refactor(api): migrate EE sessions/licenses/roles to typed HTTP methods - #41635
Conversation
|
|
Looks like this PR is ready to merge! 🎉 |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughMigrates enterprise license, role, and device-session endpoints from legacy route handlers to typed GET/POST registrations with AJV request and response schemas. Session information responses now explicitly project approved fields, excluding ChangesTyped REST endpoint migration
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/ee/server/api/licenses.ts`:
- Around line 129-152: Update the `licenses.validate` endpoint’s response schema
to declare the `403` forbidden response alongside its existing `200` and `400`
responses, matching the authorization behavior already configured by
`permissionsRequired: ['edit-privileged-setting']` and the corresponding
`licenses.add` endpoint.
- Around line 98-127: Add a 403 response schema to the licenses.add route’s
response declaration, using validateForbiddenErrorResponse to cover
permission-denied requests while preserving the existing 200 success and 400
validation schemas.
In `@apps/meteor/ee/server/api/roles.ts`:
- Around line 147-185: Remove the route-level license option from the
roles.update API definition so middleware does not reject protected-role updates
before action() executes. Preserve the existing in-action License.hasModule
check, including its !role?.protected condition, and leave the rest of the
update flow unchanged.
In `@apps/meteor/ee/server/api/sessions.ts`:
- Around line 213-247: Add the 400 response schema using
validateBadRequestErrorResponse to the response declarations for both
sessions/logout.me and sessions/logout, alongside their existing 200, 403, and
404 schemas, while leaving the handlers unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: e2b2ecf7-d850-4a0f-9534-a582e5da2d7f
📒 Files selected for processing (4)
apps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tspackages/core-typings/src/Ajv.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: 📦 Build Packages
- GitHub Check: cubic · AI code reviewer
- GitHub Check: Hacktron Security Check
- GitHub Check: CodeQL-Build
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
🧠 Learnings (3)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
🔇 Additional comments (13)
packages/core-typings/src/Ajv.ts (1)
22-32: LGTM!Also applies to: 70-73
apps/meteor/ee/server/api/licenses.ts (4)
1-58: LGTM!
60-97: LGTM!
153-166: LGTM!
115-120: 🗄️ Data Integrity & IntegrationNo change needed.
IAuditServerUserActorrequiresusernameandipas non-optional strings, andServerEvents.createAuditServerEventstores the actor/IP as-is; existing callers already default missing user/IP fields to empty strings.apps/meteor/ee/server/api/roles.ts (2)
91-100: LGTM!
101-145: LGTM!apps/meteor/ee/server/api/sessions.ts (6)
6-12: LGTM!
87-148: LGTM!
149-184: LGTM!
186-211: LGTM!
248-296: LGTM!
297-325: LGTM!
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## develop #41635 +/- ##
===========================================
+ Coverage 68.73% 68.76% +0.02%
===========================================
Files 4151 4155 +4
Lines 159513 159672 +159
Branches 27923 27985 +62
===========================================
+ Hits 109644 109797 +153
- Misses 44698 44701 +3
- Partials 5171 5174 +3
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
All reported issues were addressed across 4 files
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
ba17ad1 to
51851c7
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
apps/meteor/ee/server/api/sessions.ts (1)
149-164: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueLegacy in-handler
License.hasModulechecks are now dead code. Declaringlicense: [...]on the typed route delegates entitlement enforcement to middleware, so the retained in-action guards can no longer be reached.
