fix: abacAttributes reactivity

.changeset/spicy-phones-breathe.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": patch
+"@rocket.chat/abac": patch
+---
+
+Fixes an issue where some actions made by the abac service were not broadcasting to clients, which affected reactivity

apps/meteor/client/cachedStores/RoomsCachedStore.ts

@@ -1,5 +1,5 @@
 import type { IOmnichannelRoom, IRoom, IRoomWithRetentionPolicy } from '@rocket.chat/core-typings';
-import { DEFAULT_SLA_CONFIG, isABACManagedRoom, isRoomNativeFederated, LivechatPriorityWeight } from '@rocket.chat/core-typings';
+import { DEFAULT_SLA_CONFIG, isRoomNativeFederated, LivechatPriorityWeight } from '@rocket.chat/core-typings';
 import type { SubscriptionWithRoom } from '@rocket.chat/ui-contexts';
 
 import { PrivateCachedStore } from '../lib/cachedStores/CachedStore';
@@ -53,9 +53,7 @@ class RoomsCachedStore extends PrivateCachedStore<IRoom> {
 			source: (room as IOmnichannelRoom | undefined)?.source,
 			queuedAt: (room as IOmnichannelRoom | undefined)?.queuedAt,
 			federated: room.federated,
-			...(isABACManagedRoom(room) && {
-				abacAttributes: room.abacAttributes,
-			}),
+			abacAttributes: room.abacAttributes,
 			...(isRoomNativeFederated(room) && {
 				federation: room.federation,
 			}),

ee/packages/abac/src/helper.ts

@@ -225,14 +225,8 @@ export function buildRoomNonCompliantConditionsFromSubject(subjectAttributes: IA
 	return conditions;
 }
 
-export async function getAbacRoom(
-	rid: string,
-): Promise<Pick<IRoom, '_id' | 'abacAttributes' | 't' | 'teamMain' | 'teamDefault' | 'default' | 'name'>> {
-	const room = await Rooms.findOneByIdAndType<
-		Pick<IRoom, '_id' | 'abacAttributes' | 't' | 'teamMain' | 'teamDefault' | 'default' | 'name'>
-	>(rid, 'p', {
-		projection: { abacAttributes: 1, t: 1, teamMain: 1, teamDefault: 1, default: 1, name: 1 },
-	});
+export async function getAbacRoom(rid: string): Promise<IRoom> {
+	const room = await Rooms.findOneByIdAndType(rid, 'p');
 	if (!room) {
 		throw new AbacRoomNotFoundError();
 	}

ee/packages/abac/src/index.ts

@@ -1,4 +1,4 @@
-import { Room, ServiceClass, Settings } from '@rocket.chat/core-services';
+import { api, Room, ServiceClass, Settings } from '@rocket.chat/core-services';
 import type { AbacActor, IAbacService } from '@rocket.chat/core-services';
 import { AbacAccessOperation, AbacObjectType } from '@rocket.chat/core-typings';
 import type {
@@ -428,13 +428,18 @@ export class AbacService extends ServiceClass implements IAbacService {
 		return Rooms.isAbacAttributeInUse(key, attribute.values || []);
 	}
 
+	private broadcastRoomUpdate(room: IRoom): void {
+		void api.broadcast('watch.rooms', { clientAction: 'updated', room });
+	}
+
 	async setRoomAbacAttributes(rid: string, attributes: Record<string, string[]>, actor: AbacActor): Promise<void> {
 		await this.ensurePdpAvailable();
 		const room = await getAbacRoom(rid);
 
 		if (!Object.keys(attributes).length && room.abacAttributes?.length) {
 			await Rooms.unsetAbacAttributesById(rid);
 			void Audit.objectAttributesRemoved({ _id: room._id, name: room.name }, room.abacAttributes, actor);
+			this.broadcastRoomUpdate({ ...room, abacAttributes: undefined });
 			return;
 		}
 
@@ -445,6 +450,10 @@ export class AbacService extends ServiceClass implements IAbacService {
 		const updated = await Rooms.setAbacAttributesById(rid, normalized);
 		void Audit.objectAttributeChanged({ _id: room._id, name: room.name }, room.abacAttributes || [], normalized, 'updated', actor);
 
+		if (updated) {
+			this.broadcastRoomUpdate(updated);
+		}
+
 		const previous: IAbacAttributeDefinition[] = room.abacAttributes || [];
 		if (diffAttributeSets(previous, normalized).added) {
 			await this.onRoomAttributesChanged(room, updated?.abacAttributes ?? normalized);
@@ -476,6 +485,8 @@ export class AbacService extends ServiceClass implements IAbacService {
 			);
 			const next = [...previous, { key, values }];
 
