serviceName as keyof NonNullable<IUser['services']>] &&
+					user.services[serviceName as keyof NonNullable<IUser['services']>].id === serviceData.id &&
+					user.name === serviceData.name &&
+					(this.keyField === 'email' || !serviceData.email || user.emails?.find(({ address }) => address === serviceData.email))
+				) {
+					return;
+				}
+
+				if (this.mergeUsers !== true) {
+					throw new Meteor.Error('CustomOAuth', `User with username ${user.username} already exists`);
+				}
+
+				const serviceIdKey = `services.${serviceName}.id`;
+				const successCallbacks = [
+					async () => {
+						const updatedUser = await Users.findOneById(user._id, { projection: { name: 1, emails: 1, [serviceIdKey]: 1 } });
+						if (updatedUser) {
+							const { _id, ...diff } = updatedUser;
+							void notifyOnUserChange({ clientAction: 'updated', id: user._id, diff });
+						}
+					},
+				];
+
+				const session = client.startSession();
+				try {
+					// Extend the session to match the ExtendedSession type expected by saveUserIdentity
+					Object.assign(session, {
+						onceSuccesfulCommit: (cb: () => Promise<void>) => {
+							successCallbacks.push(cb);
+						},
+					});
+
+					session.startTransaction();
+
+					const updater = Users.getUpdater();
+
+					if (this.keyField === 'username' && serviceData.email) {
+						updater.set('emails', [{ address: serviceData.email, verified: true }]);
+					}
+
+					updater.set(serviceIdKey as keyof IUser['services'], serviceData.id);
+
+					await saveUserIdentity({
+						_id: user._id,
+						name: serviceData.name,
+						updater,
+						session,
+						updateUsernameInBackground: true,
+						// Username needs to be included otherwise the name won't be updated in some collections
+						username: user.username,
+					});
+					await Users.updateFromUpdater({ _id: user._id }, updater, { session });
+
+					await session.commitTransaction();
+				} catch (e) {
+					await session.abortTransaction();
+					throw e;
+				} finally {
+					await session.endSession();
+				}
+
+				void Promise.allSettled(successCallbacks.map((cb) => cb()));
+			}
+		});
+
+		Accounts.validateNewUser((user: IUser & { email: string }) => {
+			if (!user.services?.[this.name as keyof NonNullable<IUser['services']>]?.id) {
+				return true;
+			}
+
+			if (this.usernameField) {
+				user.username = user.services[this.name as keyof NonNullable<IUser['services']>].username;
+			}
+
+			if (this.emailField) {
+				user.email = user.services[this.name as keyof NonNullable<IUser['services']>].email;
+			}
+
+			if (this.nameField) {
+				user.name = user.services[this.name as keyof NonNullable<IUser['services']>].name;
+			}
+
+			return true;
+		});
+	}
+}
+
+const { updateOrCreateUserFromExternalService } = Accounts;
+
+Accounts.updateOrCreateUserFromExternalService = async function (...args) {
+	for (const hook of BeforeUpdateOrCreateUserFromExternalService) {
+		await hook.apply(this, args as unknown as [string, Record<string, any>]);
+	}
+
+	const [serviceName, serviceData] = args;
+
+	const user = await updateOrCreateUserFromExternalService.apply(this, args);
+
+	if (!user?.userId) {
+		return undefined;
+	}
+
+	const fullUser = await Users.findOneById(user.userId as string);
+
+	if (!fullUser) {
+		return undefined;
+	}
+
+	if (settings.get('LDAP_Update_Data_On_OAuth_Login') && fullUser.username) {
+		await LDAP.loginAuthenticatedUserRequest(fullUser.username);
+	}
+
+	await callbacks.run('afterValidateNewOAuthUser', {
+		identity: serviceData,
+		serviceName,
+		user: fullUser,
+	});
+
+	return user;
+};
diff --git a/apps/meteor/definition/externals/express.d.ts b/apps/meteor/definition/externals/express.d.ts
index 145fb8a2cce7f..9b89ad6a824b6 100644
--- a/apps/meteor/definition/externals/express.d.ts
+++ b/apps/meteor/definition/externals/express.d.ts
@@ -11,6 +11,7 @@ declare module 'express' {
 }
 declare global {
 	namespace Express {
-		type User = IUser;
+		//eslint-disable-next-line
+		interface User extends IUser {}
 	}
 }
diff --git a/apps/meteor/definition/externals/meteor/accounts-base.d.ts b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
index 9be29af6ded31..4d54fae15272f 100644
--- a/apps/meteor/definition/externals/meteor/accounts-base.d.ts
+++ b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
@@ -41,7 +41,7 @@ declare module 'meteor/accounts-base' {
 			serviceName: string,
 			serviceData: Record<string, unknown>,
 			options: Record<string, unknown>,
-		): Record<string, unknown>;
+		): Promise<Record<string, unknown> | undefined>;
 
 		function _clearAllLoginTokens(userId: string | null): void;
 
diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 3abc853835ce3..c1c951a1d12f6 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -268,6 +268,7 @@
 		"passport-facebook2": "^1.0.3",
 		"passport-github2": "^0.1.12",
 		"passport-google-oauth20": "^2.0.0",
+		"passport-oauth2": "^1.8.0",
 		"path": "^0.12.7",
 		"path-to-regexp": "^6.3.0",
 		"pino": "10.3.1",
@@ -398,6 +399,7 @@
 		"@types/passport-facebook": "^3.0.4",
 		"@types/passport-github2": "^1.2.9",
 		"@types/passport-google-oauth20": "^2",
+		"@types/passport-oauth2": "^1",
 		"@types/prometheus-gc-stats": "^0.6.4",
 		"@types/proxy-from-env": "^1.0.4",
 		"@types/proxyquire": "^1.3.31",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 3a23aeeaba004..da0469931ca55 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,4 +1,4 @@
-import { Users } from '@rocket.chat/models';
+import type { IUser } from '@rocket.chat/core-typings';
 import { Random } from '@rocket.chat/random';
 import express from 'express';
 import flash from 'express-flash';
@@ -36,11 +36,11 @@ oAuthRouter.use(flash());
 
 export const configurePassport = (settings: ICachedSettings) => {
 	passport.serializeUser((user: any, done) => {
-		done(null, user._id);
+		done(null, user);
 	});
 
-	passport.deserializeUser(async (id, done) => {
-		const user = await Users.findOneById(id as string);
+	passport.deserializeUser(async (user: IUser, done) => {
+		// const user = await Users.findOneById(id as string);
 		// we don’t actually use this user later
 		done(null, user);
 	});
diff --git a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
new file mode 100644
index 0000000000000..d81ee8f8e336f
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
@@ -0,0 +1,55 @@
+import type { OAuthConfiguration, IUser } from '@rocket.chat/core-typings';
+import type { Request, Response } from 'express';
+import { Accounts } from 'meteor/accounts-base';
+import passport from 'passport';
+import type { DoneCallback, Profile } from 'passport';
+
+import { verifyFunction } from './verifyFunction';
+import { CustomOAuthStrategy } from '../../../app/custom-oauth/server/customOAuth';
+import { oAuthRouter } from '../../configuration/configurePassport';
+
+interface IOAuthRequest extends Request {
+	user?: IUser;
+}
+
+export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAuthConfiguration & { clientSecret: string }>) => {
+	passport.unuse(serviceName);
+
+	passport.use(
+		serviceName,
+		new CustomOAuthStrategy(
+			serviceName,
+			config as OAuthConfiguration & { clientSecret: string },
+			(accessToken: string, refreshToken: string, profile: Profile, done: DoneCallback) =>
+				verifyFunction(accessToken, refreshToken, profile, done, serviceName),
+		),
+	);
+
+	oAuthRouter.get(
+		`/oauth/${serviceName}`,
+		passport.authenticate(serviceName, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
+	);
+
+	oAuthRouter.get(
+		`/oauth/${serviceName}/callback`,
+		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true }),
+		async (req: IOAuthRequest, res: Response) => {
+			const oAuthUser = req.user as IUser;
+
+			if (!oAuthUser) {
+				return res.redirect('/login');
+			}
+
+			const stampedToken = Accounts._generateStampedLoginToken();
+			await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
+
+			res.redirect(`/home?resumeToken=${stampedToken.token}`);
+
+			req.session.destroy((err) => {
+				if (err) {
+					console.error('Error destroying session', err);
+				}
+			});
+		},
+	);
+};
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 1629879e0a7e6..23b087dcddaa1 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -1,6 +1,6 @@
 import { type IUser } from '@rocket.chat/core-typings';
 import { Users } from '@rocket.chat/models';
-import type { Request, Response, NextFunction } from 'express';
+import type { Request, Response } from 'express';
 import { Accounts } from 'meteor/accounts-base';
 import passport from 'passport';
 import type { Profile, DoneCallback } from 'passport';
@@ -9,6 +9,10 @@ import type { OAuthServiceConfig } from './createOAuthServiceConfig';
 import type { ICachedSettings } from '../../../app/settings/server/CachedSettings';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
+interface IOAuthRequest extends Request {
+	user?: IUser;
+}
+
 export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[], settings: ICachedSettings) => {
 	oauthServiceConfig.forEach((config) => {
 		const Strategy = config.strategy;
@@ -63,21 +67,12 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 
 		oAuthRouter.get(
 			`/oauth/${config.provider}`,
-			(req, _res, next) => {
-				console.log('authenticate', req.session, req.session.id);
-				next();
-			},
 			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
 		);
 		oAuthRouter.get(
 			`/oauth/${config.provider}/callback`,
-			(req: Request, _res: Response, next: NextFunction) => {
-				console.log('callback', req.session, req.session.id);
-				next();
-			},
 			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true }),
-			async (req: Request, res: Response) => {
-				console.log('req -> user', req.user);
+			async (req: IOAuthRequest, res: Response) => {
 				const oAuthUser = req.user as IUser;
 
 				if (!oAuthUser) {
@@ -96,18 +91,6 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					}
 				});
 			},
-			(err: any, req: Request, res: Response, _next: NextFunction) => {
-				res.send(
-					JSON.stringify(
-						{
-							error: err.message,
-							req: req.user,
-						},
-						null,
-						2,
-					),
-				);
-			},
 		);
 	});
 };
diff --git a/apps/meteor/server/lib/oauth/getOAuthServices.ts b/apps/meteor/server/lib/oauth/getOAuthServices.ts
index 7182f6a8f0ea5..7a431982d9f71 100644
--- a/apps/meteor/server/lib/oauth/getOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/getOAuthServices.ts
@@ -16,6 +16,7 @@ export const getOAuthServices = (settings: ICachedSettings) => {
 			if (serviceName === 'Meteor') {
 				serviceName = 'meteor-developer';
 			}
+
 			if (/Accounts_OAuth_Custom-/.test(key)) {
 				return;
 			}
diff --git a/apps/meteor/server/lib/oauth/updateOAuthServices.ts b/apps/meteor/server/lib/oauth/updateOAuthServices.ts
index 784628cae44a9..f501b9c56888a 100644
--- a/apps/meteor/server/lib/oauth/updateOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/updateOAuthServices.ts
@@ -7,6 +7,7 @@ import type {
 } from '@rocket.chat/core-typings';
 import { LoginServiceConfiguration } from '@rocket.chat/models';
 
+import { addPassportCustomOAuth } from './addPassportCustomOAuth';
 import { logger } from './logger';
 import { CustomOAuth } from '../../../app/custom-oauth/server/custom_oauth_server';
 import {
@@ -68,7 +69,7 @@ export async function updateOAuthServices(): Promise<void> {
 				data.rolesToSync = settings.get(`${key}-roles_to_sync`);
 				data.showButton = settings.get(`${key}-show_button`);
 
-				new CustomOAuth(serviceKey, {
+				const config = {
 					serverURL: data.serverURL,
 					tokenPath: data.tokenPath,
 					identityPath: data.identityPath,
@@ -93,7 +94,12 @@ export async function updateOAuthServices(): Promise<void> {
 					rolesToSync: data.rolesToSync,
 					accessTokenParam: data.accessTokenParam,
 					showButton: data.showButton,
-				});
+					clientSecret: data.secret,
+					clientId: data.clientId,
+				};
+
+				new CustomOAuth(serviceKey, config);
+				addPassportCustomOAuth(serviceKey, config);
 			}
 			if (serviceName === 'Facebook') {
 				(data as FacebookOAuthConfiguration).appId = data.clientId as string;
diff --git a/apps/meteor/server/lib/oauth/verifyFunction.ts b/apps/meteor/server/lib/oauth/verifyFunction.ts
new file mode 100644
index 0000000000000..dc55fb343a3fd
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/verifyFunction.ts
@@ -0,0 +1,39 @@
+import { Users } from '@rocket.chat/models';
+import { Accounts } from 'meteor/accounts-base';
+import type { DoneCallback, Profile } from 'passport';
+
+export const verifyFunction = async (
+	accessToken: string,
+	refreshToken: string,
+	profile: Profile,
+	done: DoneCallback,
+	serviceName: string,
+) => {
+	const profileWithRaw = profile as Profile & { _json?: Record<string, unknown>; _raw?: string };
+	const { _json, _raw, ...restProfile } = profileWithRaw;
+
+	const user = await Accounts.updateOrCreateUserFromExternalService(
+		serviceName,
+		{
+			accessToken,
+			refreshToken,
+			name: profile.displayName,
+			email: profile?.emails?.[0]?.value,
+			...restProfile,
+			..._json,
+		},
+		{},
+	);
+
+	if (!user?.userId || typeof user?.userId !== 'string') {
+		return done(new Error('User not found'));
+	}
+
+	const userFromDB = await Users.findOneById(user.userId);
+
+	if (!userFromDB) {
+		return done(new Error('User not found'));
+	}
+
+	return done(null, userFromDB);
+};
diff --git a/yarn.lock b/yarn.lock
index 352c7303a7302..5b635e76a0ce5 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9766,6 +9766,7 @@ __metadata:
     "@types/passport-facebook": "npm:^3.0.4"
     "@types/passport-github2": "npm:^1.2.9"
     "@types/passport-google-oauth20": "npm:^2"
+    "@types/passport-oauth2": "npm:^1"
     "@types/prometheus-gc-stats": "npm:^0.6.4"
     "@types/proxy-from-env": "npm:^1.0.4"
     "@types/proxyquire": "npm:^1.3.31"
@@ -9911,6 +9912,7 @@ __metadata:
     passport-facebook2: "npm:^1.0.3"
     passport-github2: "npm:^0.1.12"
     passport-google-oauth20: "npm:^2.0.0"
+    passport-oauth2: "npm:^1.8.0"
     path: "npm:^0.12.7"
     path-to-regexp: "npm:^6.3.0"
     pino: "npm:10.3.1"
@@ -14689,7 +14691,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/passport-oauth2@npm:*":
+"@types/passport-oauth2@npm:*, @types/passport-oauth2@npm:^1":
   version: 1.8.0
   resolution: "@types/passport-oauth2@npm:1.8.0"
   dependencies:
@@ -29949,7 +29951,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"passport-oauth2@npm:1.x.x":
+"passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.8.0":
   version: 1.8.0
   resolution: "passport-oauth2@npm:1.8.0"
   dependencies:

From aa3602bdfe3bf8d2d9e29e6b03757812ecee37d3 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Mon, 18 May 2026 12:18:02 +0530
Subject: [PATCH 14/43] custom OAuth auto publish fields

---
 apps/meteor/app/custom-oauth/server/customOAuth.ts         | 4 ++++
 apps/meteor/definition/externals/meteor/accounts-base.d.ts | 2 ++
 packages/core-typings/src/ILoginServiceConfiguration.ts    | 4 ++++
 3 files changed, 10 insertions(+)

diff --git a/apps/meteor/app/custom-oauth/server/customOAuth.ts b/apps/meteor/app/custom-oauth/server/customOAuth.ts
index 5c8a3a902b0db..82d774ff94112 100644
--- a/apps/meteor/app/custom-oauth/server/customOAuth.ts
+++ b/apps/meteor/app/custom-oauth/server/customOAuth.ts
@@ -110,6 +110,10 @@ export class CustomOAuthStrategy extends Strategy {
 			this._oauth2.setAccessTokenName(config.accessTokenParam);
 		}
 
+		if (config.addAutopublishFields && typeof config.addAutopublishFields === 'object') {
+			Accounts.addAutopublishFields(config.addAutopublishFields);
+		}
+
 		this.name = name;
 		this.options = options;
 		this.config = config;
diff --git a/apps/meteor/definition/externals/meteor/accounts-base.d.ts b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
index 4d54fae15272f..9676c1c6d8678 100644
--- a/apps/meteor/definition/externals/meteor/accounts-base.d.ts
+++ b/apps/meteor/definition/externals/meteor/accounts-base.d.ts
@@ -43,6 +43,8 @@ declare module 'meteor/accounts-base' {
 			options: Record<string, unknown>,
 		): Promise<Record<string, unknown> | undefined>;
 
+		function addAutopublishFields(options: Record<string, unknown>): void;
+
 		function _clearAllLoginTokens(userId: string | null): void;
 
 		function config(options: { clientStorage: 'session' | 'local' }): void;
diff --git a/packages/core-typings/src/ILoginServiceConfiguration.ts b/packages/core-typings/src/ILoginServiceConfiguration.ts
index 76a4779e806e9..eec8717f5ef0e 100644
--- a/packages/core-typings/src/ILoginServiceConfiguration.ts
+++ b/packages/core-typings/src/ILoginServiceConfiguration.ts
@@ -34,6 +34,10 @@ export type OAuthConfiguration = {
 	mergeRoles: boolean;
 	rolesToSync: string;
 	showButton: boolean;
+	addAutopublishFields?: {
+		forLoggedInUser: string[];
+		forOtherUsers: string[];
+	};
 };
 
 export type FacebookOAuthConfiguration = Omit<Partial<OAuthConfiguration>, 'clientId'> & {

From 6e42e8786f0afc6d515eb46d7f4c75a59d993cb8 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Mon, 18 May 2026 23:32:08 +0530
Subject: [PATCH 15/43] chore: LinkedIn custom OAuth (#40594)

---
 .../app/custom-oauth/server/customOAuth.ts    |  2 +-
 apps/meteor/app/linkedin/server/index.ts      |  1 +
 apps/meteor/app/linkedin/server/lib.ts        | 49 +++++++++++++++++++
 .../server/configuration/accounts_meld.js     |  4 --
 apps/meteor/server/importPackages.ts          |  1 +
 .../src/ILoginServiceConfiguration.ts         |  1 +
 6 files changed, 53 insertions(+), 5 deletions(-)
 create mode 100644 apps/meteor/app/linkedin/server/index.ts
 create mode 100644 apps/meteor/app/linkedin/server/lib.ts

diff --git a/apps/meteor/app/custom-oauth/server/customOAuth.ts b/apps/meteor/app/custom-oauth/server/customOAuth.ts
index 82d774ff94112..04b940e7d95b3 100644
--- a/apps/meteor/app/custom-oauth/server/customOAuth.ts
+++ b/apps/meteor/app/custom-oauth/server/customOAuth.ts
@@ -65,7 +65,7 @@ export class CustomOAuthStrategy extends Strategy {
 			clientSecret: config.clientSecret,
 			callbackURL: `${settings.get<string>('Site_Url')}/oauth/${name}/callback`,
 			state: true,
-			pkce: true,
+			pkce: config.pkce ?? true,
 			scope: config.scope,
 		};
 
diff --git a/apps/meteor/app/linkedin/server/index.ts b/apps/meteor/app/linkedin/server/index.ts
new file mode 100644
index 0000000000000..cf327e4971bb2
--- /dev/null
+++ b/apps/meteor/app/linkedin/server/index.ts
@@ -0,0 +1 @@
+import './lib';
diff --git a/apps/meteor/app/linkedin/server/lib.ts b/apps/meteor/app/linkedin/server/lib.ts
new file mode 100644
index 0000000000000..6fb0d450d2fda
--- /dev/null
+++ b/apps/meteor/app/linkedin/server/lib.ts
@@ -0,0 +1,49 @@
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
+import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
+
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { settings } from '../../settings/server';
+
+const config: Partial<OAuthConfiguration> = {
+	serverURL: 'https://www.linkedin.com',
+	authorizePath: '/oauth/v2/authorization',
+	tokenPath: '/oauth/v2/accessToken',
+	identityPath: 'https://api.linkedin.com/v2/userinfo',
+	scope: 'openid email profile',
+	tokenSentVia: 'header',
+	addAutopublishFields: {
+		forLoggedInUser: ['services.linkedin'],
+		forOtherUsers: ['services.linkedin.name'],
+	},
+	pkce: false,
+	emailField: 'email',
+	avatarField: 'picture',
+};
+
+const serviceKey = 'linkedin';
+
+const configureLinkedInOAuth = (): void => {
+	passport.unuse(serviceKey);
+
+	const enabled = settings.get<boolean>('Accounts_OAuth_Linkedin');
+	if (!enabled) {
+		return;
+	}
+
+	const clientId = settings.get<string>('Accounts_OAuth_Linkedin_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Linkedin_secret');
+
+	if (!clientId || !clientSecret) {
+		return;
+	}
+
+	addPassportCustomOAuth(serviceKey, { ...config, clientId, clientSecret });
+};
+
+Meteor.startup(() => {
+	settings.watchMultiple(
+		['Accounts_OAuth_Linkedin', 'Accounts_OAuth_Linkedin_id', 'Accounts_OAuth_Linkedin_secret'],
+		configureLinkedInOAuth,
+	);
+});
diff --git a/apps/meteor/server/configuration/accounts_meld.js b/apps/meteor/server/configuration/accounts_meld.js
index 037150def37ee..2c8fff11a820b 100644
--- a/apps/meteor/server/configuration/accounts_meld.js
+++ b/apps/meteor/server/configuration/accounts_meld.js
@@ -18,10 +18,6 @@ export async function configureAccounts() {
 			}
 		}
 
-		if (serviceName === 'linkedin') {
-			serviceData.email = serviceData.emailAddress;
-		}
-
 		if (serviceData.email) {
 			const user = await Users.findOneByEmailAddress(serviceData.email);
 			if (user != null && user.services?.[serviceName]?.id !== serviceData.id) {
diff --git a/apps/meteor/server/importPackages.ts b/apps/meteor/server/importPackages.ts
index 645ff19932e0a..8dd1046b515b9 100644
--- a/apps/meteor/server/importPackages.ts
+++ b/apps/meteor/server/importPackages.ts
@@ -33,6 +33,7 @@ import '../app/importer-slack-users/server';
 import '../app/integrations/server';
 import '../app/irc/server';
 import '../app/lib/server';
+import '../app/linkedin/server';
 import '../app/token-login/server';
 import '../app/mailer/server/api';
 import '../app/markdown/server';
diff --git a/packages/core-typings/src/ILoginServiceConfiguration.ts b/packages/core-typings/src/ILoginServiceConfiguration.ts
index eec8717f5ef0e..c3fb05fa8e18f 100644
--- a/packages/core-typings/src/ILoginServiceConfiguration.ts
+++ b/packages/core-typings/src/ILoginServiceConfiguration.ts
@@ -38,6 +38,7 @@ export type OAuthConfiguration = {
 		forLoggedInUser: string[];
 		forOtherUsers: string[];
 	};
+	pkce?: boolean;
 };
 
 export type FacebookOAuthConfiguration = Omit<Partial<OAuthConfiguration>, 'clientId'> & {