apps/meteor/ee/server/api/sessions.ts#L149-L164: drop theLicense.hasModule('device-management')early return here and in the other five session routes that declarelicense: ['device-management'].apps/meteor/ee/server/api/roles.ts#L101-L145: drop theLicense.hasModule('custom-roles')throw inroles.create(note the separateroles.updateconcern where the in-action check intentionally differs for protected roles).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/sessions.ts` around lines 149 - 164, Remove the unreachable License.hasModule('device-management') early-return guards from all six session routes declaring license: ['device-management'] in apps/meteor/ee/server/api/sessions.ts. Also remove the License.hasModule('custom-roles') throw from roles.create in apps/meteor/ee/server/api/roles.ts, while preserving the distinct roles.update check for protected roles.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@apps/meteor/ee/server/api/sessions.ts`:
- Around line 149-164: Remove the unreachable
License.hasModule('device-management') early-return guards from all six session
routes declaring license: ['device-management'] in
apps/meteor/ee/server/api/sessions.ts. Also remove the
License.hasModule('custom-roles') throw from roles.create in
apps/meteor/ee/server/api/roles.ts, while preserving the distinct roles.update
check for protected roles.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: b2efb94f-c2d2-4c72-9a01-ca68371cb698
📒 Files selected for processing (4)
apps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tspackages/core-typings/src/Ajv.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (6)
- GitHub Check: 🔎 Code Check / TypeScript
- GitHub Check: 🔎 Code Check / Code Lint
- GitHub Check: 🔨 Test Storybook / Test Storybook
- GitHub Check: 🔨 Test Unit / Unit Tests
- GitHub Check: 📦 Meteor Build (coverage)
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.ts
🧠 Learnings (3)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.ts
🔇 Additional comments (9)
apps/meteor/ee/server/api/licenses.ts (3)
104-133: Missing403response schema on apermissionsRequired-gated route — same concern as flagged previously;licenses.adddeclares only200/400while permission denial yields a 403.
135-157: Missing403response schema —licenses.validateshares the gap already raised forlicenses.add.
18-64: LGTM!Also applies to: 66-102, 159-172
apps/meteor/ee/server/api/roles.ts (2)
147-185: Route-levellicensegate conflicts with the in-action protected-role exception — previously flagged; middleware rejects before!role?.protectedcan allow the update.
91-99: LGTM!apps/meteor/ee/server/api/sessions.ts (3)
213-246: Missing400response schema for thebody-validated route — previously flagged for both logout endpoints.
326-359: Missing400response schema — same gap assessions/logout.me, already raised.
87-147: LGTM!Also applies to: 186-211, 248-295, 297-324
packages/core-typings/src/Ajv.ts (1)
70-73: 🗄️ Data Integrity & IntegrationNo refs require
DeviceManagementSession/DeviceManagementPopulatedSessionregistration.The licenses endpoint uses
LicenseInfoandCloud.ICloudSyncAnnouncementinline, and the only generated#/components/schemas/...ref here points toIMeApiUser, so these component-key concerns don’t apply.
51851c7 to
dd74e07
Compare
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
apps/meteor/ee/server/api/roles.ts (1)
112-115: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueRedundant in-action module check.
With
license: ['custom-roles']enforced by the middleware, thisLicense.hasModuleguard inroles.createis unreachable; dropping it keeps a single source of truth for the gate.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/roles.ts` around lines 112 - 115, Remove the License.hasModule('custom-roles') guard from the roles.create action function, relying on the middleware’s license enforcement as the single module gate. Preserve the action’s remaining behavior and error handling.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/ee/server/api/licenses.ts`:
- Around line 86-100: In the license response flow, narrow the try/catch around
JSON.parse of Cloud_Sync_Announcement_Payload only. Move hasPermissionAsync and
the API.v1.success response construction outside the catch so serialization or
schema-validation errors propagate, while parse failures still log and fall back
to the license-only response.
In `@apps/meteor/ee/server/api/roles.ts`:
- Around line 101-110: Add a 403 response entry using
validateForbiddenErrorResponse to the response schemas for both license-gated
routes, roles.create and the route beginning around the second referenced block.
Preserve the existing 200 and 400 response declarations.
In `@apps/meteor/ee/server/api/sessions.ts`:
- Around line 204-209: Sanitize the response in the sessions/info handler before
calling API.v1.success: exclude loginToken from the ISession returned by
Sessions.findOneBySessionIdAndUserId, either by projecting only
DeviceManagementSession fields in the query or explicitly constructing that
allowed-field object. Preserve the existing not-found behavior and return only
the declared session fields.
