feat: no egress for offline licenses

.changeset/offline-license-no-egress.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': minor
+'@rocket.chat/license': minor
+---
+
+Adds support for the `offline` license flag, suppressing every outbound connection to Rocket.Chat Cloud services and the Push Gateway at its source, so air-gapped workspaces never initiate calls that would violate their security compliance.

apps/meteor/ee/server/apps/appRequestsCron.ts

@@ -1,4 +1,5 @@
 import { cronJobs } from '@rocket.chat/cron';
+import { License } from '@rocket.chat/license';
 import type { ExtendedFetchOptions } from '@rocket.chat/server-fetch';
 
 import { appRequestNotififyForUsers } from './marketplace/appRequestNotifyUsers';
@@ -8,6 +9,10 @@ import { settings } from '../../../server/settings';
 
 const appsNotifyAppRequests = async function _appsNotifyAppRequests() {
 	try {
+		if (License.hasOfflineLicense()) {
+			return;
+		}
+
 		const installedApps = await Apps.installedApps({ enabled: true });
 		if (!installedApps || installedApps.length === 0) {
 			return;

apps/meteor/ee/server/apps/communication/rest.ts

@@ -17,6 +17,7 @@ import { registerAppLogsExportHandler } from './endpoints/appLogsExportHandler';
 import { registerAppLogsHandler } from './endpoints/appLogsHandler';
 import { registerAppsCountHandler } from './endpoints/appsCountHandler';
 import { Info } from '../../../../app/utils/rocketchat.info';
+import { CloudOfflineLicenseError } from '../../../../lib/errors/CloudOfflineLicenseError';
 import { API } from '../../../../server/api';
 import type { APIClass } from '../../../../server/api/ApiClass';
 import { getUploadFormData } from '../../../../server/api/lib/getUploadFormData';
@@ -96,6 +97,13 @@ export class AppsRestApi {
 		const manager = this._manager;
 
 		const handleError = (message: string, err: any) => {
+			// Offline (air-gapped) licenses suppress marketplace requests at the source;
+			// report the real reason instead of a generic connectivity failure.
+			if (err instanceof CloudOfflineLicenseError) {
+				orchestrator.getRocketChatLogger().info({ msg: err.message });
+				return API.v1.failure({ error: err.message });
+			}
+
 			// when there is no `response` field in the error, it means the request
 			// couldn't even make it to the server
 			if (!err.hasOwnProperty('response')) {
@@ -149,7 +157,7 @@ export class AppsRestApi {
 						const apps = await fetchMarketplaceApps({ ...(this.queryParams.isAdminUser === 'false' && { endUserID: this.user._id }) });
 						return API.v1.success(apps);
 					} catch (err) {
-						if (err instanceof MarketplaceConnectionError) {
+						if (err instanceof MarketplaceConnectionError || err instanceof CloudOfflineLicenseError) {
 							return handleError('Unable to access Marketplace. Does the server has access to the internet?', err);
 						}
 
@@ -178,7 +186,7 @@ export class AppsRestApi {
 						return API.v1.success(categories);
 					} catch (err) {
 						orchestrator.getRocketChatLogger().error({ msg: 'Error fetching categories from Marketplace:', err });
-						if (err instanceof MarketplaceConnectionError) {
+						if (err instanceof MarketplaceConnectionError || err instanceof CloudOfflineLicenseError) {
 							return handleError('Unable to access Marketplace. Does the server has access to the internet?', err);
 						}
 

apps/meteor/ee/server/apps/cron.ts

@@ -1,6 +1,7 @@
 import type { ProxiedApp } from '@rocket.chat/apps/dist/server/ProxiedApp';
 import { AppStatus } from '@rocket.chat/apps-engine/definition/AppStatus';
 import { cronJobs } from '@rocket.chat/cron';
+import { License } from '@rocket.chat/license';
 import { Settings, Users } from '@rocket.chat/models';
 