From 9a2d2b003da2fb9e821ec157246086ea671257eb Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 01:52:04 +0530
Subject: [PATCH 16/43] feat: Deeplink login for Mobile and Desktop clients
 (#40601)

---
 .../meteor/client/lib/buildAuthDeeplinkURL.ts |  5 +++
 apps/meteor/client/lib/sdk/ddpSdk.ts          |  3 +-
 apps/meteor/client/views/root/AppLayout.tsx   |  4 ++
 .../views/root/hooks/useLoginOtherClients.ts  | 29 +++++++++++++
 .../views/root/hooks/useLoginViaQuery.ts      |  7 +++-
 .../hooks/useShareSessionWithOtherClients.ts  | 41 +++++++++++++++++++
 .../definition/externals/express-session.d.ts |  7 ++++
 .../lib/oauth/addPassportCustomOAuth.ts       | 31 ++++++++++++--
 .../lib/oauth/configureOAuthServices.ts       | 38 ++++++++++++-----
 packages/desktop-api/src/index.ts             |  1 +
 packages/i18n/src/locales/en.i18n.json        |  1 +
 packages/web-ui-registration/global.d.ts      |  7 ++++
 .../web-ui-registration/src/LoginServices.tsx | 29 ++++++++++---
 .../src/LoginServicesButton.tsx               | 12 +++++-
 .../web-ui-registration/tsconfig.build.json   |  2 +-
 packages/web-ui-registration/tsconfig.json    |  2 +-
 16 files changed, 194 insertions(+), 25 deletions(-)
 create mode 100644 apps/meteor/client/lib/buildAuthDeeplinkURL.ts
 create mode 100644 apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
 create mode 100644 apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
 create mode 100644 apps/meteor/definition/externals/express-session.d.ts
 create mode 100644 packages/web-ui-registration/global.d.ts

diff --git a/apps/meteor/client/lib/buildAuthDeeplinkURL.ts b/apps/meteor/client/lib/buildAuthDeeplinkURL.ts
new file mode 100644
index 0000000000000..e21a711963371
--- /dev/null
+++ b/apps/meteor/client/lib/buildAuthDeeplinkURL.ts
@@ -0,0 +1,5 @@
+export const buildDeepLinkURL = (resumeToken: string, userId: string) => {
+	const url = new URL(window.location.href);
+	const { host } = url;
+	return `rocketchat://auth?host=http://${host}&token=${resumeToken}&userId=${userId}`;
+};
diff --git a/apps/meteor/client/lib/sdk/ddpSdk.ts b/apps/meteor/client/lib/sdk/ddpSdk.ts
index 91ea1afe0df2f..20b6462becbc1 100644
--- a/apps/meteor/client/lib/sdk/ddpSdk.ts
+++ b/apps/meteor/client/lib/sdk/ddpSdk.ts
@@ -66,7 +66,8 @@ export const getDdpSdk = (): DDPSDK => {
 	return instance;
 };
 
-const readStoredLoginToken = (): string | null => (typeof window !== 'undefined' ? window.localStorage.getItem('Meteor.loginToken') : null);
+export const readStoredLoginToken = (): string | null =>
+	typeof window !== 'undefined' ? window.localStorage.getItem('Meteor.loginToken') : null;
 
 let inflightLogin: Promise<void> | undefined;
 
diff --git a/apps/meteor/client/views/root/AppLayout.tsx b/apps/meteor/client/views/root/AppLayout.tsx
index b355d9c7b44f2..250690e98d78f 100644
--- a/apps/meteor/client/views/root/AppLayout.tsx
+++ b/apps/meteor/client/views/root/AppLayout.tsx
@@ -27,11 +27,13 @@ import { useKeyboardShortcutsHotkey } from './hooks/useKeyboardShortcutsHotkey';
 import { useLivechatEnterprise } from './hooks/useLivechatEnterprise';
 import { useLoadMissedMessages } from './hooks/useLoadMissedMessages';
 import { useLoadRoomForAllowedAnonymousRead } from './hooks/useLoadRoomForAllowedAnonymousRead';
+import { useLoginOtherClients } from './hooks/useLoginOtherClients';
 import { useLoginViaQuery } from './hooks/useLoginViaQuery';
 import { useMessageLinkClicks } from './hooks/useMessageLinkClicks';
 import { useNotificationPermission } from './hooks/useNotificationPermission';
 import { useRedirectToSetupWizard } from './hooks/useRedirectToSetupWizard';
 import { useSettingsOnLoadSiteUrl } from './hooks/useSettingsOnLoadSiteUrl';
+import { useShareSessionWithOtherClients } from './hooks/useShareSessionWithOtherClients';
 import { useStartupEvent } from './hooks/useStartupEvent';
 import { appLayout } from '../../lib/appLayout';
 
@@ -70,6 +72,8 @@ const AppLayout = () => {
 	useAutoupdate();
 	useCodeHighlight();
 	useLoginViaQuery();
+	useLoginOtherClients();
+	useShareSessionWithOtherClients();
 	useLoadMissedMessages();
 	useDesktopFavicon();
 	useDesktopTitle();
diff --git a/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts b/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
new file mode 100644
index 0000000000000..beefab27e06a8
--- /dev/null
+++ b/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
@@ -0,0 +1,29 @@
+import { useRouter } from '@rocket.chat/ui-contexts';
+import { useEffect } from 'react';
+
+import { buildDeepLinkURL } from '../../../lib/buildAuthDeeplinkURL';
+
+export const useLoginOtherClients = () => {
+	const router = useRouter();
+
+	useEffect(() => {
+		const { resumeToken, loginClient, userId } = router.getSearchParameters();
+
+		if (!resumeToken || !userId) {
+			return;
+		}
+
+		if (loginClient !== 'desktop' && loginClient !== 'mobile') {
+			return;
+		}
+
+		const loginURL = buildDeepLinkURL(resumeToken, userId);
+		window.location.href = loginURL;
+
+		const timeout = setTimeout(() => {
+			router.navigate('/home', { replace: true });
+		}, 0);
+
+		return () => clearTimeout(timeout);
+	}, [router]);
+};
diff --git a/apps/meteor/client/views/root/hooks/useLoginViaQuery.ts b/apps/meteor/client/views/root/hooks/useLoginViaQuery.ts
index a67739eb7b025..7bc3b2b93ecb0 100644
--- a/apps/meteor/client/views/root/hooks/useLoginViaQuery.ts
+++ b/apps/meteor/client/views/root/hooks/useLoginViaQuery.ts
@@ -7,12 +7,17 @@ export const useLoginViaQuery = () => {
 
 	useEffect(() => {
 		const handleLogin = async () => {
-			const { resumeToken } = router.getSearchParameters();
+			const { resumeToken, loginClient } = router.getSearchParameters();
 
 			if (!resumeToken) {
 				return;
 			}
 
+			//Case handled by useLoginOtherClients, we don't want to login here.
+			if (loginClient) {
+				return;
+			}
+
 			try {
 				await loginWithToken(resumeToken);
 
diff --git a/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts b/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
new file mode 100644
index 0000000000000..f879fa7bd3cb1
--- /dev/null
+++ b/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
@@ -0,0 +1,41 @@
+import { useRouter, useUserId } from '@rocket.chat/ui-contexts';
+import { useEffect } from 'react';
+
+import { buildDeepLinkURL } from '../../../lib/buildAuthDeeplinkURL';
+import { readStoredLoginToken } from '../../../lib/sdk/ddpSdk';
+
+export const useShareSessionWithOtherClients = () => {
+	const router = useRouter();
+	const userId = useUserId();
+
+	useEffect(() => {
+		if (!userId) {
+			return;
+		}
+
+		const loginToken = readStoredLoginToken();
+
+		if (!loginToken) {
+			return;
+		}
+
+		const { resumeToken, loginClient } = router.getSearchParameters();
+
+		if (resumeToken) {
+			return;
+		}
+
+		if (loginClient !== 'desktop' && loginClient !== 'mobile') {
+			return;
+		}
+
+		const loginURL = buildDeepLinkURL(loginToken, userId);
+		window.location.href = loginURL;
+
+		const timeout = setTimeout(() => {
+			router.navigate('/home', { replace: true });
+		}, 100);
+
+		return () => clearTimeout(timeout);
+	}, [router, userId]);
+};
diff --git a/apps/meteor/definition/externals/express-session.d.ts b/apps/meteor/definition/externals/express-session.d.ts
new file mode 100644
index 0000000000000..6a59655d241a7
--- /dev/null
+++ b/apps/meteor/definition/externals/express-session.d.ts
@@ -0,0 +1,7 @@
+import 'express-session';
+
+declare module 'express-session' {
+	interface SessionData {
+		loginClient?: string;
+	}
+}
diff --git a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
index d81ee8f8e336f..894ea9545295e 100644
--- a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
+++ b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
@@ -6,6 +6,7 @@ import type { DoneCallback, Profile } from 'passport';
 
 import { verifyFunction } from './verifyFunction';
 import { CustomOAuthStrategy } from '../../../app/custom-oauth/server/customOAuth';
+import { settings } from '../../../app/settings/server';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
 interface IOAuthRequest extends Request {
@@ -25,14 +26,27 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 		),
 	);
 
+	const siteUrl = settings.get<string>('Site_Url');
+
 	oAuthRouter.get(
 		`/oauth/${serviceName}`,
-		passport.authenticate(serviceName, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
+		(req, _res, next) => {
+			const { loginClient } = req.query;
+			if (loginClient === 'mobile' || loginClient === 'desktop') {
+				req.session.loginClient = loginClient;
+				req.session.save(() => {
+					next();
+				});
+			} else {
+				next();
+			}
+		},
+		passport.authenticate(serviceName, { scope: config.scope, prompt: 'consent', failureRedirect: '/login', keepSessionInfo: true }),
 	);
 
 	oAuthRouter.get(
 		`/oauth/${serviceName}/callback`,
-		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true }),
+		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
 		async (req: IOAuthRequest, res: Response) => {
 			const oAuthUser = req.user as IUser;
 
@@ -40,10 +54,21 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 				return res.redirect('/login');
 			}
 
+			const { loginClient } = req.session;
+
 			const stampedToken = Accounts._generateStampedLoginToken();
 			await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
 
-			res.redirect(`/home?resumeToken=${stampedToken.token}`);
+			const redirectUrl = new URL(`/home`, siteUrl);
+
+			redirectUrl.searchParams.set('resumeToken', stampedToken.token);
+			redirectUrl.searchParams.set('userId', oAuthUser._id);
+
+			if (loginClient) {
+				redirectUrl.searchParams.set('loginClient', loginClient);
+			}
+
+			res.redirect(redirectUrl.toString());
 
 			req.session.destroy((err) => {
 				if (err) {
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 23b087dcddaa1..6fae927444167 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -9,10 +9,6 @@ import type { OAuthServiceConfig } from './createOAuthServiceConfig';
 import type { ICachedSettings } from '../../../app/settings/server/CachedSettings';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
-interface IOAuthRequest extends Request {
-	user?: IUser;
-}
-
 export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[], settings: ICachedSettings) => {
 	oauthServiceConfig.forEach((config) => {
 		const Strategy = config.strategy;
@@ -36,7 +32,6 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					const profileWithRaw = profile as Profile & { _json?: Record<string, unknown>; _raw?: string };
 					const { _json, _raw, ...restProfile } = profileWithRaw;
 
-					// eslint-disable-next-line @typescript-eslint/await-thenable
 					const user = await Accounts.updateOrCreateUserFromExternalService(
 						config.provider,
 						{
@@ -67,23 +62,44 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 
 		oAuthRouter.get(
 			`/oauth/${config.provider}`,
-			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login' }),
+			(req, _res, next) => {
+				const { loginClient } = req.query;
+				if (loginClient === 'mobile' || loginClient === 'desktop') {
+					req.session.loginClient = loginClient;
+					req.session.save(() => {
+						next();
+					});
+				} else {
+					next();
+				}
+			},
+			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login', keepSessionInfo: true }),
 		);
 		oAuthRouter.get(
 			`/oauth/${config.provider}/callback`,
-			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true }),
-			async (req: IOAuthRequest, res: Response) => {
+			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
+			async (req: Request, res: Response) => {
 				const oAuthUser = req.user as IUser;
 
 				if (!oAuthUser) {
-					// return res.redirect('/login');
-					return res.redirect('/noOauthUser');
+					return res.redirect('/login');
 				}
 
+				const { loginClient } = req.session;
+
 				const stampedToken = Accounts._generateStampedLoginToken();
 				await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
 
-				res.redirect(`/home?resumeToken=${stampedToken.token}`);
+				const redirectUrl = new URL(`/home`, siteUrl);
+
+				redirectUrl.searchParams.set('resumeToken', stampedToken.token);
+				redirectUrl.searchParams.set('userId', oAuthUser._id);
+
+				if (loginClient) {
+					redirectUrl.searchParams.set('loginClient', loginClient);
+				}
+
+				res.redirect(redirectUrl.toString());
 
 				req.session.destroy((err) => {
 					if (err) {
diff --git a/packages/desktop-api/src/index.ts b/packages/desktop-api/src/index.ts
index 9d10c1f89d1c5..5344ad5d18005 100644
--- a/packages/desktop-api/src/index.ts
+++ b/packages/desktop-api/src/index.ts
@@ -63,4 +63,5 @@ export interface IRocketChatDesktop {
 	setUserToken: (token: string, userId: string) => void;
 	openDocumentViewer: (url: string, format: string, options: any) => void;
 	reloadServer: () => void;
+	openInBrowser: (url: string) => void;
 }
diff --git a/packages/i18n/src/locales/en.i18n.json b/packages/i18n/src/locales/en.i18n.json
index 4bf33527ac06a..e46b9f53543be 100644
--- a/packages/i18n/src/locales/en.i18n.json
+++ b/packages/i18n/src/locales/en.i18n.json
@@ -6810,6 +6810,7 @@
   "registration.component.form.usernameAlreadyInUse": "Username already in use",
   "registration.component.form.usernameContainsInvalidChars": "Username contains invalid characters",
   "registration.component.login": "Login",
+  "registration.component.login.onWeb": "Login on web",
   "registration.component.login.incorrectPassword": "Incorrect password",
   "registration.component.login.userNotFound": "User not found",
   "registration.component.resetPassword": "Reset password",
diff --git a/packages/web-ui-registration/global.d.ts b/packages/web-ui-registration/global.d.ts
new file mode 100644
index 0000000000000..51c30e263ccad
--- /dev/null
+++ b/packages/web-ui-registration/global.d.ts
@@ -0,0 +1,7 @@
+import type { IRocketChatDesktop } from '@rocket.chat/desktop-api';
+
+declare global {
+	interface Window {
+		RocketChatDesktop?: IRocketChatDesktop;
+	}
+}
diff --git a/packages/web-ui-registration/src/LoginServices.tsx b/packages/web-ui-registration/src/LoginServices.tsx
index e36c032e0436f..b89b866fbabf4 100644
--- a/packages/web-ui-registration/src/LoginServices.tsx
+++ b/packages/web-ui-registration/src/LoginServices.tsx
@@ -1,4 +1,4 @@
-import { ButtonGroup, Divider } from '@rocket.chat/fuselage';
+import { Button, ButtonGroup, Divider } from '@rocket.chat/fuselage';
 import { useLoginServices, useSetting } from '@rocket.chat/ui-contexts';
 import type { Dispatch, ReactElement, SetStateAction } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -21,6 +21,16 @@ const LoginServices = ({
 		return null;
 	}
 
+	const isDesktopApp = !!window.RocketChatDesktop?.openInBrowser;
+
+	const handleLoginOnWeb = () => {
+		if (!isDesktopApp) {
+			return;
+		}
+
+		window.RocketChatDesktop?.openInBrowser(`${window.location.href}?loginClient=desktop`);
+	};
+
 	return (
 		<>
 			{showFormLogin && (
@@ -28,11 +38,18 @@ const LoginServices = ({
 					{t('registration.component.form.divider')}
 				</Divider>
 			)}
-			<ButtonGroup vertical stretch small>
-				{services.map((service) => (
-					<LoginServicesButton disabled={disabled} key={service.service} {...service} setError={setError} />
-				))}
-			</ButtonGroup>
+			{!isDesktopApp && (
+				<ButtonGroup vertical stretch small>
+					{services.map((service) => (
+						<LoginServicesButton disabled={disabled} key={service.service} {...service} setError={setError} />
+					))}
+				</ButtonGroup>
+			)}
+			{isDesktopApp && (
+				<Button width='100%' primary onClick={handleLoginOnWeb}>
+					{t('registration.component.login.onWeb')}
+				</Button>
+			)}
 		</>
 	);
 };
diff --git a/packages/web-ui-registration/src/LoginServicesButton.tsx b/packages/web-ui-registration/src/LoginServicesButton.tsx
index e5488a18ace07..dbc9db53d491f 100644
--- a/packages/web-ui-registration/src/LoginServicesButton.tsx
+++ b/packages/web-ui-registration/src/LoginServicesButton.tsx
@@ -32,7 +32,17 @@ const LoginServicesButton = <T extends LoginService>({
 
 	const handleOnClick = useCallback(() => {
 		if (!isLegacyOAuthEnabled) {
-			window.location.href = `/oauth/${service}`;
+			const url = new URL(window.location.href);
+			const queryParams = url.searchParams;
+			const loginClient = queryParams.get('loginClient');
+
+			const redirectUrl = new URL(`/oauth/${service}`, window.location.origin);
+
+			if (loginClient) {
+				redirectUrl.searchParams.set('loginClient', loginClient);
+			}
+
+			window.location.href = redirectUrl.toString();
 			return;
 		}
 
diff --git a/packages/web-ui-registration/tsconfig.build.json b/packages/web-ui-registration/tsconfig.build.json
index 73f50b10a9645..78b00e08930a3 100644
--- a/packages/web-ui-registration/tsconfig.build.json
+++ b/packages/web-ui-registration/tsconfig.build.json
@@ -1,5 +1,5 @@
 {
 	"extends": "./tsconfig.json",
-	"include": ["./src/**/*"],
+	"include": ["./src/**/*", "./global.d.ts"],
 	"exclude": ["./src/**/*.spec.ts", "./src/**/*.stories.tsx"]
 }
diff --git a/packages/web-ui-registration/tsconfig.json b/packages/web-ui-registration/tsconfig.json
index e1348ec0e2e74..46506c90ec74c 100644
--- a/packages/web-ui-registration/tsconfig.json
+++ b/packages/web-ui-registration/tsconfig.json
@@ -4,5 +4,5 @@
 		"rootDirs": ["./src","./.storybook"],
 		"outDir": "./dist"
 	},
-	"include": ["./src", "./.storybook"],
+	"include": ["./src", "./.storybook", "./global.d.ts"],
 }

From 9cda3cfbc7f06a6de20e75873b818392791e0a50 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 02:44:22 +0530
Subject: [PATCH 17/43] feat: Secret setting for express-sessions secret
 (#40602)

Co-authored-by: Ricardo Garim <rswarovsky@gmail.com>
---
 .../server/configuration/configurePassport.ts | 37 +++++++++----------
 apps/meteor/server/settings/oauth.ts          |  7 ++++
 2 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index da0469931ca55..d65bf7bb1cd6b 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,5 +1,4 @@
 import type { IUser } from '@rocket.chat/core-typings';
-import { Random } from '@rocket.chat/random';
 import express from 'express';
 import flash from 'express-flash';
 import session from 'express-session';
@@ -13,28 +12,28 @@ import { getOAuthServices } from '../lib/oauth/getOAuthServices';
 
 export const oAuthRouter = express();
 
-oAuthRouter.use(
-	session({
-		name: 'oauth',
-		secret: Random.secret(),
-		resave: false,
-		saveUninitialized: false,
-		cookie: {
-			httpOnly: true,
-			secure: process.env.NODE_ENV === 'production',
-			maxAge: 5 * 60 * 1000, // 5 minutes
-		},
-	}),
-);
-
 oAuthRouter.enable('trust proxy');
 oAuthRouter.set('trust proxy', true);
 
-oAuthRouter.use(passport.initialize());
-oAuthRouter.use(passport.session());
-oAuthRouter.use(flash());
-
 export const configurePassport = (settings: ICachedSettings) => {
+	oAuthRouter.use(
+		session({
+			name: 'oauth',
+			secret: settings.get<string>('Accounts_OAuth_Session_Secret'),
+			resave: false,
+			saveUninitialized: false,
+			cookie: {
+				httpOnly: true,
+				secure: process.env.NODE_ENV === 'production',
+				maxAge: 5 * 60 * 1000, // 5 minutes
+			},
+		}),
+	);
+
+	oAuthRouter.use(passport.initialize());
+	oAuthRouter.use(passport.session());
+	oAuthRouter.use(flash());
+
 	passport.serializeUser((user: any, done) => {
 		done(null, user);
 	});
diff --git a/apps/meteor/server/settings/oauth.ts b/apps/meteor/server/settings/oauth.ts
index 2aea9b119cf83..8ee583614882b 100644
--- a/apps/meteor/server/settings/oauth.ts
+++ b/apps/meteor/server/settings/oauth.ts
@@ -1,3 +1,5 @@
+import { Random } from '@rocket.chat/random';
+
 import { settingsRegistry } from '../../app/settings/server';
 
 export const createOauthSettings = () =>
@@ -405,6 +407,11 @@ export const createOauthSettings = () =>
 				enableQuery,
 			});
 		});
+		await this.add('Accounts_OAuth_Session_Secret', Random.secret(), {
+			type: 'string',
+			secret: true,
+			hidden: true,
+		});
 		return this.section('Proxy', async function () {
 			await this.add('Accounts_OAuth_Proxy_host', 'https://oauth-proxy.rocket.chat', {
 				type: 'string',

From 93af0a874ccee6cba7d74478f03b5e9bed5d3d52 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 02:59:43 +0530
Subject: [PATCH 18/43] chore: Passport Nextcloud OAuth (#40591)

