fix: team conversion permissions checked incorrectly

[julio-rocketchat]

Proposed changes (including videos or screenshots)

Aligns channels.convertToTeam and teams.create with the permission-checking pattern already used by groups.convertToTeam - permissions are now validated against the resolved room in all cases, rather than only for some input variants. No functional changes for existing valid use cases.

Issue(s)

VLN-488

Steps to test or reproduce

Further comments

Summary by CodeRabbit

• Bug Fixes
  • Improved authorization when converting a channel to a team and when creating a team from an existing room, preventing unauthorized team creation and room takeover attempts.
  • Requests without the required permissions now consistently return an access-denied response.
• Tests
  • Added end-to-end coverage for blocked channel-to-team conversion when permissions are missing.
  • Added end-to-end coverage ensuring creating a team from an existing room fails when the requester lacks ownership/rights, without linking team details.

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

🦋 Changeset detected

Latest commit: 998aed1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Caution

Review failed

The head commit changed during the review from 405bb7d to 998aed1.

Walkthrough

This PR enforces combined create-team and edit-room checks when converting a channel to a team or creating a team from an existing room. It also adds end-to-end coverage and a patch changeset.

Changes

Room permission enforcement

Layer / File(s)	Summary
convertToTeam permission gate apps/meteor/server/api/v1/channels.ts	Resolves the room first, then checks create-team and edit-room together on that room and returns API.v1.forbidden() when the check fails.
TeamService.create ownership guard apps/meteor/server/services/team/service.ts	Adds an early room.id guard that throws error-no-owner-channel unless both permissions are present.
End-to-end tests and changeset apps/meteor/tests/end-to-end/api/channels.ts, apps/meteor/tests/end-to-end/api/teams.ts, .changeset/quiet-teams-guard.md	Adds tests for the unauthorized conversion and room-hijack cases, plus a patch changeset entry.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested labels

type: bug

Suggested reviewers

KevLehman, juliajforesti

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main fix: correcting team conversion permission checks.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Warning

Review ran into problems

🔥 Problems

Errors were encountered while retrieving linked issues.

Errors (1)

• VLN-488: Request failed with status code 401

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.19%. Comparing base (31249c3) to head (998aed1).
⚠️ Report is 3 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41206      +/-   ##
===========================================
+ Coverage    69.17%   69.19%   +0.02%     
===========================================
  Files         3651     3651              
  Lines       142782   142784       +2     
  Branches     25612    25595      -17     
===========================================
+ Hits         98764    98800      +36     
+ Misses       39728    39693      -35     
- Partials      4290     4291       +1     

Flag	Coverage Δ
e2e	59.37% <ø> (+0.02%)	⬆️
e2e-api	50.32% <100.00%> (+<0.01%)	⬆️
unit	70.28% <ø> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cubic-dev-ai]

No issues found across 5 files

_{Re-trigger cubic}

[julio-rocketchat]

/backport 8.6.1

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.6.1-41206
git cherry-pick 175a19c4151f41910499ef37df54f58022276d12
// solve the conflict
git push

after that just run /backport 8.6.1 again

[julio-rocketchat]

/backport 8.6.1

[julio-rocketchat]

/backport 8.5.2

[dionisio-bot]

Pull request #41276 added to Project: "Patch 8.6.1"

[dionisio-bot]

Pull request #41280 added to Project: "Patch 8.3.7"

[julio-rocketchat]

/backport 8.2.7

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.2.7-41206
git cherry-pick 175a19c4151f41910499ef37df54f58022276d12
// solve the conflict
git push

after that just run /backport 8.2.7 again

[julio-rocketchat]

/backport 8.2.7

[dionisio-bot]

Pull request #41288 added to Project: "Patch 8.2.7"

[julio-rocketchat]

/backport 8.1.7

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.1.7-41206
git cherry-pick 175a19c4151f41910499ef37df54f58022276d12
// solve the conflict
git push

after that just run /backport 8.1.7 again

[julio-rocketchat]

/backport 8.1.7

[julio-rocketchat]

/backport 8.0.8

[dionisio-bot]

Pull request #41289 added to Project: "Patch 8.1.7"

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-8.0.8-41206
git cherry-pick 175a19c4151f41910499ef37df54f58022276d12
// solve the conflict
git push

after that just run /backport 8.0.8 again

[julio-rocketchat]

/backport 8.0.8

[dionisio-bot]

Pull request #41290 added to Project: "Patch 8.0.8"

[julio-rocketchat]

/backport 7.10.14

[dionisio-bot]

Sorry, I couldn't do that backport because of conflicts. Could you please solve them?

you can do so by running the following commands:

git fetch
git checkout backport-7.10.14-41206
git cherry-pick 175a19c4151f41910499ef37df54f58022276d12
// solve the conflict
git push

after that just run /backport 7.10.14 again

[julio-rocketchat]

/backport 7.10.14

[dionisio-bot]

Pull request #41291 added to Project: "Patch 7.10.14"