 import { Apps } from './orchestrator';
@@ -75,6 +76,10 @@ const notifyAdminsAboutRenewedApps = async function _notifyAdminsAboutRenewedApp
 };
 
 const appsUpdateMarketplaceInfo = async function _appsUpdateMarketplaceInfo() {
+	if (License.hasOfflineLicense()) {
+		return;
+	}
+
 	const token = await getWorkspaceAccessToken();
 	const workspaceIdSetting = await Settings.getValueById('Cloud_Workspace_Id');
 

apps/meteor/ee/server/apps/marketplace/MarketplaceAPIClient.ts

@@ -1,6 +1,8 @@
+import { License } from '@rocket.chat/license';
 import { type ExtendedFetchOptions, Response, serverFetch } from '@rocket.chat/server-fetch';
 
 import { isTesting } from './isTesting';
+import { CloudOfflineLicenseError } from '../../../../lib/errors/CloudOfflineLicenseError';
 
 export class MarketplaceAPIClient {
 	#fetchStrategy: (input: string, options?: ExtendedFetchOptions, allowSelfSignedCerts?: boolean) => Promise<Response>;
@@ -41,6 +43,12 @@ export class MarketplaceAPIClient {
 	}
 
 	public fetch(input: string, options?: ExtendedFetchOptions, allowSelfSignedCerts?: boolean): ReturnType<typeof serverFetch> {
+		if (License.hasOfflineLicense()) {
+			return Promise.reject(
+				new CloudOfflineLicenseError('Marketplace connectivity is disabled by the offline license applied to this workspace'),
+			);
+		}
+
 		if (!input.startsWith('http://') && !input.startsWith('https://')) {
 			input = this.getMarketplaceUrl().concat(!input.startsWith('/') ? '/' : '', input);
 		}

apps/meteor/ee/server/apps/marketplace/fetchMarketplaceApps.ts

@@ -3,6 +3,7 @@ import * as z from 'zod';
 
 import { getMarketplaceHeaders } from './getMarketplaceHeaders';
 import { MarketplaceAppsError, MarketplaceConnectionError, MarketplaceUnsupportedVersionError } from './marketplaceErrors';
+import { CloudOfflineLicenseError } from '../../../../lib/errors/CloudOfflineLicenseError';
 import { getWorkspaceAccessToken } from '../../../../server/lib/cloud';
 import { settings } from '../../../../server/settings';
 import { Apps } from '../orchestrator';
@@ -157,6 +158,12 @@ export async function fetchMarketplaceApps({ endUserID }: FetchMarketplaceAppsPa
 			},
 		});
 	} catch (error) {
+		// Offline (air-gapped) licenses reject before any request is made; keep the
+		// typed error so the REST layer can report the real reason instead of a
+		// generic connectivity failure.
+		if (error instanceof CloudOfflineLicenseError) {
+			throw error;
+		}
 		throw new MarketplaceConnectionError('Marketplace_Bad_Marketplace_Connection');
 	}
 

apps/meteor/ee/server/apps/marketplace/fetchMarketplaceCategories.ts

@@ -3,6 +3,7 @@ import * as z from 'zod';
 
 import { getMarketplaceHeaders } from './getMarketplaceHeaders';
 import { MarketplaceAppsError, MarketplaceConnectionError, MarketplaceUnsupportedVersionError } from './marketplaceErrors';
+import { CloudOfflineLicenseError } from '../../../../lib/errors/CloudOfflineLicenseError';
 import { getWorkspaceAccessToken } from '../../../../server/lib/cloud';
 import { settings } from '../../../../server/settings';
 import { Apps } from '../orchestrator';
@@ -41,6 +42,12 @@ export async function fetchMarketplaceCategories(): Promise<AppCategory[]> {
 			allowList: settings.get<string>('SSRF_Allowlist'),
 		});
 	} catch (error) {
+		// Offline (air-gapped) licenses reject before any request is made; keep the
+		// typed error so the REST layer can report the real reason instead of a
+		// generic connectivity failure.
+		if (error instanceof CloudOfflineLicenseError) {
+			throw error;
+		}
 		throw new MarketplaceConnectionError('Marketplace_Bad_Marketplace_Connection');
 	}
 