---
 .../app/custom-oauth/server/customOAuth.ts    |  2 +
 apps/meteor/app/nextcloud/server/lib.ts       | 45 +++++++++++--------
 2 files changed, 29 insertions(+), 18 deletions(-)

diff --git a/apps/meteor/app/custom-oauth/server/customOAuth.ts b/apps/meteor/app/custom-oauth/server/customOAuth.ts
index 04b940e7d95b3..21afcf71ece4a 100644
--- a/apps/meteor/app/custom-oauth/server/customOAuth.ts
+++ b/apps/meteor/app/custom-oauth/server/customOAuth.ts
@@ -236,6 +236,8 @@ export class CustomOAuthStrategy extends Strategy {
 			try {
 				const result = JSON.parse(typeof body === 'string' ? body : body.toString());
 				const normalizedIdentity = this.normalizeIdentity(result);
+				//Nextcloud URL needed on addWebdavServer
+				normalizedIdentity.serverURL = this.serverURL;
 				return done(null, normalizedIdentity);
 			} catch (e) {
 				return done(new Error(`Failed to parse identity from ${this.name} at ${this.identityPath}. ${e}`));
diff --git a/apps/meteor/app/nextcloud/server/lib.ts b/apps/meteor/app/nextcloud/server/lib.ts
index 28cf52da57a17..fc2b592b7c1ad 100644
--- a/apps/meteor/app/nextcloud/server/lib.ts
+++ b/apps/meteor/app/nextcloud/server/lib.ts
@@ -1,14 +1,12 @@
-import type { OauthConfig } from '@rocket.chat/core-typings';
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
-import _ from 'underscore';
 
-import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
-import { settings } from '../../settings/server';
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { settings } from '../../settings/server/cached';
 
-const config: OauthConfig = {
-	serverURL: '',
+const NEXTCLOUD_PATHS = {
 	tokenPath: '/index.php/apps/oauth2/api/v1/token',
-	tokenSentVia: 'header',
+	tokenSentVia: 'header' as OAuthConfiguration['tokenSentVia'],
 	authorizePath: '/index.php/apps/oauth2/authorize',
 	identityPath: '/ocs/v2.php/cloud/user?format=json',
 	scope: 'openid',
@@ -18,20 +16,31 @@ const config: OauthConfig = {
 	},
 };
 
-const Nextcloud = new CustomOAuth('nextcloud', config);
+function configureNextcloudOAuth(): void {
+	const enabled = settings.get<boolean>('Accounts_OAuth_Nextcloud');
+	if (!enabled) {
+		return;
+	}
 
-const fillServerURL = _.debounce((): void => {
-	const nextcloudURL = settings.get<string>('Accounts_OAuth_Nextcloud_URL');
-	if (!nextcloudURL) {
-		if (nextcloudURL === undefined) {
-			return fillServerURL();
-		}
+	const serverURL = settings.get<string>('Accounts_OAuth_Nextcloud_URL')?.trim().replace(/\/*$/, '');
+	const clientId = settings.get<string>('Accounts_OAuth_Nextcloud_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Nextcloud_secret');
+
+	if (!serverURL || !clientId || !clientSecret) {
 		return;
 	}
-	config.serverURL = nextcloudURL.trim().replace(/\/*$/, '');
-	return Nextcloud.configure(config);
-}, 1000);
+
+	addPassportCustomOAuth('nextcloud', {
+		...NEXTCLOUD_PATHS,
+		serverURL,
+		clientId,
+		clientSecret,
+	});
+}
 
 Meteor.startup(() => {
-	settings.watch('Accounts_OAuth_Nextcloud_URL', () => fillServerURL());
+	settings.watchMultiple(
+		['Accounts_OAuth_Nextcloud', 'Accounts_OAuth_Nextcloud_URL', 'Accounts_OAuth_Nextcloud_id', 'Accounts_OAuth_Nextcloud_secret'],
+		configureNextcloudOAuth,
+	);
 });

From c7f7306a729df7c58bf9a76d8dbb7646b5bbfd99 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 03:14:11 +0530
Subject: [PATCH 19/43] chore: Passport Meteor OAuth (#40595)

---
 .../app/meteor-developer/server/index.ts      |  1 +
 .../meteor/app/meteor-developer/server/lib.ts | 46 +++++++++++++++++++
 apps/meteor/server/importPackages.ts          |  1 +
 3 files changed, 48 insertions(+)
 create mode 100644 apps/meteor/app/meteor-developer/server/index.ts
 create mode 100644 apps/meteor/app/meteor-developer/server/lib.ts

diff --git a/apps/meteor/app/meteor-developer/server/index.ts b/apps/meteor/app/meteor-developer/server/index.ts
new file mode 100644
index 0000000000000..cf327e4971bb2
--- /dev/null
+++ b/apps/meteor/app/meteor-developer/server/index.ts
@@ -0,0 +1 @@
+import './lib';
diff --git a/apps/meteor/app/meteor-developer/server/lib.ts b/apps/meteor/app/meteor-developer/server/lib.ts
new file mode 100644
index 0000000000000..cb532732ead92
--- /dev/null
+++ b/apps/meteor/app/meteor-developer/server/lib.ts
@@ -0,0 +1,46 @@
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
+import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
+
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
+import { settings } from '../../settings/server';
+
+const config: Partial<OAuthConfiguration> = {
+	serverURL: 'https://www.meteor.com',
+	authorizePath: '/oauth2/authorize',
+	tokenPath: '/oauth2/token',
+	identityPath: '/api/v1/identity',
+	scope: 'email',
+	tokenSentVia: 'header',
+	addAutopublishFields: {
+		forLoggedInUser: ['services.meteor-developer'],
+		forOtherUsers: ['services.meteor-developer.username'],
+	},
+};
+
+const serviceKey = 'meteor-developer';
+
+const configureMeteorDeveloperOAuth = (): void => {
+	passport.unuse(serviceKey);
+
+	const enabled = settings.get<boolean>('Accounts_OAuth_Meteor');
+	if (!enabled) {
+		return;
+	}
+
+	const clientId = settings.get<string>('Accounts_OAuth_Meteor_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Meteor_secret');
+
+	if (!clientId || !clientSecret) {
+		return;
+	}
+
+	addPassportCustomOAuth(serviceKey, { ...config, clientId, clientSecret });
+};
+
+Meteor.startup(() => {
+	settings.watchMultiple(
+		['Accounts_OAuth_Meteor', 'Accounts_OAuth_Meteor_id', 'Accounts_OAuth_Meteor_secret'],
+		configureMeteorDeveloperOAuth,
+	);
+});
diff --git a/apps/meteor/server/importPackages.ts b/apps/meteor/server/importPackages.ts
index 8dd1046b515b9..228d809fe6dc2 100644
--- a/apps/meteor/server/importPackages.ts
+++ b/apps/meteor/server/importPackages.ts
@@ -33,6 +33,7 @@ import '../app/importer-slack-users/server';
 import '../app/integrations/server';
 import '../app/irc/server';
 import '../app/lib/server';
+import '../app/meteor-developer/server';
 import '../app/linkedin/server';
 import '../app/token-login/server';
 import '../app/mailer/server/api';

From 80a082bcf60bffdd9f08bb93a871c80b86833ebf Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 19 May 2026 03:17:31 +0530
Subject: [PATCH 20/43] me stupid

---
 apps/meteor/client/lib/sdk/ddpSdk.ts | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/apps/meteor/client/lib/sdk/ddpSdk.ts b/apps/meteor/client/lib/sdk/ddpSdk.ts
index c671880cf3fe6..09c2b43ac10a7 100644
--- a/apps/meteor/client/lib/sdk/ddpSdk.ts
+++ b/apps/meteor/client/lib/sdk/ddpSdk.ts
@@ -68,8 +68,7 @@ export const getDdpSdk = (): DDPSDK => {
 	return instance;
 };
 
-export const readStoredLoginToken = (): string | null =>
-	typeof window !== 'undefined' ? window.localStorage.getItem('Meteor.loginToken') : null;
+export const readStoredLoginToken = (): string | null => getStoredItem(STORAGE_KEYS.LOGIN_TOKEN);
 
 let inflightLogin: Promise<void> | undefined;
 

From afda09bd58d280c104dc0d3635fe9d1f793c182d Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 18:37:26 +0530
Subject: [PATCH 21/43] chore: Passport Github Enterprise OAuth (#40608)

---
 .../server/lib/oauth/configureOAuthServices.ts      |  1 +
 .../server/lib/oauth/createOAuthServiceConfig.ts    | 13 +++++++++++++
 apps/meteor/server/lib/oauth/oauthConfigs.ts        |  4 ++++
 3 files changed, 18 insertions(+)

diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 6fae927444167..a49df2f0d4529 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -20,6 +20,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 			config.provider,
 			new Strategy(
 				{
+					...config,
 					clientID: config.clientId,
 					clientSecret: config.clientSecret,
 					callbackURL: `${siteUrl}/oauth/${config.provider}/callback`,
diff --git a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
index 723f1db7a665b..2657e6aba3c72 100644
--- a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
+++ b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
@@ -14,6 +14,19 @@ export type OAuthServiceConfig = {
 
 export const createOAuthServiceConfig = (settings: ICachedSettings, services: string[]): OAuthServiceConfig[] => {
 	return services.map((service) => {
+		if (service === 'github_enterprise') {
+			return {
+				provider: service,
+				clientId: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_id'),
+				clientSecret: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_secret'),
+				authorizationURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/authorize`,
+				tokenURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/access_token`,
+				userProfileURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/api/v3/user`,
+				strategy: OAuthConfigs.github_enterprise.strategy,
+				scope: OAuthConfigs.github_enterprise.scope,
+			};
+		}
+
 		return {
 			provider: service,
 			strategy: OAuthConfigs[service].strategy,
diff --git a/apps/meteor/server/lib/oauth/oauthConfigs.ts b/apps/meteor/server/lib/oauth/oauthConfigs.ts
index 55b2c607cbdcd..4ddd63333b3ba 100644
--- a/apps/meteor/server/lib/oauth/oauthConfigs.ts
+++ b/apps/meteor/server/lib/oauth/oauthConfigs.ts
@@ -21,6 +21,10 @@ export const OAuthConfigs: Record<string, OAuthConfig> = {
 		strategy: GoogleStrategy,
 		scope: ['email', 'profile'],
 	},
+	github_enterprise: {
+		strategy: GitHubStrategy,
+		scope: ['user:email'],
+	},
 } as const;
 
 export type Provider = keyof typeof OAuthConfigs;

From dc44d7c4fc8b54a36f6c4b90945bc1e9fae30197 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 20:38:18 +0530
Subject: [PATCH 22/43] chore: Passport Gitlab OAuth (#40609)

---
 apps/meteor/app/gitlab/server/lib.ts | 49 +++++++++++++++++++++-------
 1 file changed, 37 insertions(+), 12 deletions(-)

diff --git a/apps/meteor/app/gitlab/server/lib.ts b/apps/meteor/app/gitlab/server/lib.ts
index 0f4d330cf5970..3df1c1ded5496 100644
--- a/apps/meteor/app/gitlab/server/lib.ts
+++ b/apps/meteor/app/gitlab/server/lib.ts
@@ -1,11 +1,12 @@
-import type { OauthConfig } from '@rocket.chat/core-typings';
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
 import _ from 'underscore';
 
-import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
 import { settings } from '../../settings/server';
 
-const config: OauthConfig = {
+const config: Partial<OAuthConfiguration> = {
 	serverURL: 'https://gitlab.com',
 	identityPath: '/api/v4/user',
 	scope: 'read_user',
@@ -17,15 +18,39 @@ const config: OauthConfig = {
 	accessTokenParam: 'access_token',
 };
 
-const Gitlab = new CustomOAuth('gitlab', config);
+const configureGitlabOAuth = () => {
+	passport.unuse('gitlab');
+
+	const enabled = settings.get<boolean>('Accounts_OAuth_Gitlab');
+	if (!enabled) {
+		return;
+	}
+
+	const clientId = settings.get<string>('Accounts_OAuth_Gitlab_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Gitlab_secret');
+	const serverURL = settings.get<string>('API_Gitlab_URL').trim().replace(/\/*$/, '') || config.serverURL;
+	const identityPath = settings.get<string>('Accounts_OAuth_Gitlab_identity_path') || config.identityPath;
+	const mergeUsers = Boolean(settings.get<boolean>('Accounts_OAuth_Gitlab_merge_users'));
+
+	if (!clientId || !clientSecret) {
+		return;
+	}
+
+	addPassportCustomOAuth('gitlab', { ...config, clientId, clientSecret, serverURL, identityPath, mergeUsers });
+};
 
 Meteor.startup(() => {
-	const updateConfig = _.debounce(() => {
-		config.serverURL = settings.get<string>('API_Gitlab_URL').trim().replace(/\/*$/, '') || config.serverURL;
-		config.identityPath = settings.get('Accounts_OAuth_Gitlab_identity_path') || config.identityPath;
-		config.mergeUsers = Boolean(settings.get<boolean>('Accounts_OAuth_Gitlab_merge_users'));
-		Gitlab.configure(config);
-	}, 300);
-
-	settings.watchMultiple(['API_Gitlab_URL', 'Accounts_OAuth_Gitlab_identity_path', 'Accounts_OAuth_Gitlab_merge_users'], updateConfig);
+	const updateConfig = _.debounce(configureGitlabOAuth, 300);
+
+	settings.watchMultiple(
+		[
+			'Accounts_OAuth_Gitlab',
+			'API_Gitlab_URL',
+			'Accounts_OAuth_Gitlab_id',
+			'Accounts_OAuth_Gitlab_secret',
+			'Accounts_OAuth_Gitlab_identity_path',
+			'Accounts_OAuth_Gitlab_merge_users',
+		],
+		updateConfig,
+	);
 });

From f052ca893663fa49b8da6fee9d530ba6772d86bc Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 20:55:05 +0530
Subject: [PATCH 23/43] chore: Passport Dolphin (#40611)

---
 apps/meteor/app/dolphin/server/lib.ts | 39 ++++++++++++++++++++-------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/apps/meteor/app/dolphin/server/lib.ts b/apps/meteor/app/dolphin/server/lib.ts
index 826a277b81e4e..77622fe43edab 100644
--- a/apps/meteor/app/dolphin/server/lib.ts
+++ b/apps/meteor/app/dolphin/server/lib.ts
@@ -1,13 +1,15 @@
-import type { IUser } from '@rocket.chat/core-typings';
+import type { IUser, OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
 import { ServiceConfiguration } from 'meteor/service-configuration';
+import passport from 'passport';
+import _ from 'underscore';
 
 import { callbacks } from '../../../server/lib/callbacks';
 import { beforeCreateUserCallback } from '../../../server/lib/callbacks/beforeCreateUserCallback';
-import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
 import { settings } from '../../settings/server';
 
-const config = {
+const config: Partial<OAuthConfiguration> = {
 	serverURL: '',
 	authorizePath: '/m/oauth2/auth/',
 	tokenPath: '/m/oauth2/token/',
@@ -20,8 +22,6 @@ const config = {
 	accessTokenParam: 'access_token',
 };
 
-const Dolphin = new CustomOAuth('dolphin', config);
-
 function DolphinOnCreateUser(options: any, user?: IUser) {
 	// TODO: callbacks Fix this
 	if (user?.services?.dolphin?.NickName) {
@@ -30,11 +30,32 @@ function DolphinOnCreateUser(options: any, user?: IUser) {
 	return options;
 }
 
+const configureDolphinOAuth = () => {
+	passport.unuse('dolphin');
+
+	const enabled = settings.get<boolean>('Accounts_OAuth_Dolphin');
+	if (!enabled) {
+		return;
+	}
+
+	const serverURL = settings.get<string>('Accounts_OAuth_Dolphin_URL').trim().replace(/\/*$/, '');
+	const clientId = settings.get<string>('Accounts_OAuth_Dolphin_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Dolphin_secret');
+
+	if (!clientId || !clientSecret || !serverURL) {
+		return;
+	}
+
+	addPassportCustomOAuth('dolphin', { ...config, serverURL, clientId, clientSecret });
+};
+
 Meteor.startup(async () => {
-	settings.watch<string>('Accounts_OAuth_Dolphin_URL', (value) => {
-		config.serverURL = value;
-		return Dolphin.configure(config);
-	});
+	const updateConfig = () => _.debounce(configureDolphinOAuth, 300);
+
+	settings.watchMultiple(
+		['Accounts_OAuth_Dolphin', 'Accounts_OAuth_Dolphin_URL', 'Accounts_OAuth_Dolphin_id', 'Accounts_OAuth_Dolphin_secret'],
+		updateConfig,
+	);
 
 	if (settings.get('Accounts_OAuth_Dolphin_URL')) {
 		const data = {

From 02fa86bd1a12854c66d612806ac676cdcf0ed2d4 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 20:55:32 +0530
Subject: [PATCH 24/43] chore: Passport Drupal OAuth (#40610)

---
 apps/meteor/app/drupal/server/lib.ts | 40 +++++++++++++++++++---------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/apps/meteor/app/drupal/server/lib.ts b/apps/meteor/app/drupal/server/lib.ts
index d137551fb8377..a4f71bd81696f 100644
--- a/apps/meteor/app/drupal/server/lib.ts
+++ b/apps/meteor/app/drupal/server/lib.ts
@@ -1,14 +1,12 @@
-import type { OauthConfig } from '@rocket.chat/core-typings';
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
+import passport from 'passport';
+import _ from 'underscore';
 
-import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
 import { settings } from '../../settings/server';
 
-// Drupal Server CallBack URL needs to be http(s)://{rocketchat.server}[:port]/_oauth/drupal
-// In RocketChat -> Administration the URL needs to be http(s)://{drupal.server}/
-
-const config: OauthConfig = {
-	serverURL: '',
+const config: Partial<OAuthConfiguration> = {
 	identityPath: '/oauth2/UserInfo',
 	authorizePath: '/oauth2/authorize',
 	tokenPath: '/oauth2/token',
@@ -23,11 +21,29 @@ const config: OauthConfig = {
 	accessTokenParam: 'access_token',
 };
 
-const Drupal = new CustomOAuth('drupal', config);
+const configureDrupalOAuth = () => {
+	passport.unuse('drupal');
+	const enabled = settings.get<boolean>('Accounts_OAuth_Drupal');
+	if (!enabled) {
+		return;
+	}
+
+	const serverURL = settings.get<string>('API_Drupal_URL').trim().replace(/\/*$/, '');
+	const clientId = settings.get<string>('Accounts_OAuth_Drupal_id');
+	const clientSecret = settings.get<string>('Accounts_OAuth_Drupal_secret');
+
+	if (!clientId || !clientSecret || !serverURL) {
+		return;
+	}
+
+	addPassportCustomOAuth('drupal', { ...config, serverURL, clientId, clientSecret });
+};
 
 Meteor.startup(() => {
-	settings.watch<string>('API_Drupal_URL', (value) => {
-		config.serverURL = value;
-		Drupal.configure(config);
-	});
+	const updateConfig = _.debounce(configureDrupalOAuth, 300);
+
+	settings.watchMultiple(
+		['Accounts_OAuth_Drupal', 'API_Drupal_URL', 'Accounts_OAuth_Drupal_id', 'Accounts_OAuth_Drupal_secret'],
+		updateConfig,
+	);
 });

From f7090645e263a9c0188f597b24cc03bab4f9dd16 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Tue, 19 May 2026 21:09:37 +0530
Subject: [PATCH 25/43] chore: Passport Wordpress OAuth (#40593)

---
 apps/meteor/app/wordpress/server/lib.ts | 26 +++++++++++--------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/apps/meteor/app/wordpress/server/lib.ts b/apps/meteor/app/wordpress/server/lib.ts
index 7777ea1382215..eb1ce2c01ceb2 100644
--- a/apps/meteor/app/wordpress/server/lib.ts
+++ b/apps/meteor/app/wordpress/server/lib.ts
@@ -1,12 +1,13 @@
-import type { OauthConfig } from '@rocket.chat/core-typings';
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import { Meteor } from 'meteor/meteor';
 import { ServiceConfiguration } from 'meteor/service-configuration';
+import passport from 'passport';
 import _ from 'underscore';
 
-import { CustomOAuth } from '../../custom-oauth/server/custom_oauth_server';
+import { addPassportCustomOAuth } from '../../../server/lib/oauth/addPassportCustomOAuth';
 import { settings } from '../../settings/server';
 
-const config: OauthConfig = {
+const config: Partial<OAuthConfiguration> = {
 	serverURL: '',
 	identityPath: '/oauth/me',
 
@@ -17,7 +18,7 @@ const config: OauthConfig = {
 	accessTokenParam: 'access_token',
 };
 
-const WordPress = new CustomOAuth('wordpress', config);
+const serviceKey = 'wordpress';
 
 const fillSettings = _.debounce(async (): Promise<void> => {
 	config.serverURL = settings.get('API_Wordpress_URL');
@@ -28,11 +29,7 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 		return;
 	}
 
-	delete config.identityPath;
-	delete config.identityTokenSentVia;
-	delete config.authorizePath;
-	delete config.tokenPath;
-	delete config.scope;
+	passport.unuse(serviceKey);
 
 	const serverType = settings.get('Accounts_OAuth_Wordpress_server_type');
 	switch (serverType) {
@@ -59,7 +56,7 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 			break;
 		case 'wordpress-com':
 			config.identityPath = 'https://public-api.wordpress.com/rest/v1/me';
-			config.identityTokenSentVia = 'header';
+			config.identityTokenSentVia = 'header' as OAuthConfiguration['identityTokenSentVia'];
 			config.authorizePath = 'https://public-api.wordpress.com/oauth2/authorize';
 			config.tokenPath = 'https://public-api.wordpress.com/oauth2/token';
 			config.scope = 'auth';
@@ -69,12 +66,13 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 			break;
 	}
 
-	const result = WordPress.configure(config);
+	addPassportCustomOAuth(serviceKey, config);
+
 	const enabled = settings.get('Accounts_OAuth_Wordpress');
 	if (enabled) {
 		await ServiceConfiguration.configurations.upsertAsync(
 			{
-				service: 'wordpress',
+				service: serviceKey,
 			},
 			{
 				$set: config,
@@ -82,11 +80,9 @@ const fillSettings = _.debounce(async (): Promise<void> => {
 		);
 	} else {
 		await ServiceConfiguration.configurations.removeAsync({
-			service: 'wordpress',
+			service: serviceKey,
 		});
 	}
-
-	return result;
 }, 1000);
 
 Meteor.startup(() => {

From 9509e9b6bb0dc4b71861a5358b6b1b994c6fce9f Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 19 May 2026 21:38:22 +0530
Subject: [PATCH 26/43] add rate limiter

---
 .../server/configuration/configurePassport.ts   | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index d65bf7bb1cd6b..2109523459176 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,6 +1,7 @@
 import type { IUser } from '@rocket.chat/core-typings';
 import express from 'express';
 import flash from 'express-flash';
+import rateLimit from 'express-rate-limit';
 import session from 'express-session';
 import { WebApp } from 'meteor/webapp';
 import passport from 'passport';
@@ -34,6 +35,22 @@ export const configurePassport = (settings: ICachedSettings) => {
 	oAuthRouter.use(passport.session());
 	oAuthRouter.use(flash());
 
+	const oauthRateLimiter = rateLimit({
+		windowMs: settings.get<number>('API_Enable_Rate_Limiter_Limit_Time_Default'),
+		max: settings.get<number>('API_Enable_Rate_Limiter_Limit_Calls_Default'),
+		skip: () =>
+			settings.get<boolean>('API_Enable_Rate_Limiter') !== true ||
+			(process.env.NODE_ENV === 'development' && settings.get<boolean>('API_Enable_Rate_Limiter_Dev') !== true),
+		handler: (_req, res) => {
+			res.status(429).json({
+				success: false,
+				error: 'Too many requests. Please try again later.',
+			});
+		},
+	});
+
+	oAuthRouter.use(oauthRateLimiter);
+
 	passport.serializeUser((user: any, done) => {
 		done(null, user);
 	});