+			this.broadcastRoomUpdate({ ...room, abacAttributes: next });
+
 			await this.onRoomAttributesChanged(room, next);
 			return;
 		}
@@ -486,7 +497,7 @@ export class AbacService extends ServiceClass implements IAbacService {
 			return;
 		}
 
-		await Rooms.updateAbacAttributeValuesArrayFilteredById(rid, key, values);
+		const updated = await Rooms.updateAbacAttributeValuesArrayFilteredById(rid, key, values);
 		void Audit.objectAttributeChanged(
 			{ _id: room._id, name: room.name },
 			room.abacAttributes || [],
@@ -495,6 +506,10 @@ export class AbacService extends ServiceClass implements IAbacService {
 			actor,
 		);
 
+		if (updated) {
+			this.broadcastRoomUpdate(updated);
+		}
+
 		if (diffAttributeSets([previous[existingIndex]], [{ key, values }]).added) {
 			const next = previous.map((a, i) => (i === existingIndex ? { key, values } : a));
 			await this.onRoomAttributesChanged(room, next);
@@ -516,17 +531,16 @@ export class AbacService extends ServiceClass implements IAbacService {
 			await Rooms.unsetAbacAttributesById(rid);
 			void Audit.objectAttributesRemoved({ _id: room._id }, previous, actor);
 
+			this.broadcastRoomUpdate({ ...room, abacAttributes: undefined });
+
 			return;
 		}
 
 		await Rooms.removeAbacAttributeByRoomIdAndKey(rid, key);
-		void Audit.objectAttributeRemoved(
-			{ _id: room._id, name: room.name },
-			previous,
-			previous.filter((a) => a.key !== key),
-			'key-removed',
-			actor,
-		);
+		const next = previous.filter((a) => a.key !== key);
+		void Audit.objectAttributeRemoved({ _id: room._id, name: room.name }, previous, next, 'key-removed', actor);
+
+		this.broadcastRoomUpdate({ ...room, abacAttributes: next });
 	}
 
 	async addRoomAbacAttributeByKey(rid: string, key: string, values: string[], actor: AbacActor): Promise<void> {
@@ -549,6 +563,8 @@ export class AbacService extends ServiceClass implements IAbacService {
 
 		void Audit.objectAttributeChanged({ _id: room._id, name: room.name }, previous, next, 'key-added', actor);
 
+		this.broadcastRoomUpdate({ ...room, abacAttributes: next });
+
 		await this.onRoomAttributesChanged(room, next);
 	}
 
@@ -570,6 +586,11 @@ export class AbacService extends ServiceClass implements IAbacService {
 				'key-updated',
 				actor,
 			);
+
+			if (updated) {
+				this.broadcastRoomUpdate(updated);
+			}
+
 			if (diffAttributeSets([exists], [{ key, values }]).added) {
 				await this.onRoomAttributesChanged(room, updated?.abacAttributes || []);
 			}
@@ -582,13 +603,10 @@ export class AbacService extends ServiceClass implements IAbacService {
 		}
 
 		const updated = await Rooms.insertAbacAttributeIfNotExistsById(rid, key, values);
-		void Audit.objectAttributeChanged(
-			{ _id: room._id, name: room.name },
-			room.abacAttributes || [],
-			updated?.abacAttributes || [],
-			'key-added',
-			actor,
-		);
+		const nextAttributes = updated?.abacAttributes || [...(room.abacAttributes || []), { key, values }];
+		void Audit.objectAttributeChanged({ _id: room._id, name: room.name }, room.abacAttributes || [], nextAttributes, 'key-added', actor);
+
+		this.broadcastRoomUpdate({ ...room, abacAttributes: nextAttributes });
 
 		await this.onRoomAttributesChanged(room, updated?.abacAttributes || []);
 	}

ee/packages/abac/src/pdp/VirtruPDP.ts

@@ -491,7 +491,7 @@ export class VirtruPDP implements IPolicyDecisionPoint {
 				msg: 'User has no entity key for Virtru PDP evaluation, treating as non-compliant for all ABAC rooms',
 				userId: user._id,
 			});
-			return abacRooms as IRoom[];
+			return abacRooms;
 		}
 
 		const decisionRequests = abacRooms.map((room) => ({

ee/packages/abac/src/service.spec.ts

@@ -69,6 +69,9 @@ jest.mock('@rocket.chat/core-services', () => {
 		Room: {
 			removeUserFromRoom: jest.fn(),
 		},
+		api: {
+			broadcast: jest.fn(),
+		},
 	};
 });
 

ee/packages/abac/src/user-auto-removal.spec.ts

@@ -17,6 +17,9 @@ jest.mock('@rocket.chat/core-services', () => ({
 			await Subscriptions.removeByRoomIdAndUserId(roomId, user._id);
 		},
 	},
+	api: {
+		broadcast: jest.fn(),
+	},
 	MeteorError: class extends Error {},
 	isMeteorError: () => false,
 }));