apps/meteor/ee/server/lib/license/startup.ts

@@ -8,6 +8,7 @@ import moment from 'moment';
 import { getAppCount } from './lib/getAppCount';
 import { callbacks } from '../../../../server/lib/callbacks';
 import { syncWorkspace } from '../../../../server/lib/cloud/syncWorkspace';
+import { SystemLogger } from '../../../../server/lib/logger/system';
 import { notifyOnSettingChangedById } from '../../../../server/lib/notifyListener';
 import { settings } from '../../../../server/settings';
 
@@ -125,6 +126,15 @@ export const startLicense = async () => {
 				}
 			}
 
+			License.onInstall(() => {
+				if (License.hasOfflineLicense()) {
+					// startup level so it is visible at the default Log_Level, like 'License installed'
+					SystemLogger.startup(
+						'Offline license detected: outbound connections to Rocket.Chat Cloud services and the Rocket.Chat Push Gateway are disabled',
+					);
+				}
+			});
+
 			// After the current license is already loaded, watch the setting value to react to new licenses being applied.
 			settings.change<string>('Enterprise_License', (license) => applyLicenseOrRemove(license, true));
 

apps/meteor/lib/errors/CloudOfflineLicenseError.ts

@@ -0,0 +1,5 @@
+import { CloudWorkspaceError } from './CloudWorkspaceError';
+
+export class CloudOfflineLicenseError extends CloudWorkspaceError {
+	override name = CloudOfflineLicenseError.name;
+}

apps/meteor/server/lib/cloud/connectWorkspace.ts

@@ -1,6 +1,7 @@
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
 import { getRedirectUri } from './getRedirectUri';
+import { assertNotOfflineLicense } from './offlineLicense';
 import { saveRegistrationData } from './saveRegistrationData';
 import { CloudWorkspaceConnectionError } from '../../../lib/errors/CloudWorkspaceConnectionError';
 import { settings } from '../../settings';
@@ -47,6 +48,8 @@ const fetchRegistrationDataPayload = async ({
 };
 
 export async function connectWorkspace(token: string) {
+	assertNotOfflineLicense();
+
 	if (!token) {
 		throw new CloudWorkspaceConnectionError('Invalid registration token');
 	}

apps/meteor/server/lib/cloud/finishOAuthAuthorization.ts

@@ -4,10 +4,13 @@ import { Meteor } from 'meteor/meteor';
 
 import { getRedirectUri } from './getRedirectUri';
 import { userScopes } from './oauthScopes';
+import { assertNotOfflineLicense } from './offlineLicense';
 import { settings } from '../../settings';
 import { SystemLogger } from '../logger/system';
 
 export async function finishOAuthAuthorization(code: string, state: string) {
+	assertNotOfflineLicense();
+
 	if (settings.get<string>('Cloud_Workspace_Registration_State') !== state) {
 		throw new Meteor.Error('error-invalid-state', 'Invalid state provided', {
 			method: 'cloud:finishOAuthAuthorization',

apps/meteor/server/lib/cloud/getConfirmationPoll.ts

@@ -1,10 +1,13 @@
 import type { CloudConfirmationPollData } from '@rocket.chat/core-typings';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
+import { assertNotOfflineLicense } from './offlineLicense';
 import { settings } from '../../settings';
 import { SystemLogger } from '../logger/system';
 
 export async function getConfirmationPoll(deviceCode: string): Promise<CloudConfirmationPollData> {
+	assertNotOfflineLicense();
+
 	try {
 		const cloudUrl = settings.get<string>('Cloud_Url');
 		const response = await fetch(`${cloudUrl}/api/v2/register/workspace/poll`, {

apps/meteor/server/lib/cloud/getOAuthAuthorizationUrl.ts

@@ -3,11 +3,14 @@ import { Random } from '@rocket.chat/random';
 