From d394e16776bd5fe1d171f6692c0f5e0934adec05 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 19 May 2026 22:26:06 +0530
Subject: [PATCH 27/43] exclude saml, cas, ldap from login flow

---
 .../web-ui-registration/src/LoginServices.tsx | 21 +++++++++++++------
 .../src/LoginServicesButton.tsx               |  9 ++++----
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/packages/web-ui-registration/src/LoginServices.tsx b/packages/web-ui-registration/src/LoginServices.tsx
index b89b866fbabf4..5e9d3972e60ea 100644
--- a/packages/web-ui-registration/src/LoginServices.tsx
+++ b/packages/web-ui-registration/src/LoginServices.tsx
@@ -1,11 +1,13 @@
 import { Button, ButtonGroup, Divider } from '@rocket.chat/fuselage';
 import { useLoginServices, useSetting } from '@rocket.chat/ui-contexts';
-import type { Dispatch, ReactElement, SetStateAction } from 'react';
+import { useMemo, type Dispatch, type ReactElement, type SetStateAction } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import type { LoginErrorState } from './LoginForm';
 import LoginServicesButton from './LoginServicesButton';
 
+const servicesToBeShownOnDesktop = ['saml', 'cas', 'ldap'];
+
 const LoginServices = ({
 	disabled,
 	setError,
@@ -17,12 +19,17 @@ const LoginServices = ({
 	const services = useLoginServices();
 	const showFormLogin = useSetting('Accounts_ShowFormLogin');
 
+	const isDesktopApp = !!window.RocketChatDesktop?.openInBrowser;
+
+	const servicesToShow = useMemo(
+		() => (isDesktopApp ? services.filter(({ service }) => servicesToBeShownOnDesktop.includes(service)) : services),
+		[isDesktopApp, services],
+	);
+
 	if (services.length === 0) {
 		return null;
 	}
 
-	const isDesktopApp = !!window.RocketChatDesktop?.openInBrowser;
-
 	const handleLoginOnWeb = () => {
 		if (!isDesktopApp) {
 			return;
@@ -38,15 +45,17 @@ const LoginServices = ({
 					{t('registration.component.form.divider')}
 				</Divider>
 			)}
-			{!isDesktopApp && (
+
+			{servicesToShow.length > 0 && (
 				<ButtonGroup vertical stretch small>
-					{services.map((service) => (
+					{servicesToShow.map((service) => (
 						<LoginServicesButton disabled={disabled} key={service.service} {...service} setError={setError} />
 					))}
 				</ButtonGroup>
 			)}
+
 			{isDesktopApp && (
-				<Button width='100%' primary onClick={handleLoginOnWeb}>
+				<Button width='100%' primary onClick={handleLoginOnWeb} marginBlockStart={4}>
 					{t('registration.component.login.onWeb')}
 				</Button>
 			)}
diff --git a/packages/web-ui-registration/src/LoginServicesButton.tsx b/packages/web-ui-registration/src/LoginServicesButton.tsx
index dbc9db53d491f..62d3d9856cd17 100644
--- a/packages/web-ui-registration/src/LoginServicesButton.tsx
+++ b/packages/web-ui-registration/src/LoginServicesButton.tsx
@@ -1,5 +1,4 @@
 import { Button } from '@rocket.chat/fuselage';
-import { useLocalStorage } from '@rocket.chat/fuselage-hooks';
 import type { Keys as IconName } from '@rocket.chat/icons';
 import type { LoginService } from '@rocket.chat/ui-contexts';
 import { useLoginWithService } from '@rocket.chat/ui-contexts';
@@ -9,6 +8,8 @@ import { useTranslation } from 'react-i18next';
 
 import type { LoginErrorState, LoginErrors } from './LoginForm';
 
+const servicesSupportedByMeteor = ['saml', 'cas', 'ldap'];
+
 const LoginServicesButton = <T extends LoginService>({
 	buttonLabelText,
 	icon,
@@ -28,10 +29,8 @@ const LoginServicesButton = <T extends LoginService>({
 	const { t } = useTranslation();
 	const handler = useLoginWithService({ service, buttonLabelText, ...props });
 
-	const [isLegacyOAuthEnabled] = useLocalStorage<boolean>('useLegacyOAuth', false);
-
 	const handleOnClick = useCallback(() => {
-		if (!isLegacyOAuthEnabled) {
+		if (!servicesSupportedByMeteor.includes(service)) {
 			const url = new URL(window.location.href);
 			const queryParams = url.searchParams;
 			const loginClient = queryParams.get('loginClient');
@@ -52,7 +51,7 @@ const LoginServicesButton = <T extends LoginService>({
 			}
 			setError?.([e.error, e.reason]);
 		});
-	}, [handler, setError, isLegacyOAuthEnabled, service]);
+	}, [handler, setError, service]);
 
 	return (
 		<Button

From df761f0a6cb68b107119bed514afbe1612524929 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 19 May 2026 22:38:46 +0530
Subject: [PATCH 28/43] express sessions mongo store

---
 apps/meteor/package.json                      |  1 +
 .../server/configuration/configurePassport.ts | 11 ++++-
 yarn.lock                                     | 48 +++++++++++++++++--
 3 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index f8ada19e2edda..ef5ec939ef084 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -183,6 +183,7 @@
 		"colorette": "^2.0.20",
 		"colors": "^1.4.0",
 		"connect": "^3.7.0",
+		"connect-mongo": "5.1.0",
 		"cookie": "^0.7.2",
 		"cookie-parser": "^1.4.7",
 		"cors": "^2.8.6",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 2109523459176..f7aa533ab0c55 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,8 +1,10 @@
 import type { IUser } from '@rocket.chat/core-typings';
+import MongoStore from 'connect-mongo';
 import express from 'express';
 import flash from 'express-flash';
 import rateLimit from 'express-rate-limit';
 import session from 'express-session';
+import { MongoInternals } from 'meteor/mongo';
 import { WebApp } from 'meteor/webapp';
 import passport from 'passport';
 
@@ -13,9 +15,10 @@ import { getOAuthServices } from '../lib/oauth/getOAuthServices';
 
 export const oAuthRouter = express();
 
-oAuthRouter.enable('trust proxy');
 oAuthRouter.set('trust proxy', true);
 
+const { client } = MongoInternals.defaultRemoteCollectionDriver().mongo;
+
 export const configurePassport = (settings: ICachedSettings) => {
 	oAuthRouter.use(
 		session({
@@ -23,6 +26,12 @@ export const configurePassport = (settings: ICachedSettings) => {
 			secret: settings.get<string>('Accounts_OAuth_Session_Secret'),
 			resave: false,
 			saveUninitialized: false,
+			store: MongoStore.create({
+				client,
+				collectionName: 'rocketchat_oauth_sessions',
+				ttl: 5 * 60,
+				autoRemove: 'native',
+			}),
 			cookie: {
 				httpOnly: true,
 				secure: process.env.NODE_ENV === 'production',
diff --git a/yarn.lock b/yarn.lock
index 7dcb5765d3c84..3a8e71798c778 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4232,6 +4232,18 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@jas-/asn.1@npm:>=5":
+  version: 5.4.2
+  resolution: "@jas-/asn.1@npm:5.4.2"
+  dependencies:
+    bn.js: "npm:>=5"
+    inherits: "npm:>=2"
+    minimalistic-assert: "npm:>=1"
+    safer-buffer: "npm:>=2"
+  checksum: 10/2b7e09ccceee3a2fae02d9e37f7875199148e3e654d10741e37e8f2f775ac318015b2d8902bb3895c00aafa1ebf6bc25fefa8a09bc65e85ddb9153f4e4cf2021
+  languageName: node
+  linkType: hard
+
 "@jest/console@npm:30.2.0":
   version: 30.2.0
   resolution: "@jest/console@npm:30.2.0"
@@ -9899,6 +9911,7 @@ __metadata:
     colorette: "npm:^2.0.20"
     colors: "npm:^1.4.0"
     connect: "npm:^3.7.0"
+    connect-mongo: "npm:5.1.0"
     cookie: "npm:^0.7.2"
     cookie-parser: "npm:^1.4.7"
     cors: "npm:^2.8.6"
@@ -17491,6 +17504,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"bn.js@npm:>=5":
+  version: 5.2.3
+  resolution: "bn.js@npm:5.2.3"
+  checksum: 10/dfb3927e0d531e6ec4f191597ce6f7f7665310c356fef5f968ada676b8058027f959af42eaa37b5f5c63617e819d3741813025ab15dd71a90f2e74698df0b58e
+  languageName: node
+  linkType: hard
+
 "bn.js@npm:^4.0.0, bn.js@npm:^4.1.0, bn.js@npm:^4.11.9":
   version: 4.12.0
   resolution: "bn.js@npm:4.12.0"
@@ -18853,6 +18873,19 @@ __metadata:
   languageName: node
   linkType: hard
 
+"connect-mongo@npm:5.1.0":
+  version: 5.1.0
+  resolution: "connect-mongo@npm:5.1.0"
+  dependencies:
+    debug: "npm:^4.3.1"
+    kruptein: "npm:^3.0.0"
+  peerDependencies:
+    express-session: ^1.17.1
+    mongodb: ">= 5.1.0 < 7"
+  checksum: 10/0d54169ab5c8374486a8057d60ee985d1476ac80f01996646887c9db8ed2b0cc039efcf02ab595472d558f3e9891abd2822b59c5adf654fcf54354f2ef5949ea
+  languageName: node
+  linkType: hard
+
 "connect@npm:^3.7.0":
   version: 3.7.0
   resolution: "connect@npm:3.7.0"
@@ -24372,7 +24405,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.1, inherits@npm:~2.0.3, inherits@npm:~2.0.4":
+"inherits@npm:2, inherits@npm:2.0.4, inherits@npm:>=2, inherits@npm:^2.0.1, inherits@npm:^2.0.3, inherits@npm:^2.0.4, inherits@npm:~2.0.1, inherits@npm:~2.0.3, inherits@npm:~2.0.4":
   version: 2.0.4
   resolution: "inherits@npm:2.0.4"
   checksum: 10/cd45e923bee15186c07fa4c89db0aace24824c482fb887b528304694b2aa6ff8a898da8657046a5dcf3e46cd6db6c61629551f9215f208d7c3f157cf9b290521
@@ -26858,6 +26891,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"kruptein@npm:^3.0.0":
+  version: 3.3.0
+  resolution: "kruptein@npm:3.3.0"
+  dependencies:
+    "@jas-/asn.1": "npm:>=5"
+  checksum: 10/5f5faee0440f0b02f43752ecad976345c2fb5b670bc0eb9289b7209cb266489c07a03787003d400c713a99eb8e3c7554d13e0fec77eed7388b764856cc2a1018
+  languageName: node
+  linkType: hard
+
 "language-subtag-registry@npm:^0.3.20":
   version: 0.3.22
   resolution: "language-subtag-registry@npm:0.3.22"
@@ -28228,7 +28270,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"minimalistic-assert@npm:^1.0.0, minimalistic-assert@npm:^1.0.1":
+"minimalistic-assert@npm:>=1, minimalistic-assert@npm:^1.0.0, minimalistic-assert@npm:^1.0.1":
   version: 1.0.1
   resolution: "minimalistic-assert@npm:1.0.1"
   checksum: 10/cc7974a9268fbf130fb055aff76700d7e2d8be5f761fb5c60318d0ed010d839ab3661a533ad29a5d37653133385204c503bfac995aaa4236f4e847461ea32ba7
@@ -33488,7 +33530,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:~2.1.0":
+"safer-buffer@npm:>= 2.1.2 < 3, safer-buffer@npm:>= 2.1.2 < 3.0.0, safer-buffer@npm:>=2, safer-buffer@npm:~2.1.0":
   version: 2.1.2
   resolution: "safer-buffer@npm:2.1.2"
   checksum: 10/7eaf7a0cf37cc27b42fb3ef6a9b1df6e93a1c6d98c6c6702b02fe262d5fcbd89db63320793b99b21cb5348097d0a53de81bd5f4e8b86e20cc9412e3f1cfb4e83

From 30c5ee113be3daee87a9044d55df8f5d58ca64d8 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Tue, 19 May 2026 23:47:51 +0530
Subject: [PATCH 29/43] rate limit only oauth req

---
 apps/meteor/server/configuration/configurePassport.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index f7aa533ab0c55..708b3942c8092 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -58,7 +58,7 @@ export const configurePassport = (settings: ICachedSettings) => {
 		},
 	});
 
-	oAuthRouter.use(oauthRateLimiter);
+	oAuthRouter.use('/oauth', oauthRateLimiter);
 
 	passport.serializeUser((user: any, done) => {
 		done(null, user);

From 161212e2e9a0697c8b866f5ed894977897d294b2 Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Wed, 20 May 2026 01:26:02 +0530
Subject: [PATCH 30/43] chore: Passport Twitter OAuth (#40563)

---
 apps/meteor/package.json                      |  2 +
 .../lib/oauth/configureOAuthServices.ts       |  2 +
 .../lib/oauth/createOAuthServiceConfig.ts     | 46 ++++++++-------
 apps/meteor/server/lib/oauth/oauthConfigs.ts  |  8 ++-
 yarn.lock                                     | 56 +++++++++++++++++++
 5 files changed, 93 insertions(+), 21 deletions(-)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index ef5ec939ef084..9fd4bb0c9e989 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -270,6 +270,7 @@
 		"passport-github2": "^0.1.12",
 		"passport-google-oauth20": "^2.0.0",
 		"passport-oauth2": "^1.8.0",
+		"passport-twitter": "^1.0.4",
 		"path": "^0.12.7",
 		"path-to-regexp": "^6.3.0",
 		"pino": "10.3.1",
@@ -401,6 +402,7 @@
 		"@types/passport-github2": "^1.2.9",
 		"@types/passport-google-oauth20": "^2",
 		"@types/passport-oauth2": "^1",
+		"@types/passport-twitter": "^1",
 		"@types/prometheus-gc-stats": "^0.6.4",
 		"@types/proxy-from-env": "^1.0.4",
 		"@types/proxyquire": "^1.3.31",
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index a49df2f0d4529..7d73291720119 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -23,6 +23,8 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					...config,
 					clientID: config.clientId,
 					clientSecret: config.clientSecret,
+					consumerKey: config.clientId,
+					consumerSecret: config.clientSecret,
 					callbackURL: `${siteUrl}/oauth/${config.provider}/callback`,
 					state: true,
 					pkce: true,
diff --git a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
index 2657e6aba3c72..31e2f7d2cedcf 100644
--- a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
+++ b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
@@ -1,4 +1,5 @@
 import { capitalize } from '@rocket.chat/string-helpers';
+import { isTruthy } from '@rocket.chat/tools';
 import type { Strategy } from 'passport';
 
 import { OAuthConfigs } from './oauthConfigs';
@@ -9,30 +10,35 @@ export type OAuthServiceConfig = {
 	strategy: new (...args: any[]) => Strategy;
 	clientId: string;
 	clientSecret: string;
-	scope: string[];
+	scope?: string[];
 };
 
 export const createOAuthServiceConfig = (settings: ICachedSettings, services: string[]): OAuthServiceConfig[] => {
-	return services.map((service) => {
-		if (service === 'github_enterprise') {
+	return services
+		.map((service) => {
+			if (!OAuthConfigs[service]) {
+				return;
+			}
+
+			if (service === 'github_enterprise') {
+				return {
+					provider: service,
+					clientId: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_id'),
+					clientSecret: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_secret'),
+					authorizationURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/authorize`,
+					tokenURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/access_token`,
+					userProfileURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/api/v3/user`,
+					strategy: OAuthConfigs.github_enterprise.strategy,
+					scope: OAuthConfigs.github_enterprise.scope,
+				};
+			}
+
 			return {
 				provider: service,
-				clientId: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_id'),
-				clientSecret: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_secret'),
-				authorizationURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/authorize`,
-				tokenURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/access_token`,
-				userProfileURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/api/v3/user`,
-				strategy: OAuthConfigs.github_enterprise.strategy,
-				scope: OAuthConfigs.github_enterprise.scope,
+				clientId: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_id`),
+				clientSecret: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_secret`),
+				...OAuthConfigs[service],
 			};
-		}
-
-		return {
-			provider: service,
-			strategy: OAuthConfigs[service].strategy,
-			clientId: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_id`),
-			clientSecret: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_secret`),
-			scope: OAuthConfigs[service].scope,
-		};
-	});
+		})
+		.filter(isTruthy);
 };
diff --git a/apps/meteor/server/lib/oauth/oauthConfigs.ts b/apps/meteor/server/lib/oauth/oauthConfigs.ts
index 4ddd63333b3ba..b4c8fe6604fa5 100644
--- a/apps/meteor/server/lib/oauth/oauthConfigs.ts
+++ b/apps/meteor/server/lib/oauth/oauthConfigs.ts
@@ -2,10 +2,12 @@ import type { Strategy } from 'passport';
 import { Strategy as FacebookStrategy } from 'passport-facebook';
 import { Strategy as GitHubStrategy } from 'passport-github2';
 import { Strategy as GoogleStrategy } from 'passport-google-oauth20';
+import { Strategy as TwitterStrategy } from 'passport-twitter';
 
 export type OAuthConfig = {
 	strategy: new (...args: any[]) => Strategy;
-	scope: string[];
+	scope?: string[];
+	includeEmail?: boolean;
 };
 
 export const OAuthConfigs: Record<string, OAuthConfig> = {
@@ -21,6 +23,10 @@ export const OAuthConfigs: Record<string, OAuthConfig> = {
 		strategy: GoogleStrategy,
 		scope: ['email', 'profile'],
 	},
+	twitter: {
+		strategy: TwitterStrategy,
+		includeEmail: true,
+	},
 	github_enterprise: {
 		strategy: GitHubStrategy,
 		scope: ['user:email'],
diff --git a/yarn.lock b/yarn.lock
index 3a8e71798c778..82a52d1f34c90 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9862,6 +9862,7 @@ __metadata:
     "@types/passport-github2": "npm:^1.2.9"
     "@types/passport-google-oauth20": "npm:^2"
     "@types/passport-oauth2": "npm:^1"
+    "@types/passport-twitter": "npm:^1"
     "@types/prometheus-gc-stats": "npm:^0.6.4"
     "@types/proxy-from-env": "npm:^1.0.4"
     "@types/proxyquire": "npm:^1.3.31"
@@ -10009,6 +10010,7 @@ __metadata:
     passport-github2: "npm:^0.1.12"
     passport-google-oauth20: "npm:^2.0.0"
     passport-oauth2: "npm:^1.8.0"
+    passport-twitter: "npm:^1.0.4"
     path: "npm:^0.12.7"
     path-to-regexp: "npm:^6.3.0"
     pino: "npm:10.3.1"
@@ -14799,6 +14801,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/passport-twitter@npm:^1":
+  version: 1.0.40
+  resolution: "@types/passport-twitter@npm:1.0.40"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/passport": "npm:*"
+  checksum: 10/cf97db9469acff4dffff11ecf4e12ac016fc55d478e2fbd881c7961fe36f26ba232a55f74fdd0bd0216ea49d3a9dcd4e18afac852b6bb10450f43413e4a464b7
+  languageName: node
+  linkType: hard
+
 "@types/passport@npm:*, @types/passport@npm:^1.0.17":
   version: 1.0.17
   resolution: "@types/passport@npm:1.0.17"
@@ -29362,6 +29374,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"oauth@npm:0.9.x":
+  version: 0.9.15
+  resolution: "oauth@npm:0.9.15"
+  checksum: 10/6b0b10be19a461da417a37ea2821a773ef74dd667563291e1e83b2024b88e6571b0323a0a6887f2390fbaf28cc6ce5bfe0484fc22162b975305b1e19b76f5597
+  languageName: node
+  linkType: hard
+
 "object-assign@npm:^4, object-assign@npm:^4.0.1, object-assign@npm:^4.1.1":
   version: 4.1.1
   resolution: "object-assign@npm:4.1.1"
@@ -30072,6 +30091,17 @@ __metadata:
   languageName: node
   linkType: hard
 
+"passport-oauth1@npm:1.x.x":
+  version: 1.3.0
+  resolution: "passport-oauth1@npm:1.3.0"
+  dependencies:
+    oauth: "npm:0.9.x"
+    passport-strategy: "npm:1.x.x"
+    utils-merge: "npm:1.x.x"
+  checksum: 10/56f725cf3e3358ccb72212a6342e237ae9366172b94fdb9ac8ab380456da07dc1bb776bcdcddc9964e8e9056922fbf31c2f142d0421fd8a5b0140132d0cd9671
+  languageName: node
+  linkType: hard
+
 "passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.8.0":
   version: 1.8.0
   resolution: "passport-oauth2@npm:1.8.0"
@@ -30092,6 +30122,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"passport-twitter@npm:^1.0.4":
+  version: 1.0.4
+  resolution: "passport-twitter@npm:1.0.4"
+  dependencies:
+    passport-oauth1: "npm:1.x.x"
+    xtraverse: "npm:0.1.x"
+  checksum: 10/46c2efcbd8893c2de329770f16703b027531e2becfc8865dd288290635dcc9a678bbcec82a66ad52e49742bccd77ff4fc49f576fef2d711f49363e1b75ac1e80
+  languageName: node
+  linkType: hard
+
 "passport@npm:^0.7.0":
   version: 0.7.0
   resolution: "passport@npm:0.7.0"
@@ -37908,6 +37948,13 @@ __metadata:
   languageName: node
   linkType: hard
 
+"xmldom@npm:0.1.x":
+  version: 0.1.31
+  resolution: "xmldom@npm:0.1.31"
+  checksum: 10/eddc09391c928be61c504a355d5b7c42cbec526e94cc1e2d092d006ed5bc1525b869fb922cbcf3f6f7aac946a6b25ec4243dc2630afb5cbec61b723829211792
+  languageName: node
+  linkType: hard
+
 "xorshift@npm:^1.1.1":
   version: 1.2.0
   resolution: "xorshift@npm:1.2.0"
@@ -37943,6 +37990,15 @@ __metadata:
   languageName: node
   linkType: hard
 
+"xtraverse@npm:0.1.x":
+  version: 0.1.0
+  resolution: "xtraverse@npm:0.1.0"
+  dependencies:
+    xmldom: "npm:0.1.x"
+  checksum: 10/86e837a626ef363c01efa55a3e20b1d85b49d87f3de504955af119b451cb1f2c63e887bff6061335314c1d49005d851f4bc1d0cf2603dce18271aceb3e673d8a
+  languageName: node
+  linkType: hard
+
 "xxhashjs@npm:~0.2.2":
   version: 0.2.2
   resolution: "xxhashjs@npm:0.2.2"