 import { getRedirectUri } from './getRedirectUri';
 import { userScopes } from './oauthScopes';
+import { assertNotOfflineLicense } from './offlineLicense';
 import { settings } from '../../settings';
 import { updateAuditedBySystem } from '../../settings/lib/auditedSettingUpdates';
 import { notifyOnSettingChangedById } from '../notifyListener';
 
 export async function getOAuthAuthorizationUrl() {
+	assertNotOfflineLicense();
+
 	const state = Random.id();
 
 	await updateAuditedBySystem({

apps/meteor/server/lib/cloud/getWorkspaceAccessToken.ts

@@ -1,4 +1,5 @@
 import type { IWorkspaceCredentials } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
 import { WorkspaceCredentials } from '@rocket.chat/models';
 
 import { getWorkspaceAccessTokenWithScope } from './getWorkspaceAccessTokenWithScope';
@@ -26,6 +27,10 @@ export async function getWorkspaceAccessToken(forceNew = false, scope = '', save
 		return '';
 	}
 
+	if (License.hasOfflineLicense()) {
+		return '';
+	}
+
 	// Note: If no scope is given, it means we should assume the default scope, we store the default scopes
 	//       in the global variable workspaceScopes.
 	if (scope === '') {

apps/meteor/server/lib/cloud/getWorkspaceAccessTokenWithScope.ts

@@ -1,3 +1,4 @@
+import { License } from '@rocket.chat/license';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
 import { getRedirectUri } from './getRedirectUri';
@@ -31,6 +32,10 @@ export async function getWorkspaceAccessTokenWithScope({
 		return tokenResponse;
 	}
 
+	if (License.hasOfflineLicense()) {
+		return tokenResponse;
+	}
+
 	// eslint-disable-next-line @typescript-eslint/naming-convention
 	const client_id = settings.get<string>('Cloud_Workspace_Client_Id');
 	if (!client_id) {

apps/meteor/server/lib/cloud/offlineLicense.ts

@@ -0,0 +1,13 @@
+import { License } from '@rocket.chat/license';
+
+import { CloudOfflineLicenseError } from '../../../lib/errors/CloudOfflineLicenseError';
+
+/**
+ * Guard for interactive cloud flows (registration, OAuth, billing). Background
+ * jobs should instead skip silently by checking {@link License.hasOfflineLicense}.
+ */
+export function assertNotOfflineLicense(): void {
+	if (License.hasOfflineLicense()) {
+		throw new CloudOfflineLicenseError('Cloud connectivity is disabled by the offline license applied to this workspace');
+	}
+}

apps/meteor/server/lib/cloud/registerPreIntentWorkspaceWizard.ts

@@ -1,4 +1,5 @@
 import type { IUser } from '@rocket.chat/core-typings';
+import { License } from '@rocket.chat/license';
 import { Users } from '@rocket.chat/models';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
@@ -7,6 +8,10 @@ import { settings } from '../../settings';
 import { SystemLogger } from '../logger/system';
 
 export async function registerPreIntentWorkspaceWizard(): Promise<boolean> {
+	if (License.hasOfflineLicense()) {
+		return false;
+	}
+
 	const firstUser = (await Users.getOldest({ projection: { name: 1, emails: 1 } })) as IUser | undefined;
 	const email = firstUser?.emails?.find((address) => address)?.address;
 
@@ -16,6 +21,12 @@ export async function registerPreIntentWorkspaceWizard(): Promise<boolean> {
 
 	const regInfo = await buildWorkspaceRegistrationData(email);
 