From 77de0c2e8bbec53f556123865edf8d689a018f2d Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Wed, 20 May 2026 02:00:17 +0530
Subject: [PATCH 31/43] feat: New 2FA flow for passport OAuth (#40106)

---
 apps/meteor/app/2fa/server/code/EmailCheck.ts |   4 +-
 .../app/2fa/server/code/EmailCheckForOAuth.ts |  37 ++++++
 apps/meteor/app/2fa/server/code/TOTPCheck.ts  |   2 +-
 .../app/2fa/server/code/TOTPCheckForOAuth.ts  |  35 ++++++
 apps/meteor/app/2fa/server/code/index.ts      |  26 ++++-
 apps/meteor/app/api/server/ApiClass.ts        |   2 +-
 apps/meteor/app/api/server/index.ts           |   2 +-
 .../app/api/server/v1/twoFactorChallenges.ts  | 108 ++++++++++++++++++
 .../TwoFactorModal/TwoFactorEmailModal.tsx    |  13 ++-
 .../TwoFactorModal/TwoFactorModal.tsx         |   6 +-
 .../meteor/client/lib/2fa/process2faReturn.ts |   9 +-
 apps/meteor/client/startup/routes.tsx         |  10 ++
 .../OAuthTwoFactorAuthenticationRouter.tsx    | 101 ++++++++++++++++
 .../views/root/hooks/useLoginOtherClients.ts  |   9 +-
 .../hooks/useShareSessionWithOtherClients.ts  |   8 +-
 .../lib/oauth/configureOAuthServices.ts       |  21 +++-
 apps/meteor/server/lib/oauth/twoFactorAuth.ts |  37 ++++++
 apps/meteor/server/models.ts                  |   2 +
 .../core-typings/src/ITwoFactorChallenge.ts   |   7 ++
 packages/core-typings/src/index.ts            |   2 +
 packages/i18n/src/locales/en.i18n.json        |   2 +
 packages/model-typings/src/index.ts           |   1 +
 .../src/models/ITwoFactorChallengesModel.ts   |  10 ++
 packages/models/src/index.ts                  |   2 +
 packages/models/src/modelClasses.ts           |   1 +
 .../models/src/models/TwoFactorChallenges.ts  |  38 ++++++
 packages/rest-typings/src/index.ts            |   3 +
 .../src/v1/twoFactorChallenges.ts             |  43 +++++++
 28 files changed, 511 insertions(+), 30 deletions(-)
 create mode 100644 apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts
 create mode 100644 apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts
 create mode 100644 apps/meteor/app/api/server/v1/twoFactorChallenges.ts
 create mode 100644 apps/meteor/client/views/OAuthTwoFactorAuthentication/OAuthTwoFactorAuthenticationRouter.tsx
 create mode 100644 apps/meteor/server/lib/oauth/twoFactorAuth.ts
 create mode 100644 packages/core-typings/src/ITwoFactorChallenge.ts
 create mode 100644 packages/model-typings/src/models/ITwoFactorChallengesModel.ts
 create mode 100644 packages/models/src/models/TwoFactorChallenges.ts
 create mode 100644 packages/rest-typings/src/v1/twoFactorChallenges.ts

diff --git a/apps/meteor/app/2fa/server/code/EmailCheck.ts b/apps/meteor/app/2fa/server/code/EmailCheck.ts
index 5967aa518348b..c52531eaac781 100644
--- a/apps/meteor/app/2fa/server/code/EmailCheck.ts
+++ b/apps/meteor/app/2fa/server/code/EmailCheck.ts
@@ -10,7 +10,7 @@ import * as Mailer from '../../../mailer/server/api';
 import { settings } from '../../../settings/server';
 
 export class EmailCheck implements ICodeCheck {
-	public readonly name = 'email';
+	public readonly name: string = 'email';
 
 	private getUserVerifiedEmails(user: IUser): string[] {
 		if (!Array.isArray(user.emails)) {
@@ -145,6 +145,6 @@ ${t('If_you_didnt_try_to_login_in_your_account_please_ignore_this_email')}
 
 	public async maxFaildedAttemtpsReached(user: IUser) {
 		const maxAttempts = settings.get<number>('Accounts_TwoFactorAuthentication_Max_Invalid_Email_Code_Attempts');
-		return (await Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts)) as boolean;
+		return Users.maxInvalidEmailCodeAttemptsReached(user._id, maxAttempts);
 	}
 }
diff --git a/apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts b/apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts
new file mode 100644
index 0000000000000..68c3e8a05506d
--- /dev/null
+++ b/apps/meteor/app/2fa/server/code/EmailCheckForOAuth.ts
@@ -0,0 +1,37 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+
+import { EmailCheck } from './EmailCheck';
+
+export class EmailCheckForOAuth extends EmailCheck {
+	public override readonly name = 'email-oauth';
+
+	public readonly method = 'email';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		const challengeId = await TwoFactorChallenges.createTwoFactorChallenge(user._id, 'email');
+		await this.sendEmailCode(user);
+		return challengeId;
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}
diff --git a/apps/meteor/app/2fa/server/code/TOTPCheck.ts b/apps/meteor/app/2fa/server/code/TOTPCheck.ts
index 236016883f89e..ae9502569457f 100644
--- a/apps/meteor/app/2fa/server/code/TOTPCheck.ts
+++ b/apps/meteor/app/2fa/server/code/TOTPCheck.ts
@@ -5,7 +5,7 @@ import { settings } from '../../../settings/server';
 import { TOTP } from '../lib/totp';
 
 export class TOTPCheck implements ICodeCheck {
-	public readonly name = 'totp';
+	public readonly name: string = 'totp';
 
 	public isEnabled(user: IUser): boolean {
 		if (!settings.get('Accounts_TwoFactorAuthentication_By_TOTP_Enabled')) {
diff --git a/apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts b/apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts
new file mode 100644
index 0000000000000..02e8267fb59eb
--- /dev/null
+++ b/apps/meteor/app/2fa/server/code/TOTPCheckForOAuth.ts
@@ -0,0 +1,35 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+
+import { TOTPCheck } from './TOTPCheck';
+
+export class TOTPCheckForOAuth extends TOTPCheck {
+	public override readonly name = 'totp-oauth';
+
+	public readonly method = 'totp';
+
+	public async sendTwoFactorChallenge(user: IUser): Promise<string> {
+		return TwoFactorChallenges.createTwoFactorChallenge(user._id, 'totp');
+	}
+
+	public async verifyEmailTwoFactorChallenge(user: IUser, challengeId: string, code: string): Promise<boolean> {
+		const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+		if (!challenge) {
+			return false;
+		}
+
+		if (challenge.expireAt && challenge.expireAt < new Date()) {
+			throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+		}
+
+		const isCodeValid = await this.verify(user, code);
+
+		if (!isCodeValid) {
+			return false;
+		}
+
+		await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+
+		return true;
+	}
+}
diff --git a/apps/meteor/app/2fa/server/code/index.ts b/apps/meteor/app/2fa/server/code/index.ts
index cfe7b8ab7d4d4..70a00442eb101 100644
--- a/apps/meteor/app/2fa/server/code/index.ts
+++ b/apps/meteor/app/2fa/server/code/index.ts
@@ -63,8 +63,8 @@ function getFingerprintFromConnection(connection: IMethodConnection): string {
 	return crypto.createHash('md5').update(data).digest('hex');
 }
 
-function getRememberDate(from: Date = new Date()): Date | undefined {
-	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor') as string, 10);
+export function getRememberDate(from: Date = new Date()): Date | undefined {
+	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor'), 10);
 
 	if (rememberFor <= 0) {
 		return;
@@ -118,6 +118,25 @@ function isAuthorizedForToken(connection: IMethodConnection, user: IUser, option
 	return true;
 }
 
+export async function rememberAuthorizationByToken(token: string, userId: IUser['_id'], connection: IMethodConnection): Promise<void> {
+	const user = await Users.findOneByIdAndLoginHashedToken(userId, token, { projection: { _id: 1, services: 1 } });
+	if (!user) {
+		throw new Meteor.Error('error-user-not-found', 'user not found');
+	}
+
+	const tokenObject = user.services?.resume?.loginTokens?.find((i) => i.hashedToken === token);
+	if (!tokenObject) {
+		throw new Meteor.Error('error-token-not-found', 'token not found');
+	}
+
+	const expires = getRememberDate();
+	if (!expires) {
+		return;
+	}
+
+	await Users.setTwoFactorAuthorizationHashAndUntilForUserIdAndToken(user._id, token, getFingerprintFromConnection(connection), expires);
+}
+
 async function rememberAuthorization(connection: IMethodConnection, user: IUser): Promise<void> {
 	const currentToken = Accounts._getLoginToken(connection.id);
 
@@ -146,7 +165,7 @@ interface ICheckCodeForUser {
 	connection?: IMethodConnection;
 }
 
-const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
+export const getSecondFactorMethod = (user: IUser, method: string | undefined, options: ITwoFactorOptions): ICodeCheck | undefined => {
 	// try first getting one of the available methods or the one that was already provided
 	const selectedMethod = getMethodByNameOrFirstActiveForUser(user, method);
 	if (selectedMethod) {
@@ -174,7 +193,6 @@ export async function checkCodeForUser({ user, code, method, options = {}, conne
 	}
 
 	let existingUser: IUser | null;
-
 	if (typeof user === 'string') {
 		existingUser = await getUserForCheck(user);
 	} else {
diff --git a/apps/meteor/app/api/server/ApiClass.ts b/apps/meteor/app/api/server/ApiClass.ts
index d51726049e0dd..62a2d7c0601c8 100644
--- a/apps/meteor/app/api/server/ApiClass.ts
+++ b/apps/meteor/app/api/server/ApiClass.ts
@@ -144,7 +144,7 @@ const rateLimiterDictionary: Record<
 	}
 > = {};
 
-const generateConnection = (
+export const generateConnection = (
 	ipAddress: string,
 	httpHeaders: Record<string, any>,
 ): {
diff --git a/apps/meteor/app/api/server/index.ts b/apps/meteor/app/api/server/index.ts
index 5a6a6f06cbbab..c53c56d797cc5 100644
--- a/apps/meteor/app/api/server/index.ts
+++ b/apps/meteor/app/api/server/index.ts
@@ -45,7 +45,7 @@ import './v1/mailer';
 import './v1/teams';
 import './v1/moderation';
 import './v1/uploads';
-
+import './v1/twoFactorChallenges';
 // This has to come last so all endpoints are registered before generating the OpenAPI documentation
 import './default/openApi';
 
diff --git a/apps/meteor/app/api/server/v1/twoFactorChallenges.ts b/apps/meteor/app/api/server/v1/twoFactorChallenges.ts
new file mode 100644
index 0000000000000..4cd335c7e1c80
--- /dev/null
+++ b/apps/meteor/app/api/server/v1/twoFactorChallenges.ts
@@ -0,0 +1,108 @@
+import type { IMethodConnection } from '@rocket.chat/core-typings';
+import { TwoFactorChallenges } from '@rocket.chat/models';
+import { isTwoFactorChallengesSendEmailCodeParamsPOST, isTwoFactorChallengesVerifyChallengeParamsPOST } from '@rocket.chat/rest-typings';
+import { Accounts } from 'meteor/accounts-base';
+
+import { emailCheckForOAuth, getTwoFAMethodForOAuth } from '../../../../server/lib/oauth/twoFactorAuth';
+import { getUserForCheck, rememberAuthorizationByToken } from '../../../2fa/server/code';
+import { generateConnection } from '../ApiClass';
+import { API } from '../api';
+
+API.v1.addRoute(
+	'twoFactorChallenges.sendEmailCode',
+	{ validateParams: isTwoFactorChallengesSendEmailCodeParamsPOST, rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 } },
+	{
+		async post() {
+			const { challengeId } = this.bodyParams;
+
+			if (!challengeId) {
+				throw new Meteor.Error('error-parameter-required', 'challengeId is required');
+			}
+
+			const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+
+			if (!challenge) {
+				throw new Meteor.Error('error-challenge-not-found', 'challenge not found');
+			}
+
+			if (challenge.expireAt && challenge.expireAt < new Date()) {
+				throw new Meteor.Error('error-challenge-expired', 'challenge expired');
+			}
+
+			const { userId } = challenge;
+
+			const user = await getUserForCheck(userId);
+
+			if (!user) {
+				throw new Meteor.Error('error-user-not-found', 'user not found');
+			}
+
+			await emailCheckForOAuth.sendEmailCode(user);
+
+			return API.v1.success();
+		},
+	},
+);
+
+API.v1.addRoute(
+	'twoFactorChallenges.verifyChallenge',
+	{
+		validateParams: isTwoFactorChallengesVerifyChallengeParamsPOST,
+		rateLimiterOptions: { intervalTimeInMS: 60000, numRequestsAllowed: 5 },
+	},
+	{
+		async post() {
+			const { challengeId, code } = this.bodyParams;
+
+			if (!challengeId || !code) {
+				throw new Meteor.Error('error-parameter-required', 'challengeId and code are required');
+			}
+
+			const challenge = await TwoFactorChallenges.findOneByPendingChallengeId(challengeId);
+
+			if (!challenge) {
+				throw new Meteor.Error('error-challenge-not-found', 'challenge not found');
+			}
+
+			const { userId } = challenge;
+
+			const user = await getUserForCheck(userId);
+
+			if (!user) {
+				throw new Meteor.Error('error-user-not-found', 'user not found');
+			}
+
+			const twoFAMethod = getTwoFAMethodForOAuth(challenge.method);
+
+			const isCodeValid = await twoFAMethod.verifyEmailTwoFactorChallenge(user, challengeId, code);
+
+			if (!isCodeValid) {
+				const tooManyAttempts = await twoFAMethod.maxFaildedAttemtpsReached(user);
+				if (tooManyAttempts) {
+					await TwoFactorChallenges.removeByPendingChallengeId(challengeId);
+					throw new Meteor.Error('totp-max-attempts', 'TOTP Maximun Failed Attempts Reached');
+				}
+				return API.v1.failure('error-invalid-code', 'Invalid code');
+			}
+
+			const stampedToken = Accounts._generateStampedLoginToken();
+
+			await Accounts._insertLoginToken(user._id, stampedToken);
+
+			const hashedToken = Accounts._hashLoginToken(stampedToken.token);
+
+			const connection = {
+				...generateConnection(this.requestIp, this.request.headers),
+				token: hashedToken,
+			} as unknown as IMethodConnection;
+
+			// remember the 2FA authorization for the next requests
+			await rememberAuthorizationByToken(hashedToken, user._id, connection);
+
+			return API.v1.success({
+				loginToken: stampedToken.token,
+				userId: user._id,
+			});
+		},
+	},
+);
diff --git a/apps/meteor/client/components/TwoFactorModal/TwoFactorEmailModal.tsx b/apps/meteor/client/components/TwoFactorModal/TwoFactorEmailModal.tsx
index c80fb09e78ae1..14f86a832e075 100644
--- a/apps/meteor/client/components/TwoFactorModal/TwoFactorEmailModal.tsx
+++ b/apps/meteor/client/components/TwoFactorModal/TwoFactorEmailModal.tsx
@@ -1,7 +1,7 @@
 import { Box, Button } from '@rocket.chat/fuselage';
 import { FieldGroup, TextInput, Field, FieldLabel, FieldRow, FieldError } from '@rocket.chat/fuselage-forms';
 import { GenericModal } from '@rocket.chat/ui-client';
-import { useToastMessageDispatch, useEndpoint } from '@rocket.chat/ui-contexts';
+import { useToastMessageDispatch } from '@rocket.chat/ui-contexts';
 import type { ReactElement } from 'react';
 import { useForm, Controller } from 'react-hook-form';
 import { useTranslation } from 'react-i18next';
@@ -12,14 +12,14 @@ import { Method } from './TwoFactorModal';
 type TwoFactorEmailModalProps = {
 	onConfirm: OnConfirm;
 	onClose: () => void;
-	emailOrUsername: string;
+	resendEmail?: () => Promise<null>;
 };
 
 type TwoFactorEmailFormData = {
 	code: string;
 };
 
-const TwoFactorEmailModal = ({ onConfirm, onClose, emailOrUsername }: TwoFactorEmailModalProps): ReactElement => {
+const TwoFactorEmailModal = ({ onConfirm, onClose, resendEmail }: TwoFactorEmailModalProps): ReactElement => {
 	const dispatchToastMessage = useToastMessageDispatch();
 	const { t } = useTranslation();
 
@@ -33,11 +33,12 @@ const TwoFactorEmailModal = ({ onConfirm, onClose, emailOrUsername }: TwoFactorE
 		defaultValues: { code: '' },
 	});
 
-	const sendEmailCode = useEndpoint('POST', '/v1/users.2fa.sendEmailCode');
-
 	const onClickResendCode = async (): Promise<void> => {
 		try {
-			await sendEmailCode({ emailOrUsername });
+			if (!resendEmail) {
+				throw new Error('resendEmail is not defined');
+			}
+			await resendEmail();
 			dispatchToastMessage({ type: 'success', message: t('Email_sent') });
 		} catch (error) {
 			dispatchToastMessage({
diff --git a/apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx b/apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx
index ef056ee717ccb..04f603882c531 100644
--- a/apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx
+++ b/apps/meteor/client/components/TwoFactorModal/TwoFactorModal.tsx
@@ -21,7 +21,7 @@ type TwoFactorModalProps = {
 	  }
 	| {
 			method: 'email';
-			emailOrUsername: string;
+			resendEmail?: () => Promise<null>;
 	  }
 );
 
@@ -31,9 +31,9 @@ const TwoFactorModal = ({ onConfirm, onClose, ...props }: TwoFactorModalProps):
 	}
 
 	if (props.method === Method.EMAIL) {
-		const { emailOrUsername } = props;
+		const { resendEmail } = props;
 
-		return <TwoFactorEmail onConfirm={onConfirm} onClose={onClose} emailOrUsername={emailOrUsername} />;
+		return <TwoFactorEmail onConfirm={onConfirm} onClose={onClose} resendEmail={resendEmail} />;
 	}
 
 	if (props.method === Method.PASSWORD) {
diff --git a/apps/meteor/client/lib/2fa/process2faReturn.ts b/apps/meteor/client/lib/2fa/process2faReturn.ts
index 50a0d729d770b..7bdac41bc1f50 100644
--- a/apps/meteor/client/lib/2fa/process2faReturn.ts
+++ b/apps/meteor/client/lib/2fa/process2faReturn.ts
@@ -5,6 +5,7 @@ import { lazy } from 'react';
 import type { LoginCallback } from './overrideLoginMethod';
 import type { MeteorErrorLike } from './types';
 import { isTotpInvalidError, isTotpRequiredError } from './utils';
+import { sdk } from '../../../app/utils/client/lib/SDKClient';
 import { getUser } from '../user';
 
 const TwoFactorModal = lazy(() => import('../../components/TwoFactorModal'));
@@ -31,7 +32,9 @@ const hasRequiredTwoFactorMethod = (
 function assertModalProps(props: {
 	method: TwoFactorMethod;
 	emailOrUsername?: string;
-}): asserts props is { method: 'totp' } | { method: 'password' } | { method: 'email'; emailOrUsername: string } {
+}): asserts props is
+	| { method: 'totp' | 'password'; invalidAttempt?: boolean }
+	| { method: 'email'; emailOrUsername: string; invalidAttempt?: boolean } {
 	if (props.method === 'email' && typeof props.emailOrUsername !== 'string') {
 		throw new Error('Invalid Two Factor method');
 	}
@@ -161,6 +164,10 @@ export const invokeTwoFactorModal = async (
 						reject(new Error('totp-canceled'));
 					}
 				},
+				...(props.method === 'email' &&
+					props.emailOrUsername && {
+						resendEmail: (): Promise<null> => sdk.rest.post('/v1/users.2fa.sendEmailCode', { emailOrUsername: props.emailOrUsername }),
+					}),
 			},
 		});
 	});
diff --git a/apps/meteor/client/startup/routes.tsx b/apps/meteor/client/startup/routes.tsx
index 77f76158cb65d..2b8e1c43e35e2 100644
--- a/apps/meteor/client/startup/routes.tsx
+++ b/apps/meteor/client/startup/routes.tsx
@@ -3,6 +3,7 @@ import { createElement, lazy, useEffect } from 'react';
 
 import { appLayout } from '../lib/appLayout';
 import { router } from '../providers/RouterProvider';
+import OAuthTwoFactorAuthenticationRouter from '../views/OAuthTwoFactorAuthentication/OAuthTwoFactorAuthenticationRouter';
 import MainLayout from '../views/root/MainLayout';
 
 const IndexRoute = lazy(() => import('../views/root/IndexRoute'));
@@ -39,6 +40,10 @@ declare module '@rocket.chat/ui-contexts' {
 			pathname: `/meet/${string}`;
 			pattern: '/meet/:rid';
 		};
+		'2fa': {
+			pathname: `/2fa/${string}/${string}`;
+			pattern: '/2fa/:method/:challengeId';
+		};
 		'home': {
 			pathname: '/home';
 			pattern: '/home';
@@ -131,6 +136,11 @@ router.defineRoutes([
 			return null;
 		}),
 	},
+	{
+		path: '/2fa/:method/:challengeId',
+		id: '2fa',
+		element: appLayout.wrap(<OAuthTwoFactorAuthenticationRouter />),
+	},
 	{
 		path: '/home',
 		id: 'home',
diff --git a/apps/meteor/client/views/OAuthTwoFactorAuthentication/OAuthTwoFactorAuthenticationRouter.tsx b/apps/meteor/client/views/OAuthTwoFactorAuthentication/OAuthTwoFactorAuthenticationRouter.tsx
new file mode 100644
index 0000000000000..2394d0a8cfdaf
--- /dev/null
+++ b/apps/meteor/client/views/OAuthTwoFactorAuthentication/OAuthTwoFactorAuthenticationRouter.tsx
@@ -0,0 +1,101 @@
+import { useStableCallback } from '@rocket.chat/fuselage-hooks';
+import { Page } from '@rocket.chat/ui-client';
+import {
+	useEndpoint,
+	useLoginWithToken,
+	useRouteParameter,
+	useRouter,
+	useSetModal,
+	useToastMessageDispatch,
+} from '@rocket.chat/ui-contexts';
+import { useEffect } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import TwoFactorModal from '../../components/TwoFactorModal/TwoFactorModal';
+
+const throwErrorOnInvalidMethod = (method: never): never => {
+	throw new Error(`Invalid Two Factor method: ${method}`);
+};
+
+const OAuthTwoFactorAuthenticationRouter = () => {
+	const method = useRouteParameter('method') as 'totp' | 'email' | undefined;
+	const challengeId = useRouteParameter('challengeId');
+	const router = useRouter();
+	const dispatchToastMessage = useToastMessageDispatch();
+	const setModal = useSetModal();
+	const loginWithToken = useLoginWithToken();
+	const { t } = useTranslation();
+	const verifyChallenge = useEndpoint('POST', '/v1/twoFactorChallenges.verifyChallenge');
+	const sendEmailCode = useEndpoint('POST', '/v1/twoFactorChallenges.sendEmailCode');
+
+	const navigateToHome = useStableCallback(() => {
+		setModal(null);
+		router.navigate('/home', { replace: true });
+	});
+
+	const resendEmail = useStableCallback(async () => {
+		if (!challengeId) {
+			return null;
+		}
+		await sendEmailCode({ challengeId });
+		return null;
+	});
+
+	const onConfirm = useStableCallback(async (code: string) => {
+		if (!challengeId || !code) {
+			return;
+		}
+		try {
+			const { loginToken, userId } = await verifyChallenge({ challengeId, code });
+
+			const { loginClient } = router.getSearchParameters();
+
+			if (loginClient === 'mobile' || loginClient === 'desktop') {
+				setModal(null);
+				router.navigate({ name: 'home', search: { resumeToken: loginToken, userId, loginClient } }, { replace: true });
+				return;
+			}
+
+			await loginWithToken(loginToken);
+			navigateToHome();
+		} catch (error: any) {
+			console.error('Failed to verify challenge', error);
+			if (error.errorType === 'totp-max-attempts') {
+				setModal(null);
+				dispatchToastMessage({ type: 'error', message: t('Maximum_number_of_attempts_reached_please_try_again_later') });
+				router.navigate('/login', { replace: true });
+				return;
+			}
+			if (error.errorType === 'error-challenge-expired' || error.errorType === 'error-challenge-not-found') {
+				setModal(null);
+				dispatchToastMessage({ type: 'error', message: t('Challenge_expired_please_try_again_later') });
+				router.navigate('/login', { replace: true });
+				return;
+			}
+			throw error;
+		}
+	});
+
+	useEffect(() => {
+		if (!method || !challengeId) {
+			router.navigate('/home');
+			return;
+		}
+
+		if (method === 'email') {
+			setModal(<TwoFactorModal method={method} onConfirm={onConfirm} resendEmail={resendEmail} onClose={navigateToHome} />);
+			return;
+		}
+
+		if (method === 'totp') {
+			setModal(<TwoFactorModal method={method} onConfirm={onConfirm} onClose={navigateToHome} />);
+			return;
+		}
+
+		throwErrorOnInvalidMethod(method);
+	}, [method, challengeId, router, setModal, onConfirm, resendEmail, navigateToHome]);
+
+	return <Page />;
+};
+
+export default OAuthTwoFactorAuthenticationRouter;
diff --git a/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts b/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
index beefab27e06a8..a826091886772 100644
--- a/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
+++ b/apps/meteor/client/views/root/hooks/useLoginOtherClients.ts
@@ -1,14 +1,15 @@
-import { useRouter } from '@rocket.chat/ui-contexts';
+import { useRouter, useSearchParameter } from '@rocket.chat/ui-contexts';
 import { useEffect } from 'react';
 
 import { buildDeepLinkURL } from '../../../lib/buildAuthDeeplinkURL';
 
 export const useLoginOtherClients = () => {
 	const router = useRouter();
+	const resumeToken = useSearchParameter('resumeToken');
+	const loginClient = useSearchParameter('loginClient');
+	const userId = useSearchParameter('userId');
 
 	useEffect(() => {
-		const { resumeToken, loginClient, userId } = router.getSearchParameters();
-
 		if (!resumeToken || !userId) {
 			return;
 		}
@@ -25,5 +26,5 @@ export const useLoginOtherClients = () => {
 		}, 0);
 
 		return () => clearTimeout(timeout);
-	}, [router]);
+	}, [resumeToken, userId, loginClient, router]);
 };
diff --git a/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts b/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
index f879fa7bd3cb1..62fd2fee04818 100644
--- a/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
+++ b/apps/meteor/client/views/root/hooks/useShareSessionWithOtherClients.ts
@@ -1,4 +1,4 @@
-import { useRouter, useUserId } from '@rocket.chat/ui-contexts';
+import { useRouter, useSearchParameter, useUserId } from '@rocket.chat/ui-contexts';
 import { useEffect } from 'react';
 
 import { buildDeepLinkURL } from '../../../lib/buildAuthDeeplinkURL';
@@ -7,6 +7,8 @@ import { readStoredLoginToken } from '../../../lib/sdk/ddpSdk';
 export const useShareSessionWithOtherClients = () => {
 	const router = useRouter();
 	const userId = useUserId();
+	const resumeToken = useSearchParameter('resumeToken');
+	const loginClient = useSearchParameter('loginClient');
 
 	useEffect(() => {
 		if (!userId) {
@@ -19,8 +21,6 @@ export const useShareSessionWithOtherClients = () => {
 			return;
 		}
 
-		const { resumeToken, loginClient } = router.getSearchParameters();
-
 		if (resumeToken) {
 			return;
 		}
@@ -37,5 +37,5 @@ export const useShareSessionWithOtherClients = () => {
 		}, 100);
 
 		return () => clearTimeout(timeout);
-	}, [router, userId]);
+	}, [resumeToken, loginClient, router, userId]);
 };
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 7d73291720119..dcfbca399683f 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -6,6 +6,7 @@ import passport from 'passport';
 import type { Profile, DoneCallback } from 'passport';
 
 import type { OAuthServiceConfig } from './createOAuthServiceConfig';
+import { doesUserRequire2FA } from './twoFactorAuth';
 import type { ICachedSettings } from '../../../app/settings/server/CachedSettings';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
@@ -41,9 +42,9 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 							accessToken,
 							refreshToken,
 							name: profile.displayName,
-							email: profile?.emails?.[0]?.value,
 							...restProfile,
 							..._json,
+							email: profile?.emails?.[0]?.value,
 						},
 						{},
 					);
@@ -73,6 +74,8 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 						next();
 					});
 				} else {
+					//delete stale value from previous sessions if any
+					delete req.session.loginClient;
 					next();
 				}
 			},
@@ -87,9 +90,21 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 				if (!oAuthUser) {
 					return res.redirect('/login');
 				}
-
 				const { loginClient } = req.session;
 
+				const secondFactorMethod = doesUserRequire2FA(oAuthUser);
+
+				if (secondFactorMethod) {
+					const challengeId = await secondFactorMethod.sendTwoFactorChallenge(oAuthUser);
+					const twoFARedirectUrl = new URL(`/2fa/${secondFactorMethod.method}/${challengeId}`, siteUrl);
+
+					if (loginClient) {
+						twoFARedirectUrl.searchParams.set('loginClient', loginClient);
+					}
+
+					return res.redirect(twoFARedirectUrl.toString());
+				}
+
 				const stampedToken = Accounts._generateStampedLoginToken();
 				await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
 
@@ -102,7 +117,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					redirectUrl.searchParams.set('loginClient', loginClient);
 				}
 
-				res.redirect(redirectUrl.toString());
+				setImmediate(() => res.redirect(redirectUrl.toString()));
 
 				req.session.destroy((err) => {
 					if (err) {
diff --git a/apps/meteor/server/lib/oauth/twoFactorAuth.ts b/apps/meteor/server/lib/oauth/twoFactorAuth.ts
new file mode 100644
index 0000000000000..2c97ff5fc5244
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/twoFactorAuth.ts
@@ -0,0 +1,37 @@
+import type { IUser } from '@rocket.chat/core-typings';
+
+import { getRememberDate } from '../../../app/2fa/server/code';
+import { EmailCheckForOAuth } from '../../../app/2fa/server/code/EmailCheckForOAuth';
+import { TOTPCheckForOAuth } from '../../../app/2fa/server/code/TOTPCheckForOAuth';
+
+export const emailCheckForOAuth = new EmailCheckForOAuth();
+export const totpCheckForOAuth = new TOTPCheckForOAuth();
+
+const twoFACheckMethodsForOAuth = {
+	[emailCheckForOAuth.method]: emailCheckForOAuth,
+	[totpCheckForOAuth.method]: totpCheckForOAuth,
+};
+
+export const getTwoFAMethodForOAuth = (method: 'email' | 'totp') => {
+	return twoFACheckMethodsForOAuth[method];
+};
+
+const getSecondFactorMethod = (user: IUser) => {
+	return Array.from(Object.values(twoFACheckMethodsForOAuth)).find((method) => method.isEnabled(user));
+};
+
+export const doesUserRequire2FA = (user: IUser) => {
+	const rememberAfterRegistration = getRememberDate(user.createdAt);
+
+	if (rememberAfterRegistration && rememberAfterRegistration > new Date()) {
+		return false;
+	}
+
+	const secondFactorMethod = getSecondFactorMethod(user);
+
+	if (!secondFactorMethod) {
+		return false;
+	}
+
+	return secondFactorMethod;
+};
diff --git a/apps/meteor/server/models.ts b/apps/meteor/server/models.ts
index 49b5b98b19f08..1d8481923b987 100644
--- a/apps/meteor/server/models.ts
+++ b/apps/meteor/server/models.ts
@@ -75,6 +75,7 @@ import {
 	WebdavAccountsRaw,
 	WorkspaceCredentialsRaw,
 	AbacAttributesRaw,
+	TwoFactorChallengesRaw,
 } from '@rocket.chat/models';
 import type { Collection } from 'mongodb';
 
@@ -161,3 +162,4 @@ registerModel('IVideoConferenceModel', new VideoConferenceRaw(db));
 registerModel('IWebdavAccountsModel', new WebdavAccountsRaw(db));
 registerModel('IWorkspaceCredentialsModel', new WorkspaceCredentialsRaw(db));
 registerModel('IAbacAttributesModel', new AbacAttributesRaw(db));
+registerModel('ITwoFactorChallengesModel', new TwoFactorChallengesRaw(db));
diff --git a/packages/core-typings/src/ITwoFactorChallenge.ts b/packages/core-typings/src/ITwoFactorChallenge.ts
new file mode 100644
index 0000000000000..783309001ee5d
--- /dev/null
+++ b/packages/core-typings/src/ITwoFactorChallenge.ts
@@ -0,0 +1,7 @@
+export interface ITwoFactorChallenge {
+	_id: string;
+	userId: string;
+	method: 'email' | 'totp';
+	expireAt: Date;
+	createdAt: Date;
+}
diff --git a/packages/core-typings/src/index.ts b/packages/core-typings/src/index.ts
index 90dd9c4e638a8..0b4cd9a471675 100644
--- a/packages/core-typings/src/index.ts
+++ b/packages/core-typings/src/index.ts
@@ -134,3 +134,5 @@ export type * from './ServerAudit/IAuditServerAbacAction';
 export type * from './ServerAudit/IAuditUserChangedEvent';
 
 export { schemas } from './Ajv';
+
+export type * from './ITwoFactorChallenge';
diff --git a/packages/i18n/src/locales/en.i18n.json b/packages/i18n/src/locales/en.i18n.json
index 4fd7b1a8e0907..428d239cf18f2 100644
--- a/packages/i18n/src/locales/en.i18n.json
+++ b/packages/i18n/src/locales/en.i18n.json
@@ -1080,6 +1080,7 @@
   "Categories": "Categories",
   "Categories*": "Categories*",
   "Certificates_and_Keys": "Certificates and Keys",
+  "Challenge_expired_please_try_again_later": "Challenge expired. Please try again later.",
   "Change_Room_Type": "Changing the Room Type",
   "Changed_from": "Changed from",
   "Changed_to": "Changed to",
@@ -3410,6 +3411,7 @@
   "Max_number_of_chats_per_agent_description": "The max. number of simultaneous chats that the agents can attend",
   "Max_number_of_uses": "Max number of uses",
   "Maximum": "Maximum",
+  "Maximum_number_of_attempts_reached_please_try_again_later": "Maximum number of attempts reached. Please try again later.",
   "Maximum_number_of_guests_reached": "Maximum number of guests reached",
   "Me": "Me",
   "Media": "Media",
diff --git a/packages/model-typings/src/index.ts b/packages/model-typings/src/index.ts
index 439447c49ea02..7e459803350b9 100644
--- a/packages/model-typings/src/index.ts
+++ b/packages/model-typings/src/index.ts
@@ -81,3 +81,4 @@ export type * from './updater';
 export type * from './models/IWorkspaceCredentialsModel';
 export type * from './models/ICallHistoryModel';
 export type * from './models/IAbacAttributesModel';
+export type * from './models/ITwoFactorChallengesModel';
diff --git a/packages/model-typings/src/models/ITwoFactorChallengesModel.ts b/packages/model-typings/src/models/ITwoFactorChallengesModel.ts
new file mode 100644
index 0000000000000..e0f523ae49104
--- /dev/null
+++ b/packages/model-typings/src/models/ITwoFactorChallengesModel.ts
@@ -0,0 +1,10 @@
+import type { ITwoFactorChallenge } from '@rocket.chat/core-typings';
+import type { DeleteResult, FindOptions } from 'mongodb';
+
+import type { IBaseModel } from './IBaseModel';
+
+export interface ITwoFactorChallengesModel extends IBaseModel<ITwoFactorChallenge> {
+	findOneByPendingChallengeId(id: string, options?: FindOptions<ITwoFactorChallenge>): Promise<ITwoFactorChallenge | null>;
+	removeByPendingChallengeId(id: string): Promise<DeleteResult>;
+	createTwoFactorChallenge(userId: string, method: ITwoFactorChallenge['method']): Promise<string>;
+}
diff --git a/packages/models/src/index.ts b/packages/models/src/index.ts
index 099420cd2f7ae..753e851d67a62 100644
--- a/packages/models/src/index.ts
+++ b/packages/models/src/index.ts
@@ -80,6 +80,7 @@ import type {
 	IMediaCallNegotiationsModel,
 	ICallHistoryModel,
 	IAbacAttributesModel,
+	ITwoFactorChallengesModel,
 } from '@rocket.chat/model-typings';
 import type { Collection, Db } from 'mongodb';
 
@@ -207,6 +208,7 @@ export const Migrations = proxify<IMigrationsModel>('IMigrationsModel');
 export const ModerationReports = proxify<IModerationReportsModel>('IModerationReportsModel');
 export const WorkspaceCredentials = proxify<IWorkspaceCredentialsModel>('IWorkspaceCredentialsModel');
 export const AbacAttributes = proxify<IAbacAttributesModel>('IAbacAttributesModel');
+export const TwoFactorChallenges = proxify<ITwoFactorChallengesModel>('ITwoFactorChallengesModel');
 
 export function registerServiceModels(db: Db, trash?: Collection<RocketChatRecordDeleted<any>>): void {
 	registerModel('IUsersSessionsModel', () => new UsersSessionsRaw(db));
diff --git a/packages/models/src/modelClasses.ts b/packages/models/src/modelClasses.ts
index c554fc9698550..b9d446e64c1ac 100644
--- a/packages/models/src/modelClasses.ts
+++ b/packages/models/src/modelClasses.ts
@@ -73,3 +73,4 @@ export * from './models/MediaCallNegotiations';
 export * from './models/WorkspaceCredentials';
 export * from './models/Trash';
 export * from './models/CallHistory';
+export * from './models/TwoFactorChallenges';
diff --git a/packages/models/src/models/TwoFactorChallenges.ts b/packages/models/src/models/TwoFactorChallenges.ts
new file mode 100644
index 0000000000000..2d4fb748c1d15
--- /dev/null
+++ b/packages/models/src/models/TwoFactorChallenges.ts
@@ -0,0 +1,38 @@
+import { randomBytes } from 'crypto';
+
+import type { ITwoFactorChallenge } from '@rocket.chat/core-typings';
+import type { ITwoFactorChallengesModel } from '@rocket.chat/model-typings';
+import type { Db, FindOptions, IndexDescription } from 'mongodb';
+
+import { BaseRaw } from './BaseRaw';
+
+export class TwoFactorChallengesRaw extends BaseRaw<ITwoFactorChallenge> implements ITwoFactorChallengesModel {
+	constructor(db: Db) {
+		super(db, 'two_factor_challenges');
+	}
+
+	override modelIndexes(): IndexDescription[] {
+		return [{ key: { expireAt: 1 }, expireAfterSeconds: 0 }];
+	}
+
+	findOneByPendingChallengeId(pendingChallengeId: string, options?: FindOptions<ITwoFactorChallenge>) {
+		return this.findOne({ _id: pendingChallengeId }, options);
+	}
+
+	removeByPendingChallengeId(pendingChallengeId: string) {
+		return this.deleteOne({ _id: pendingChallengeId });
+	}
+
+	async createTwoFactorChallenge(userId: string, method: ITwoFactorChallenge['method']): Promise<string> {
+		const now = new Date();
+		const challengeId = randomBytes(32).toString('hex');
+		await this.insertOne({
+			_id: challengeId,
+			userId,
+			method,
+			createdAt: now,
+			expireAt: new Date(now.getTime() + 1000 * 60 * 5),
+		});
+		return challengeId;
+	}
+}
diff --git a/packages/rest-typings/src/index.ts b/packages/rest-typings/src/index.ts
index 9c25e22e983f8..ef1f94da30eb1 100644
--- a/packages/rest-typings/src/index.ts
+++ b/packages/rest-typings/src/index.ts
@@ -41,6 +41,7 @@ import type { SettingsEndpoints } from './v1/settings';
 import type { StatisticsEndpoints } from './v1/statistics';
 import type { SubscriptionsEndpoints } from './v1/subscriptionsEndpoints';
 import type { TeamsEndpoints } from './v1/teams';
+import type { TwoFactorChallengesEndpoints } from './v1/twoFactorChallenges';
 import type { UsersEndpoints } from './v1/users';
 import type { VideoConferenceEndpoints } from './v1/videoConference';
 
@@ -90,6 +91,7 @@ export interface Endpoints
 		AuthEndpoints,
 		ImportEndpoints,
 		ServerEventsEndpoints,
+		TwoFactorChallengesEndpoints,
 		DefaultEndpoints {}
 
 type OperationsByPathPatternAndMethod<
@@ -264,6 +266,7 @@ export * from './v1/auth';
 export * from './v1/cloud';
 export * from './v1/banners';
 export * from './default';
+export * from './v1/twoFactorChallenges';
 
 // Export the ajv instance for use in other packages
 export * from './v1/Ajv';
diff --git a/packages/rest-typings/src/v1/twoFactorChallenges.ts b/packages/rest-typings/src/v1/twoFactorChallenges.ts
new file mode 100644
index 0000000000000..42b471b244a48
--- /dev/null
+++ b/packages/rest-typings/src/v1/twoFactorChallenges.ts
@@ -0,0 +1,43 @@
+import { ajv } from './Ajv';
+
+type TwoFactorChallengesSendEmailCode = { challengeId: string };
+
+const TwoFactorChallengesSendEmailCodeSchema = {
+	type: 'object',
+	properties: {
+		challengeId: {
+			type: 'string',
+		},
+	},
+	required: ['challengeId'],
+	additionalProperties: false,
+};
+
+export const isTwoFactorChallengesSendEmailCodeParamsPOST = ajv.compile<TwoFactorChallengesSendEmailCode>(
+	TwoFactorChallengesSendEmailCodeSchema,
+);
+
+type TwoFactorChallengesVerifyChallenge = { challengeId: string; code: string };
+
+const TwoFactorChallengesVerifyChallengeSchema = {
+	type: 'object',
+	properties: {
+		challengeId: { type: 'string' },
+		code: { type: 'string' },
+	},
+	required: ['challengeId', 'code'],
+	additionalProperties: false,
+};
+
+export const isTwoFactorChallengesVerifyChallengeParamsPOST = ajv.compile<TwoFactorChallengesVerifyChallenge>(
+	TwoFactorChallengesVerifyChallengeSchema,
+);
+
+export type TwoFactorChallengesEndpoints = {
+	'/v1/twoFactorChallenges.sendEmailCode': {
+		POST: (params: TwoFactorChallengesSendEmailCode) => void;
+	};
+	'/v1/twoFactorChallenges.verifyChallenge': {
+		POST: (params: TwoFactorChallengesVerifyChallenge) => { loginToken: string; userId: string };
+	};
+};

From 732fc12e8ce4deefb44c2908496103517f37df9c Mon Sep 17 00:00:00 2001
From: Yash Rajpal <58601732+yash-rajpal@users.noreply.github.com>
Date: Wed, 20 May 2026 03:07:34 +0530
Subject: [PATCH 32/43] chore: Passport apple oauth (#40481)

Co-authored-by: Kevin Aleman <kaleman960@gmail.com>
---
 .../app/apple/lib/handleIdentityToken.ts      |   7 +-
 .../apple/server/appleOauthRegisterService.ts | 133 +++++++++++++-----
 apps/meteor/definition/externals/express.d.ts |   2 +-
 apps/meteor/package.json                      |   2 +
 .../server/configuration/configurePassport.ts |  34 +++--
 .../lib/oauth/addPassportCustomOAuth.ts       |  41 +-----
 .../lib/oauth/configureOAuthServices.ts       |  47 +------
 .../server/lib/oauth/passportOAuthCallback.ts |  48 +++++++
 yarn.lock                                     |  24 +++-
 9 files changed, 204 insertions(+), 134 deletions(-)
 create mode 100644 apps/meteor/server/lib/oauth/passportOAuthCallback.ts

diff --git a/apps/meteor/app/apple/lib/handleIdentityToken.ts b/apps/meteor/app/apple/lib/handleIdentityToken.ts
index f3ab1c8f9e66f..861aa42707077 100644
--- a/apps/meteor/app/apple/lib/handleIdentityToken.ts
+++ b/apps/meteor/app/apple/lib/handleIdentityToken.ts
@@ -27,7 +27,7 @@ async function isValidAppleJWT(identityToken: string, header: any): Promise<bool
 	}
 }
 
-export async function handleIdentityToken(identityToken: string): Promise<{ id: string; email: string; name: string }> {
+export async function handleIdentityToken(identityToken: string): Promise<Record<string, any>> {
 	const decodedToken = KJUR.jws.JWS.parse(identityToken);
 
 	if (!(await isValidAppleJWT(identityToken, decodedToken.headerObj))) {
@@ -38,15 +38,14 @@ export async function handleIdentityToken(identityToken: string): Promise<{ id:
 		throw new Error('identityToken does not have a payload');
 	}
 
-	const { iss, sub, email } = decodedToken.payloadObj as any;
+	const { iss, sub } = decodedToken.payloadObj as any;
 	if (!iss) {
 		throw new Error('Insufficient data in auth response token');
 	}
 
 	const serviceData = {
 		id: sub,
-		email,
-		name: '',
+		...decodedToken.payloadObj,
 	};
 
 	return serviceData;
diff --git a/apps/meteor/app/apple/server/appleOauthRegisterService.ts b/apps/meteor/app/apple/server/appleOauthRegisterService.ts
index 7cb748c7ab917..5ac57ed936de7 100644
--- a/apps/meteor/app/apple/server/appleOauthRegisterService.ts
+++ b/apps/meteor/app/apple/server/appleOauthRegisterService.ts
@@ -1,9 +1,18 @@
-import { KJUR } from 'jsrsasign';
+import { MeteorError } from '@rocket.chat/core-services';
+import { Users } from '@rocket.chat/models';
+import express from 'express';
+import { Accounts } from 'meteor/accounts-base';
 import { ServiceConfiguration } from 'meteor/service-configuration';
+import passport from 'passport';
+import { Strategy as AppleStrategy } from 'passport-apple';
+import type { Profile } from 'passport-apple';
 
 import { AppleCustomOAuth } from './AppleCustomOAuth';
+import { oAuthRouter } from '../../../server/configuration/configurePassport';
+import { passportOAuthCallback } from '../../../server/lib/oauth/passportOAuthCallback';
 import { settings } from '../../settings/server';
 import { config } from '../lib/config';
+import { handleIdentityToken } from '../lib/handleIdentityToken';
 
 new AppleCustomOAuth('apple', config);
 