+	// Re-validated at dispatch time: an offline license applied while the
+	// registration data was being built must still suppress the request.
+	if (License.hasOfflineLicense()) {
+		return false;
+	}
+
 	try {
 		const cloudUrl = settings.get<string>('Cloud_Url');
 		const response = await fetch(`${cloudUrl}/api/v2/register/workspace/pre-intent`, {

apps/meteor/server/lib/cloud/startRegisterWorkspace.ts

@@ -2,6 +2,7 @@ import { Settings } from '@rocket.chat/models';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
 import { buildWorkspaceRegistrationData } from './buildRegistrationData';
+import { assertNotOfflineLicense } from './offlineLicense';
 import { retrieveRegistrationStatus } from './retrieveRegistrationStatus';
 import { syncWorkspace } from './syncWorkspace';
 import { settings } from '../../settings';
@@ -10,6 +11,8 @@ import { SystemLogger } from '../logger/system';
 import { notifyOnSettingChangedById } from '../notifyListener';
 
 export async function startRegisterWorkspace(resend = false) {
+	assertNotOfflineLicense();
+
 	const { workspaceRegistered } = await retrieveRegistrationStatus();
 	if (workspaceRegistered || process.env.TEST_MODE) {
 		await syncWorkspace();

apps/meteor/server/lib/cloud/startRegisterWorkspaceSetupWizard.ts

@@ -2,10 +2,13 @@ import type { CloudRegistrationIntentData } from '@rocket.chat/core-typings';
 import { serverFetch as fetch } from '@rocket.chat/server-fetch';
 
 import { buildWorkspaceRegistrationData } from './buildRegistrationData';
+import { assertNotOfflineLicense } from './offlineLicense';
 import { settings } from '../../settings';
 import { SystemLogger } from '../logger/system';
 
 export async function startRegisterWorkspaceSetupWizard(resend = false, email: string): Promise<CloudRegistrationIntentData> {
+	assertNotOfflineLicense();
+
 	const regInfo = await buildWorkspaceRegistrationData(email);
 
 	let payload;

apps/meteor/server/lib/cloud/supportedVersionsToken/supportedVersionsToken.ts

@@ -114,6 +114,12 @@ const getSupportedVersionsFromCloud = async () => {
 
 	const headers = await generateWorkspaceBearerHttpHeader();
 
+	// Re-validated at dispatch time: an offline license applied while this async
+	// operation was in flight must still suppress the request.
+	if (License.hasOfflineLicense()) {
+		return { success: true, result: undefined } as const;
+	}
+
 	const response = await handleResponse<SupportedVersions>(
 		fetch(releaseEndpoint, {
 			headers,
@@ -141,7 +147,10 @@ const getSupportedVersionsToken = async (retry = 0) => {
 	 * Gets the latest version
 	 * return the token
 	 */
-	const [versionsFromLicense, cloudResponse] = await Promise.all([License.getLicense(), getSupportedVersionsFromCloud()]);
+	const [versionsFromLicense, cloudResponse] = await Promise.all([
+		License.getLicense(),
+		License.hasOfflineLicense() ? ({ success: true, result: undefined } as const) : getSupportedVersionsFromCloud(),
+	]);
 
 	const supportedVersions = await supportedVersionsChooseLatest(
 		supportedVersionsFromBuild,

apps/meteor/server/lib/cloud/syncWorkspace/index.ts

@@ -1,3 +1,5 @@
+import { License } from '@rocket.chat/license';
+
 import { CloudWorkspaceRegistrationError } from '../../../../lib/errors/CloudWorkspaceRegistrationError';
 import { SystemLogger } from '../../logger/system';
 import { CloudWorkspaceAccessTokenEmptyError, CloudWorkspaceAccessTokenError, isAbortError } from '../getWorkspaceAccessToken';
@@ -12,6 +14,12 @@ import { getCachedSupportedVersionsToken } from '../supportedVersionsToken/suppo
  * @throws {Error} - If there is an unexpected error during sync like a network error
  */
 export async function syncWorkspace() {
+	if (License.hasOfflineLicense()) {
+		SystemLogger.debug({ msg: 'Skipping cloud sync: workspace has an offline license', function: 'syncWorkspace' });
+		await getCachedSupportedVersionsToken.reset();
+		return;
+	}
+
 	try {
 		await announcementSync();
 		await syncCloudData();