@@ -17,6 +26,7 @@ settings.watchMultiple(
 	],
 	async ([enabled, clientId, serverSecret, iss, kid]) => {
 		if (!enabled) {
+			passport.unuse('apple');
 			return ServiceConfiguration.configurations.removeAsync({
 				service: 'apple',
 			});
@@ -38,43 +48,96 @@ settings.watchMultiple(
 			return;
 		}
 
-		const HEADER = {
-			kid,
-			alg: 'ES256',
-		};
-
-		const now = new Date();
-		const exp = new Date();
-		exp.setMonth(exp.getMonth() + 5); // from Apple docs expiration time must no be greater than 6 months
-
-		const secret = KJUR.jws.JWS.sign(
-			null,
-			HEADER,
-			{
-				iss,
-				iat: Math.floor(now.getTime() / 1000),
-				exp: Math.floor(exp.getTime() / 1000),
-				aud: 'https://appleid.apple.com',
-				sub: clientId,
-			},
-			serverSecret as string,
-		);
+		passport.unuse('apple');
 
-		await ServiceConfiguration.configurations.upsertAsync(
-			{
-				service: 'apple',
-			},
-			{
-				$set: {
-					showButton: true,
-					secret,
-					enabled: settings.get('Accounts_OAuth_Apple'),
-					loginStyle: 'popup',
-					clientId: clientId as string,
-					buttonColor: '#000',
-					buttonLabelColor: '#FFF',
+		passport.use(
+			'apple',
+
+			new AppleStrategy(
+				{
+					clientID: settings.get<string>('Accounts_OAuth_Apple_id'),
+					teamID: settings.get<string>('Accounts_OAuth_Apple_iss'),
+					keyID: settings.get<string>('Accounts_OAuth_Apple_kid'),
+					privateKeyString: settings.get<string>('Accounts_OAuth_Apple_secretKey').replace(/\\n/g, '\n'),
+					callbackURL: `${settings.get<string>('Site_Url')}/oauth/apple/callback`,
+					scope: ['name', 'email'],
+					passReqToCallback: false,
+					state: false,
 				},
+				async (accessToken: string, refreshToken: string, idToken: string, profile: Profile, done) => {
+					try {
+						const serviceData = await handleIdentityToken(idToken);
+						if (profile?.name) {
+							serviceData.name = `${profile.name.firstName}${profile.name.middleName ? ` ${profile.name.middleName}` : ''}${
+								profile.name.lastName ? ` ${profile.name.lastName}` : ''
+							}`;
+						}
+
+						if (!serviceData.email && profile?.email) {
+							serviceData.email = profile.email;
+						}
+
+						const user = await Accounts.updateOrCreateUserFromExternalService(
+							'apple',
+							{
+								accessToken,
+								refreshToken,
+								...serviceData,
+							},
+							{},
+						);
+
+						if (!user?.userId || typeof user?.userId !== 'string') {
+							return done(new Error('User not found'));
+						}
+
+						const userFromDB = await Users.findOneById(user.userId);
+
+						if (!userFromDB) {
+							return done(new Error('User not found'));
+						}
+
+						return done(null, userFromDB);
+					} catch (error: any) {
+						done(error);
+						return {
+							type: 'apple',
+							error: new MeteorError(Accounts.LoginCancelledError.numericError, error.message),
+						};
+					}
+				},
+			),
+		);
+
+		const callbackHandler = [
+			express.urlencoded({ extended: true }),
+			passport.authenticate('apple', { failWithError: true, session: true, keepSessionInfo: true }),
+			passportOAuthCallback(settings.get<string>('Site_Url')),
+		];
+
+		oAuthRouter.get(
+			'/oauth/apple',
+			(req, _res, next) => {
+				const { loginClient } = req.query;
+				if (loginClient === 'mobile' || loginClient === 'desktop') {
+					req.session.loginClient = loginClient;
+					req.session.save(() => {
+						next();
+					});
+				} else {
+					//delete stale value from previous sessions if any
+					delete req.session.loginClient;
+					next();
+				}
 			},
+			passport.authenticate('apple', {
+				scope: ['name', 'email'],
+			}),
 		);
+
+		oAuthRouter
+			.route('/oauth/apple/callback')
+			.post(...callbackHandler)
+			.get(...callbackHandler);
 	},
 );
diff --git a/apps/meteor/definition/externals/express.d.ts b/apps/meteor/definition/externals/express.d.ts
index 9b89ad6a824b6..251d8310daf9f 100644
--- a/apps/meteor/definition/externals/express.d.ts
+++ b/apps/meteor/definition/externals/express.d.ts
@@ -11,7 +11,7 @@ declare module 'express' {
 }
 declare global {
 	namespace Express {
-		//eslint-disable-next-line
+		// eslint-disable-next-line @typescript-eslint/no-empty-interface -- merges with Passport's Express.User
 		interface User extends IUser {}
 	}
 }
diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 9fd4bb0c9e989..57d8ddf3db8d1 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -265,6 +265,7 @@
 		"overlayscrollbars": "~2.11.5",
 		"overlayscrollbars-react": "^0.5.6",
 		"passport": "^0.7.0",
+		"passport-apple": "^2.0.2",
 		"passport-facebook": "^3.0.0",
 		"passport-facebook2": "^1.0.3",
 		"passport-github2": "^0.1.12",
@@ -398,6 +399,7 @@
 		"@types/object-path": "^0.11.4",
 		"@types/parseurl": "^1.3.3",
 		"@types/passport": "^1.0.17",
+		"@types/passport-apple": "^2",
 		"@types/passport-facebook": "^3.0.4",
 		"@types/passport-github2": "^1.2.9",
 		"@types/passport-google-oauth20": "^2",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 708b3942c8092..8ba67e8de86c2 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -1,4 +1,5 @@
-import type { IUser } from '@rocket.chat/core-typings';
+import { Users } from '@rocket.chat/models';
+import bodyParser from 'body-parser';
 import MongoStore from 'connect-mongo';
 import express from 'express';
 import flash from 'express-flash';
@@ -13,19 +14,23 @@ import { configureOAuthServices } from '../lib/oauth/configureOAuthServices';
 import { createOAuthServiceConfig } from '../lib/oauth/createOAuthServiceConfig';
 import { getOAuthServices } from '../lib/oauth/getOAuthServices';
 
-export const oAuthRouter = express();
+const { Router: router } = express;
 
-oAuthRouter.set('trust proxy', true);
+export const oAuthRouter = router();
 
-const { client } = MongoInternals.defaultRemoteCollectionDriver().mongo;
+const oAuthApp = express();
+oAuthApp.set('trust proxy', true);
 
 export const configurePassport = (settings: ICachedSettings) => {
-	oAuthRouter.use(
+	const { client } = MongoInternals.defaultRemoteCollectionDriver().mongo;
+
+	oAuthApp.use(
 		session({
 			name: 'oauth',
 			secret: settings.get<string>('Accounts_OAuth_Session_Secret'),
 			resave: false,
 			saveUninitialized: false,
+			proxy: true,
 			store: MongoStore.create({
 				client,
 				collectionName: 'rocketchat_oauth_sessions',
@@ -36,13 +41,15 @@ export const configurePassport = (settings: ICachedSettings) => {
 				httpOnly: true,
 				secure: process.env.NODE_ENV === 'production',
 				maxAge: 5 * 60 * 1000, // 5 minutes
+				sameSite: process.env.NODE_ENV === 'production' ? 'none' : 'lax',
 			},
 		}),
 	);
 
-	oAuthRouter.use(passport.initialize());
-	oAuthRouter.use(passport.session());
-	oAuthRouter.use(flash());
+	oAuthApp.use(passport.initialize());
+	oAuthApp.use(passport.session());
+	oAuthApp.use(flash());
+	oAuthApp.use(bodyParser.urlencoded({ extended: true }));
 
 	const oauthRateLimiter = rateLimit({
 		windowMs: settings.get<number>('API_Enable_Rate_Limiter_Limit_Time_Default'),
@@ -60,12 +67,15 @@ export const configurePassport = (settings: ICachedSettings) => {
 
 	oAuthRouter.use('/oauth', oauthRateLimiter);
 
+	// Register OAuth Routes
+	oAuthApp.use(oAuthRouter);
+
 	passport.serializeUser((user: any, done) => {
-		done(null, user);
+		done(null, user._id);
 	});
 
-	passport.deserializeUser(async (user: IUser, done) => {
-		// const user = await Users.findOneById(id as string);
+	passport.deserializeUser(async (id, done) => {
+		const user = await Users.findOneById(id as string);
 		// we don’t actually use this user later
 		done(null, user);
 	});
@@ -76,5 +86,5 @@ export const configurePassport = (settings: ICachedSettings) => {
 		configureOAuthServices(oauthServiceConfigs, settings);
 	});
 
-	WebApp.rawConnectHandlers.use(oAuthRouter);
+	WebApp.rawConnectHandlers.use(oAuthApp);
 };
diff --git a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
index 894ea9545295e..22a3a850199d1 100644
--- a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
+++ b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
@@ -1,18 +1,13 @@
-import type { OAuthConfiguration, IUser } from '@rocket.chat/core-typings';
-import type { Request, Response } from 'express';
-import { Accounts } from 'meteor/accounts-base';
+import type { OAuthConfiguration } from '@rocket.chat/core-typings';
 import passport from 'passport';
 import type { DoneCallback, Profile } from 'passport';
 
+import { passportOAuthCallback } from './passportOAuthCallback';
 import { verifyFunction } from './verifyFunction';
 import { CustomOAuthStrategy } from '../../../app/custom-oauth/server/customOAuth';
 import { settings } from '../../../app/settings/server';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
-interface IOAuthRequest extends Request {
-	user?: IUser;
-}
-
 export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAuthConfiguration & { clientSecret: string }>) => {
 	passport.unuse(serviceName);
 
@@ -38,6 +33,8 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 					next();
 				});
 			} else {
+				//delete stale value from previous sessions if any
+				delete req.session.loginClient;
 				next();
 			}
 		},
@@ -47,34 +44,6 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 	oAuthRouter.get(
 		`/oauth/${serviceName}/callback`,
 		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
-		async (req: IOAuthRequest, res: Response) => {
-			const oAuthUser = req.user as IUser;
-
-			if (!oAuthUser) {
-				return res.redirect('/login');
-			}
-
-			const { loginClient } = req.session;
-
-			const stampedToken = Accounts._generateStampedLoginToken();
-			await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
-
-			const redirectUrl = new URL(`/home`, siteUrl);
-
-			redirectUrl.searchParams.set('resumeToken', stampedToken.token);
-			redirectUrl.searchParams.set('userId', oAuthUser._id);
-
-			if (loginClient) {
-				redirectUrl.searchParams.set('loginClient', loginClient);
-			}
-
-			res.redirect(redirectUrl.toString());
-
-			req.session.destroy((err) => {
-				if (err) {
-					console.error('Error destroying session', err);
-				}
-			});
-		},
+		passportOAuthCallback(siteUrl),
 	);
 };
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index dcfbca399683f..7958efba03e53 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -1,12 +1,10 @@
-import { type IUser } from '@rocket.chat/core-typings';
 import { Users } from '@rocket.chat/models';
-import type { Request, Response } from 'express';
 import { Accounts } from 'meteor/accounts-base';
 import passport from 'passport';
 import type { Profile, DoneCallback } from 'passport';
 
 import type { OAuthServiceConfig } from './createOAuthServiceConfig';
-import { doesUserRequire2FA } from './twoFactorAuth';
+import { passportOAuthCallback } from './passportOAuthCallback';
 import type { ICachedSettings } from '../../../app/settings/server/CachedSettings';
 import { oAuthRouter } from '../../configuration/configurePassport';
 
@@ -29,7 +27,6 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					callbackURL: `${siteUrl}/oauth/${config.provider}/callback`,
 					state: true,
 					pkce: true,
-					scope: config.scope,
 					profileFields: ['id', 'displayName', 'emails'],
 				},
 				async (accessToken: string, refreshToken: string, profile: Profile, done: DoneCallback) => {
@@ -84,47 +81,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 		oAuthRouter.get(
 			`/oauth/${config.provider}/callback`,
 			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
-			async (req: Request, res: Response) => {
-				const oAuthUser = req.user as IUser;
-
-				if (!oAuthUser) {
-					return res.redirect('/login');
-				}
-				const { loginClient } = req.session;
-
-				const secondFactorMethod = doesUserRequire2FA(oAuthUser);
-
-				if (secondFactorMethod) {
-					const challengeId = await secondFactorMethod.sendTwoFactorChallenge(oAuthUser);
-					const twoFARedirectUrl = new URL(`/2fa/${secondFactorMethod.method}/${challengeId}`, siteUrl);
-
-					if (loginClient) {
-						twoFARedirectUrl.searchParams.set('loginClient', loginClient);
-					}
-
-					return res.redirect(twoFARedirectUrl.toString());
-				}
-
-				const stampedToken = Accounts._generateStampedLoginToken();
-				await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
-
-				const redirectUrl = new URL(`/home`, siteUrl);
-
-				redirectUrl.searchParams.set('resumeToken', stampedToken.token);
-				redirectUrl.searchParams.set('userId', oAuthUser._id);
-
-				if (loginClient) {
-					redirectUrl.searchParams.set('loginClient', loginClient);
-				}
-
-				setImmediate(() => res.redirect(redirectUrl.toString()));
-
-				req.session.destroy((err) => {
-					if (err) {
-						console.error('Error destroying session', err);
-					}
-				});
-			},
+			passportOAuthCallback(siteUrl),
 		);
 	});
 };
diff --git a/apps/meteor/server/lib/oauth/passportOAuthCallback.ts b/apps/meteor/server/lib/oauth/passportOAuthCallback.ts
new file mode 100644
index 0000000000000..392f9c4eda6ad
--- /dev/null
+++ b/apps/meteor/server/lib/oauth/passportOAuthCallback.ts
@@ -0,0 +1,48 @@
+import type { IUser } from '@rocket.chat/core-typings';
+import type { Request, Response } from 'express';
+import { Accounts } from 'meteor/accounts-base';
+
+import { doesUserRequire2FA } from './twoFactorAuth';
+
+export const passportOAuthCallback = (siteUrl: string) => async (req: Request, res: Response) => {
+	const oAuthUser = req.user as IUser;
+
+	if (!oAuthUser) {
+		return res.redirect('/login');
+	}
+
+	const { loginClient } = req.session;
+
+	const secondFactorMethod = doesUserRequire2FA(oAuthUser);
+
+	if (secondFactorMethod) {
+		const challengeId = await secondFactorMethod.sendTwoFactorChallenge(oAuthUser);
+		const twoFARedirectUrl = new URL(`/2fa/${secondFactorMethod.method}/${challengeId}`, siteUrl);
+
+		if (loginClient) {
+			twoFARedirectUrl.searchParams.set('loginClient', loginClient);
+		}
+
+		return res.redirect(twoFARedirectUrl.toString());
+	}
+
+	const stampedToken = Accounts._generateStampedLoginToken();
+	await Accounts._insertLoginToken(oAuthUser._id, stampedToken);
+
+	const redirectUrl = new URL(`/home`, siteUrl);
+
+	redirectUrl.searchParams.set('resumeToken', stampedToken.token);
+	redirectUrl.searchParams.set('userId', oAuthUser._id);
+
+	if (loginClient) {
+		redirectUrl.searchParams.set('loginClient', loginClient);
+	}
+
+	setImmediate(() => res.redirect(redirectUrl.toString()));
+
+	req.session.destroy((err) => {
+		if (err) {
+			console.error('Error destroying session', err);
+		}
+	});
+};
diff --git a/yarn.lock b/yarn.lock
index 82a52d1f34c90..8cd5a9a64cfde 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9858,6 +9858,7 @@ __metadata:
     "@types/object-path": "npm:^0.11.4"
     "@types/parseurl": "npm:^1.3.3"
     "@types/passport": "npm:^1.0.17"
+    "@types/passport-apple": "npm:^2"
     "@types/passport-facebook": "npm:^3.0.4"
     "@types/passport-github2": "npm:^1.2.9"
     "@types/passport-google-oauth20": "npm:^2"
@@ -10005,6 +10006,7 @@ __metadata:
     overlayscrollbars: "npm:~2.11.5"
     overlayscrollbars-react: "npm:^0.5.6"
     passport: "npm:^0.7.0"
+    passport-apple: "npm:^2.0.2"
     passport-facebook: "npm:^3.0.0"
     passport-facebook2: "npm:^1.0.3"
     passport-github2: "npm:^0.1.12"
@@ -14757,6 +14759,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"@types/passport-apple@npm:^2":
+  version: 2.0.3
+  resolution: "@types/passport-apple@npm:2.0.3"
+  dependencies:
+    "@types/express": "npm:*"
+    "@types/passport-oauth2": "npm:*"
+  checksum: 10/5aa6b98913e803a66728ba313bb16f7aed74ba67151748b0b20ac6b492639e240be69e80939474f6bde0e0855856f0d13411b3853249301a8708cb6ea63c2260
+  languageName: node
+  linkType: hard
+
 "@types/passport-facebook@npm:^3.0.4":
   version: 3.0.4
   resolution: "@types/passport-facebook@npm:3.0.4"
@@ -30055,6 +30067,16 @@ __metadata:
   languageName: node
   linkType: hard
 
+"passport-apple@npm:^2.0.2":
+  version: 2.0.2
+  resolution: "passport-apple@npm:2.0.2"
+  dependencies:
+    jsonwebtoken: "npm:^9.0.0"
+    passport-oauth2: "npm:^1.6.1"
+  checksum: 10/fa061292deb885c09a9edcb027790d14e66112848828f803fd52d96a81adbb60fd8ac8e0ef8a8cf43e029dc048bf971513c60e1b520b020c902d466fe66902e8
+  languageName: node
+  linkType: hard
+
 "passport-facebook2@npm:^1.0.3":
   version: 1.0.3
   resolution: "passport-facebook2@npm:1.0.3"
@@ -30102,7 +30124,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.8.0":
+"passport-oauth2@npm:1.x.x, passport-oauth2@npm:^1.6.1, passport-oauth2@npm:^1.8.0":
   version: 1.8.0
   resolution: "passport-oauth2@npm:1.8.0"
   dependencies:

From bdb7a2ea421a5de63ddaed598eabdc8c3b591437 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 06:47:50 +0530
Subject: [PATCH 33/43] handle undefined client secrets

---
 .../lib/oauth/createOAuthServiceConfig.ts     | 29 ++++++++++++++-----
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
index 31e2f7d2cedcf..3ea8213140b95 100644
--- a/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
+++ b/apps/meteor/server/lib/oauth/createOAuthServiceConfig.ts
@@ -21,22 +21,37 @@ export const createOAuthServiceConfig = (settings: ICachedSettings, services: st
 			}
 
 			if (service === 'github_enterprise') {
+				const clientId = settings.get<string>('Accounts_OAuth_GitHub_Enterprise_id');
+				const clientSecret = settings.get<string>('Accounts_OAuth_GitHub_Enterprise_secret');
+				const serverUrl = settings.get<string>('API_GitHub_Enterprise_URL');
+
+				if (!clientId || !clientSecret || !serverUrl) {
+					return;
+				}
+
 				return {
 					provider: service,
-					clientId: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_id'),
-					clientSecret: settings.get<string>('Accounts_OAuth_GitHub_Enterprise_secret'),
-					authorizationURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/authorize`,
-					tokenURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/login/oauth/access_token`,
-					userProfileURL: `${settings.get<string>('API_GitHub_Enterprise_URL')}/api/v3/user`,
+					clientId,
+					clientSecret,
+					authorizationURL: `${serverUrl}/login/oauth/authorize`,
+					tokenURL: `${serverUrl}/login/oauth/access_token`,
+					userProfileURL: `${serverUrl}/api/v3/user`,
 					strategy: OAuthConfigs.github_enterprise.strategy,
 					scope: OAuthConfigs.github_enterprise.scope,
 				};
 			}
 
+			const clientId = settings.get<string>(`Accounts_OAuth_${capitalize(service)}_id`);
+			const clientSecret = settings.get<string>(`Accounts_OAuth_${capitalize(service)}_secret`);
+
+			if (!clientId || !clientSecret) {
+				return;
+			}
+
 			return {
 				provider: service,
-				clientId: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_id`),
-				clientSecret: settings.get<string>(`Accounts_OAuth_${capitalize(service)}_secret`),
+				clientId,
+				clientSecret,
 				...OAuthConfigs[service],
 			};
 		})

From 540c2b6354c869b6dc5a5256b6c578f54dc9e7ef Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 09:16:27 +0530
Subject: [PATCH 34/43] fix oauth e2e tests

---
 apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts | 4 ++++
 apps/meteor/tests/e2e/fixtures/addCustomOAuth.ts       | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
index 22a3a850199d1..9ee57da3c8386 100644
--- a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
+++ b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
@@ -11,6 +11,10 @@ import { oAuthRouter } from '../../configuration/configurePassport';
 export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAuthConfiguration & { clientSecret: string }>) => {
 	passport.unuse(serviceName);
 
+	if (!config.clientId || !config.clientSecret || !config.serverURL) {
+		return;
+	}
+
 	passport.use(
 		serviceName,
 		new CustomOAuthStrategy(
diff --git a/apps/meteor/tests/e2e/fixtures/addCustomOAuth.ts b/apps/meteor/tests/e2e/fixtures/addCustomOAuth.ts
index 5721266b728d5..70885f1a634fb 100644
--- a/apps/meteor/tests/e2e/fixtures/addCustomOAuth.ts
+++ b/apps/meteor/tests/e2e/fixtures/addCustomOAuth.ts
@@ -15,4 +15,7 @@ export default async function addCustomOAuth(): Promise<void> {
 	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test`, { data: { value: false }, headers });
 	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test-url`, { data: { value: 'https://rocket.chat' }, headers });
 	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test-login_style`, { data: { value: 'redirect' }, headers });
+	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test-id`, { data: { value: 'abc' }, headers });
+	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test-secret`, { data: { value: 'def' }, headers });
+	await api.post(`${BASE_API_URL}/settings/Accounts_OAuth_Custom-Test-authorize_path`, { data: { value: '/authorize' }, headers });
 }

From 88a80992e5f6cac737b400a7b1f0a6818eff05f9 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 09:28:54 +0530
Subject: [PATCH 35/43] isolate oauth middlewares

---
 apps/meteor/server/configuration/configurePassport.ts | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 8ba67e8de86c2..b51734e969e2e 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -25,6 +25,7 @@ export const configurePassport = (settings: ICachedSettings) => {
 	const { client } = MongoInternals.defaultRemoteCollectionDriver().mongo;
 
 	oAuthApp.use(
+		'/oauth',
 		session({
 			name: 'oauth',
 			secret: settings.get<string>('Accounts_OAuth_Session_Secret'),
@@ -46,10 +47,10 @@ export const configurePassport = (settings: ICachedSettings) => {
 		}),
 	);
 
-	oAuthApp.use(passport.initialize());
-	oAuthApp.use(passport.session());
-	oAuthApp.use(flash());
-	oAuthApp.use(bodyParser.urlencoded({ extended: true }));
+	oAuthApp.use('/oauth', passport.initialize());
+	oAuthApp.use('/oauth', passport.session());
+	oAuthApp.use('/oauth', flash());
+	oAuthApp.use('/oauth', bodyParser.urlencoded({ extended: true }));
 
 	const oauthRateLimiter = rateLimit({
 		windowMs: settings.get<number>('API_Enable_Rate_Limiter_Limit_Time_Default'),

From 5f2b140846066ce1410f0ad5513f548aaa5b69fb Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 17:40:21 +0530
Subject: [PATCH 36/43] spread profile for all fields

---
 apps/meteor/server/lib/oauth/verifyFunction.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/apps/meteor/server/lib/oauth/verifyFunction.ts b/apps/meteor/server/lib/oauth/verifyFunction.ts
index dc55fb343a3fd..74d8c051e5992 100644
--- a/apps/meteor/server/lib/oauth/verifyFunction.ts
+++ b/apps/meteor/server/lib/oauth/verifyFunction.ts
@@ -19,6 +19,7 @@ export const verifyFunction = async (
 			refreshToken,
 			name: profile.displayName,
 			email: profile?.emails?.[0]?.value,
+			...profile,
 			...restProfile,
 			..._json,
 		},

From 8a9a9654104c3e87de9be5879d264c6918bbde20 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 19:27:21 +0530
Subject: [PATCH 37/43] restore /_oauth/provider callback structure

---
 .../app/apple/server/appleOauthRegisterService.ts  |  4 ++--
 apps/meteor/app/custom-oauth/server/customOAuth.ts |  2 +-
 .../server/configuration/configurePassport.ts      | 14 ++++++++------
 .../server/lib/oauth/addPassportCustomOAuth.ts     |  2 +-
 .../server/lib/oauth/configureOAuthServices.ts     |  4 ++--
 5 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/apps/meteor/app/apple/server/appleOauthRegisterService.ts b/apps/meteor/app/apple/server/appleOauthRegisterService.ts
index 5ac57ed936de7..429909b94901b 100644
--- a/apps/meteor/app/apple/server/appleOauthRegisterService.ts
+++ b/apps/meteor/app/apple/server/appleOauthRegisterService.ts
@@ -59,7 +59,7 @@ settings.watchMultiple(
 					teamID: settings.get<string>('Accounts_OAuth_Apple_iss'),
 					keyID: settings.get<string>('Accounts_OAuth_Apple_kid'),
 					privateKeyString: settings.get<string>('Accounts_OAuth_Apple_secretKey').replace(/\\n/g, '\n'),
-					callbackURL: `${settings.get<string>('Site_Url')}/oauth/apple/callback`,
+					callbackURL: `${settings.get<string>('Site_Url')}/_oauth/apple`,
 					scope: ['name', 'email'],
 					passReqToCallback: false,
 					state: false,
@@ -136,7 +136,7 @@ settings.watchMultiple(
 		);
 
 		oAuthRouter
-			.route('/oauth/apple/callback')
+			.route('/_oauth/apple')
 			.post(...callbackHandler)
 			.get(...callbackHandler);
 	},
diff --git a/apps/meteor/app/custom-oauth/server/customOAuth.ts b/apps/meteor/app/custom-oauth/server/customOAuth.ts
index 21afcf71ece4a..13c4d4d6ca373 100644
--- a/apps/meteor/app/custom-oauth/server/customOAuth.ts
+++ b/apps/meteor/app/custom-oauth/server/customOAuth.ts
@@ -63,7 +63,7 @@ export class CustomOAuthStrategy extends Strategy {
 			tokenURL: config.serverURL + config.tokenPath,
 			clientID: config.clientId,
 			clientSecret: config.clientSecret,
-			callbackURL: `${settings.get<string>('Site_Url')}/oauth/${name}/callback`,
+			callbackURL: `${settings.get<string>('Site_Url')}/_oauth/${name}`,
 			state: true,
 			pkce: config.pkce ?? true,
 			scope: config.scope,
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index b51734e969e2e..7ac3248c563dd 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -14,6 +14,8 @@ import { configureOAuthServices } from '../lib/oauth/configureOAuthServices';
 import { createOAuthServiceConfig } from '../lib/oauth/createOAuthServiceConfig';
 import { getOAuthServices } from '../lib/oauth/getOAuthServices';
 
+const oAuthPaths = ['/oauth', '/_oauth'];
+
 const { Router: router } = express;
 
 export const oAuthRouter = router();
@@ -25,7 +27,7 @@ export const configurePassport = (settings: ICachedSettings) => {
 	const { client } = MongoInternals.defaultRemoteCollectionDriver().mongo;
 
 	oAuthApp.use(
-		'/oauth',
+		oAuthPaths,
 		session({
 			name: 'oauth',
 			secret: settings.get<string>('Accounts_OAuth_Session_Secret'),
@@ -47,10 +49,10 @@ export const configurePassport = (settings: ICachedSettings) => {
 		}),
 	);
 
-	oAuthApp.use('/oauth', passport.initialize());
-	oAuthApp.use('/oauth', passport.session());
-	oAuthApp.use('/oauth', flash());
-	oAuthApp.use('/oauth', bodyParser.urlencoded({ extended: true }));
+	oAuthApp.use(oAuthPaths, passport.initialize());
+	oAuthApp.use(oAuthPaths, passport.session());
+	oAuthApp.use(oAuthPaths, flash());
+	oAuthApp.use(oAuthPaths, bodyParser.urlencoded({ extended: true }));
 
 	const oauthRateLimiter = rateLimit({
 		windowMs: settings.get<number>('API_Enable_Rate_Limiter_Limit_Time_Default'),
@@ -66,7 +68,7 @@ export const configurePassport = (settings: ICachedSettings) => {
 		},
 	});
 
-	oAuthRouter.use('/oauth', oauthRateLimiter);
+	oAuthRouter.use(oAuthPaths, oauthRateLimiter);
 
 	// Register OAuth Routes
 	oAuthApp.use(oAuthRouter);
diff --git a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
index 9ee57da3c8386..e26f51bdf9c72 100644
--- a/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
+++ b/apps/meteor/server/lib/oauth/addPassportCustomOAuth.ts
@@ -46,7 +46,7 @@ export const addPassportCustomOAuth = (serviceName: string, config: Partial<OAut
 	);
 
 	oAuthRouter.get(
-		`/oauth/${serviceName}/callback`,
+		`/_oauth/${serviceName}`,
 		passport.authenticate(serviceName, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
 		passportOAuthCallback(siteUrl),
 	);
diff --git a/apps/meteor/server/lib/oauth/configureOAuthServices.ts b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
index 7958efba03e53..5ff0b202a2e89 100644
--- a/apps/meteor/server/lib/oauth/configureOAuthServices.ts
+++ b/apps/meteor/server/lib/oauth/configureOAuthServices.ts
@@ -24,7 +24,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 					clientSecret: config.clientSecret,
 					consumerKey: config.clientId,
 					consumerSecret: config.clientSecret,
-					callbackURL: `${siteUrl}/oauth/${config.provider}/callback`,
+					callbackURL: `${siteUrl}/_oauth/${config.provider}`,
 					state: true,
 					pkce: true,
 					profileFields: ['id', 'displayName', 'emails'],
@@ -79,7 +79,7 @@ export const configureOAuthServices = (oauthServiceConfig: OAuthServiceConfig[],
 			passport.authenticate(config.provider, { scope: config.scope, prompt: 'consent', failureRedirect: '/login', keepSessionInfo: true }),
 		);
 		oAuthRouter.get(
-			`/oauth/${config.provider}/callback`,
+			`/_oauth/${config.provider}`,
 			passport.authenticate(config.provider, { failureRedirect: '/login', failureFlash: true, failWithError: true, keepSessionInfo: true }),
 			passportOAuthCallback(siteUrl),
 		);

From c1525a9c2977a16ee25ed043a14c54bd305a9abb Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:17:36 +0530
Subject: [PATCH 38/43] fix review

---
 apps/meteor/app/2fa/server/code/index.ts      |  2 +-
 .../meteor/client/lib/buildAuthDeeplinkURL.ts |  4 +--
 apps/meteor/package.json                      |  2 --
 .../server/configuration/configurePassport.ts |  2 --
 .../server/lib/oauth/passportOAuthCallback.ts |  5 +++-
 yarn.lock                                     | 27 -------------------
 6 files changed, 7 insertions(+), 35 deletions(-)

diff --git a/apps/meteor/app/2fa/server/code/index.ts b/apps/meteor/app/2fa/server/code/index.ts
index 4f68ac37e70d1..ee25c80fc55ac 100644
--- a/apps/meteor/app/2fa/server/code/index.ts
+++ b/apps/meteor/app/2fa/server/code/index.ts
@@ -64,7 +64,7 @@ function getFingerprintFromConnection(connection: IMethodConnection): string {
 }
 
 export function getRememberDate(from: Date = new Date()): Date | undefined {
-	const rememberFor = parseInt(settings.get('Accounts_TwoFactorAuthentication_RememberFor'), 10);
+	const rememberFor = settings.get<number>('Accounts_TwoFactorAuthentication_RememberFor');
 
 	if (rememberFor <= 0) {
 		return;
diff --git a/apps/meteor/client/lib/buildAuthDeeplinkURL.ts b/apps/meteor/client/lib/buildAuthDeeplinkURL.ts
index e21a711963371..e4481fed271d3 100644
--- a/apps/meteor/client/lib/buildAuthDeeplinkURL.ts
+++ b/apps/meteor/client/lib/buildAuthDeeplinkURL.ts
@@ -1,5 +1,5 @@
 export const buildDeepLinkURL = (resumeToken: string, userId: string) => {
 	const url = new URL(window.location.href);
-	const { host } = url;
-	return `rocketchat://auth?host=http://${host}&token=${resumeToken}&userId=${userId}`;
+	const { origin } = url;
+	return `rocketchat://auth?host=${origin}&token=${resumeToken}&userId=${userId}`;
 };
diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 68e0cb2989506..5530fcdaf9745 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -205,7 +205,6 @@
 		"exif-be-gone": "^1.5.1",
 		"expiry-map": "^2.0.0",
 		"express": "^4.21.2",
-		"express-flash": "^0.0.2",
 		"express-rate-limit": "^5.5.1",
 		"express-session": "^1.19.0",
 		"fast-redact": "^3.5.0",
@@ -366,7 +365,6 @@
 		"@types/cssom": "^0.4.3",
 		"@types/ejson": "^2.2.2",
 		"@types/express": "^4.17.25",
-		"@types/express-flash": "^0",
 		"@types/express-rate-limit": "^5.1.3",
 		"@types/express-session": "^1",
 		"@types/fast-redact": "^3",
diff --git a/apps/meteor/server/configuration/configurePassport.ts b/apps/meteor/server/configuration/configurePassport.ts
index 7ac3248c563dd..48c9ccd9d85cc 100644
--- a/apps/meteor/server/configuration/configurePassport.ts
+++ b/apps/meteor/server/configuration/configurePassport.ts
@@ -2,7 +2,6 @@ import { Users } from '@rocket.chat/models';
 import bodyParser from 'body-parser';
 import MongoStore from 'connect-mongo';
 import express from 'express';
-import flash from 'express-flash';
 import rateLimit from 'express-rate-limit';
 import session from 'express-session';
 import { MongoInternals } from 'meteor/mongo';
@@ -51,7 +50,6 @@ export const configurePassport = (settings: ICachedSettings) => {
 
 	oAuthApp.use(oAuthPaths, passport.initialize());
 	oAuthApp.use(oAuthPaths, passport.session());
-	oAuthApp.use(oAuthPaths, flash());
 	oAuthApp.use(oAuthPaths, bodyParser.urlencoded({ extended: true }));
 
 	const oauthRateLimiter = rateLimit({
diff --git a/apps/meteor/server/lib/oauth/passportOAuthCallback.ts b/apps/meteor/server/lib/oauth/passportOAuthCallback.ts
index 392f9c4eda6ad..7bd128f6ebf7a 100644
--- a/apps/meteor/server/lib/oauth/passportOAuthCallback.ts
+++ b/apps/meteor/server/lib/oauth/passportOAuthCallback.ts
@@ -1,9 +1,12 @@
 import type { IUser } from '@rocket.chat/core-typings';
+import { Logger } from '@rocket.chat/logger';
 import type { Request, Response } from 'express';
 import { Accounts } from 'meteor/accounts-base';
 
 import { doesUserRequire2FA } from './twoFactorAuth';
 
+const logger = new Logger('OAuth');
+
 export const passportOAuthCallback = (siteUrl: string) => async (req: Request, res: Response) => {
 	const oAuthUser = req.user as IUser;
 
@@ -42,7 +45,7 @@ export const passportOAuthCallback = (siteUrl: string) => async (req: Request, r
 
 	req.session.destroy((err) => {
 		if (err) {
-			console.error('Error destroying session', err);
+			logger.error({ msg: 'Error destroying OAuth session', err });
 		}
 	});
 };
diff --git a/yarn.lock b/yarn.lock
index f9c4e5eb249db..7c3802f7c8dba 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -9823,7 +9823,6 @@ __metadata:
     "@types/cssom": "npm:^0.4.3"
     "@types/ejson": "npm:^2.2.2"
     "@types/express": "npm:^4.17.25"
-    "@types/express-flash": "npm:^0"
     "@types/express-rate-limit": "npm:^5.1.3"
     "@types/express-session": "npm:^1"
     "@types/fast-redact": "npm:^3"
@@ -9939,7 +9938,6 @@ __metadata:
     exif-be-gone: "npm:^1.5.1"
     expiry-map: "npm:^2.0.0"
     express: "npm:^4.21.2"
-    express-flash: "npm:^0.0.2"
     express-rate-limit: "npm:^5.5.1"
     express-session: "npm:^1.19.0"
     fast-glob: "npm:^3.3.3"
@@ -14114,15 +14112,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"@types/express-flash@npm:^0":
-  version: 0.0.5
-  resolution: "@types/express-flash@npm:0.0.5"
-  dependencies:
-    "@types/express": "npm:*"
-  checksum: 10/0985a1c73f6ad0fd95902495f5a8cad757476c64cce3b75109c4a0875f569e97b1184cc358ffb646da335145c9a4ebaa993739c68f7ead8457ffd1269ee2a9da
-  languageName: node
-  linkType: hard
-
 "@types/express-rate-limit@npm:^5.1.3":
   version: 5.1.3
   resolution: "@types/express-rate-limit@npm:5.1.3"
@@ -18884,13 +18873,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"connect-flash@npm:0.1.x":
-  version: 0.1.1
-  resolution: "connect-flash@npm:0.1.1"
-  checksum: 10/243e103ec1fdf056e33eccdb3ccad20abe50b3c6e9b8a2a6391708cb0fcc550d116cdc2208fedd04be338ac0a45f8e7af2300042d8190c4342658f738b4d4e3a
-  languageName: node
-  linkType: hard
-
 "connect-history-api-fallback@npm:^2.0.0":
   version: 2.0.0
   resolution: "connect-history-api-fallback@npm:2.0.0"
@@ -22096,15 +22078,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"express-flash@npm:^0.0.2":
-  version: 0.0.2
-  resolution: "express-flash@npm:0.0.2"
-  dependencies:
-    connect-flash: "npm:0.1.x"
-  checksum: 10/2979158276da72fa5b68d6b370183ae756dcd7ffd038885ca099706c147cf0b4b1e25387ae36691eab2ed7211c07fad3450a3c31dc2c8b15c0f057043ed33bb5
-  languageName: node
-  linkType: hard
-
 "express-rate-limit@npm:^5.5.1":
   version: 5.5.1
   resolution: "express-rate-limit@npm:5.5.1"

From 873daadf6f95a065228b109bebcafc41a0ccaa5e Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:27:02 +0530
Subject: [PATCH 39/43] add changeset

---
 .changeset/flat-poets-cheat.md | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)
 create mode 100644 .changeset/flat-poets-cheat.md

diff --git a/.changeset/flat-poets-cheat.md b/.changeset/flat-poets-cheat.md
new file mode 100644
index 0000000000000..2560e2d3ee172
--- /dev/null
+++ b/.changeset/flat-poets-cheat.md
@@ -0,0 +1,28 @@
+---
+'@rocket.chat/web-ui-registration': minor
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/desktop-api': minor
+'@rocket.chat/models': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+## Phishing-Resistant Multi-Factor Authentication
+
+Introduces a more secure and reliable server-side OAuth authentication flow.
+
+### What’s New
+
+- **Improved OAuth login security**  
+  OAuth authentication now happens fully on the server, reducing the risk of token theft, phishing attacks, and client-side credential interception.
+
+- **Built-in CSRF, state validation, and PKCE protection**  
+  OAuth logins now include stronger protection against CSRF attacks, request tampering, and authorization code interception through secure state validation and PKCE support.
+
+- **Improved two-step verification with OAuth logins**  
+  Users with email or TOTP two-factor authentication enabled will now be asked to complete 2FA even when signing in with providers like Google, GitHub, GitLab, and others.
+
+- **Improved mobile & desktop app login**  
+  Mobile and desktop apps now support a smoother and more secure deep-link OAuth login flow.

From d360cd20a96c569a1cad8d0ec293cdf66560aa2a Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:27:32 +0530
Subject: [PATCH 40/43] fix unused tokenObject

---
 apps/meteor/app/2fa/server/code/index.ts | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/apps/meteor/app/2fa/server/code/index.ts b/apps/meteor/app/2fa/server/code/index.ts
index ee25c80fc55ac..0094b25bd321d 100644
--- a/apps/meteor/app/2fa/server/code/index.ts
+++ b/apps/meteor/app/2fa/server/code/index.ts
@@ -124,11 +124,6 @@ export async function rememberAuthorizationByToken(token: string, userId: IUser[
 		throw new Meteor.Error('error-user-not-found', 'user not found');
 	}
 
-	const tokenObject = user.services?.resume?.loginTokens?.find((i) => i.hashedToken === token);
-	if (!tokenObject) {
-		throw new Meteor.Error('error-token-not-found', 'token not found');
-	}
-
 	const expires = getRememberDate();
 	if (!expires) {
 		return;

From 0b99664b9d5c6107d182ec2fb7506288e0345427 Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:43:12 +0530
Subject: [PATCH 41/43] remove unused deps

---
 apps/meteor/package.json |  1 -
 yarn.lock                | 10 ----------
 2 files changed, 11 deletions(-)

diff --git a/apps/meteor/package.json b/apps/meteor/package.json
index 5530fcdaf9745..8b8bb2d4ce7f1 100644
--- a/apps/meteor/package.json
+++ b/apps/meteor/package.json
@@ -266,7 +266,6 @@
 		"passport": "^0.7.0",
 		"passport-apple": "^2.0.2",
 		"passport-facebook": "^3.0.0",
-		"passport-facebook2": "^1.0.3",
 		"passport-github2": "^0.1.12",
 		"passport-google-oauth20": "^2.0.0",
 		"passport-oauth2": "^1.8.0",
diff --git a/yarn.lock b/yarn.lock
index 7c3802f7c8dba..82d5daa637805 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -10006,7 +10006,6 @@ __metadata:
     passport: "npm:^0.7.0"
     passport-apple: "npm:^2.0.2"
     passport-facebook: "npm:^3.0.0"
-    passport-facebook2: "npm:^1.0.3"
     passport-github2: "npm:^0.1.12"
     passport-google-oauth20: "npm:^2.0.0"
     passport-oauth2: "npm:^1.8.0"
@@ -30051,15 +30050,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"passport-facebook2@npm:^1.0.3":
-  version: 1.0.3
-  resolution: "passport-facebook2@npm:1.0.3"
-  dependencies:
-    passport-oauth2: "npm:1.x.x"
-  checksum: 10/0dfc697d4db5bd55c0523f77bc4683568ffb6a5037e9d3d07275dff5007b76d1def83c9bff5f2d8414cd59ea26b3d619abae8d5dcd8bd784d6110d9ce770530d
-  languageName: node
-  linkType: hard
-
 "passport-facebook@npm:^3.0.0":
   version: 3.0.0
   resolution: "passport-facebook@npm:3.0.0"

From 396cf66e7698e2c2cd60df680ef1942d5008c4ea Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:46:18 +0530
Subject: [PATCH 42/43] improve login redirect url handling

---
 packages/web-ui-registration/src/LoginServices.tsx | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/packages/web-ui-registration/src/LoginServices.tsx b/packages/web-ui-registration/src/LoginServices.tsx
index 5e9d3972e60ea..df490dfcd4d59 100644
--- a/packages/web-ui-registration/src/LoginServices.tsx
+++ b/packages/web-ui-registration/src/LoginServices.tsx
@@ -35,7 +35,10 @@ const LoginServices = ({
 			return;
 		}
 
-		window.RocketChatDesktop?.openInBrowser(`${window.location.href}?loginClient=desktop`);
+		const redirectUrl = new URL(window.location.href);
+		redirectUrl.searchParams.set('loginClient', 'desktop');
+
+		window.RocketChatDesktop?.openInBrowser(redirectUrl.toString());
 	};
 
 	return (

From 2700a4624c47ca5c4175ccf87bfa3e13d887fdaa Mon Sep 17 00:00:00 2001
From: yash-rajpal <rajpal.yash03@gmail.com>
Date: Wed, 20 May 2026 22:52:22 +0530
Subject: [PATCH 43/43] check for email method before sending email code

---
 apps/meteor/app/api/server/v1/twoFactorChallenges.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/apps/meteor/app/api/server/v1/twoFactorChallenges.ts b/apps/meteor/app/api/server/v1/twoFactorChallenges.ts
index 4cd335c7e1c80..fd48e22ad7123 100644
--- a/apps/meteor/app/api/server/v1/twoFactorChallenges.ts
+++ b/apps/meteor/app/api/server/v1/twoFactorChallenges.ts
@@ -29,6 +29,10 @@ API.v1.addRoute(
 				throw new Meteor.Error('error-challenge-expired', 'challenge expired');
 			}
 
+			if (challenge.method !== 'email') {
+				throw new Meteor.Error('error-invalid-challenge-method', 'invalid challenge method');
+			}
+
 			const { userId } = challenge;
 
 			const user = await getUserForCheck(userId);