---
Nitpick comments:
In `@apps/meteor/ee/server/api/roles.ts`:
- Around line 112-115: Remove the License.hasModule('custom-roles') guard from
the roles.create action function, relying on the middleware’s license
enforcement as the single module gate. Preserve the action’s remaining behavior
and error handling.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ba1b3578-31dc-4d39-9bcd-876ac32f86d5
📒 Files selected for processing (6)
apps/meteor/client/hooks/useLicenseLimitsByBehavior.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tspackages/core-typings/src/Ajv.tspackages/core-typings/src/license/LicenseInfo.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: Hacktron Security Check
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.tspackages/core-typings/src/license/LicenseInfo.tspackages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
🧠 Learnings (6)
📚 Learning: 2026-02-10T16:32:42.586Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 38528
File: apps/meteor/client/startup/roles.ts:14-14
Timestamp: 2026-02-10T16:32:42.586Z
Learning: In Rocket.Chat's Meteor client code, DDP streams use EJSON and Date fields arrive as Date objects; do not manually construct new Date() in stream handlers (for example, in sdk.stream()). Only REST API responses return plain JSON where dates are strings, so implement explicit conversion there if needed. Apply this guidance to all TypeScript files under apps/meteor/client to ensure consistent date handling in DDP streams and REST responses.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.ts
📚 Learning: 2026-05-11T20:30:35.265Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 40480
File: apps/meteor/client/meteor/startup/accounts.ts:59-61
Timestamp: 2026-05-11T20:30:35.265Z
Learning: In Rocket.Chat’s Meteor client code, when calling `dispatchToastMessage` with `{ type: 'error' }`, pass the raw caught error object as `message` without manual normalization. `dispatchToastMessage` is designed to accept `message: unknown` for error toasts, so avoid converting errors to strings (e.g., `String(error)`) or extracting `error.message` before passing them.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.tspackages/core-typings/src/license/LicenseInfo.tspackages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.tspackages/core-typings/src/license/LicenseInfo.tspackages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
📚 Learning: 2026-04-14T21:10:31.855Z
Learnt from: dougfabris
Repo: RocketChat/Rocket.Chat PR: 36292
File: apps/meteor/client/hooks/useHasValidLocationHash.ts:7-12
Timestamp: 2026-04-14T21:10:31.855Z
Learning: When reviewing files in apps/meteor/client/hooks/, do not treat JSDoc-style comments on React hooks (especially exported hooks) as a violation of any “avoid code comments in implementation” guideline. It’s acceptable to use JSDoc to document the public API of exported hooks (e.g., parameter/return types, intended usage), as long as it documents behavior/contracts rather than adding narrative implementation comments.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/client/hooks/useLicenseLimitsByBehavior.tspackages/core-typings/src/license/LicenseInfo.tspackages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tsapps/meteor/ee/server/api/licenses.ts
🔇 Additional comments (7)
apps/meteor/ee/server/api/licenses.ts (1)
104-113: Missing403response schema on thepermissionsRequired-gated license routes.
licenses.addandlicenses.validategate onedit-privileged-settingbut declare only200/400.Also applies to: 135-144
apps/meteor/ee/server/api/roles.ts (1)
147-157: Route-levellicense: ['custom-roles']blocks the protected-role update path.The in-action check at Lines 167-169 deliberately allows updating protected roles without the module; the middleware-level gate rejects those requests first.
apps/meteor/ee/server/api/sessions.ts (2)
219-223: Missing400response schema on thebody-validated logout routes.
sessions/logout.meandsessions/logoutvalidatebody: isSessionsPropsbut declare no400.Also applies to: 334-338
149-184: LGTM!Also applies to: 248-295
apps/meteor/client/hooks/useLicenseLimitsByBehavior.ts (1)
26-26: LGTM!packages/core-typings/src/Ajv.ts (1)
70-73: 🗄️ Data Integrity & IntegrationCheck Typia’s emitted OpenAPI component schemas before relying on these refs. The generated schemas must contain named entries for
DeviceManagementSession,DeviceManagementPopulatedSession,LicenseInfo, andICloudSyncAnnouncement, and they must not be strict enough to reject the injectedsuccessfield when validated throughallOf; if either emitted contract is missing or too strict, switch to an inlined object schema that allowssuccess.packages/core-typings/src/license/LicenseInfo.ts (1)
11-12: 🗄️ Data Integrity & IntegrationNo change needed.
LicenseInfo.limitsis only indexed from this PR path with optional-chain handling inuseLicenseLimitsByBehavior.ts.> Likely an incorrect or invalid review comment.
c741e42 to
51ae842
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
apps/meteor/ee/server/api/roles.ts (1)
101-111: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winMissing
403response schema forroles.create's license-gated route.
roles.createdeclareslicense: ['custom-roles'](Line 105), which can be rejected by middleware beforeaction()runs, butresponseonly declares200/400(Lines 107-110) andvalidateForbiddenErrorResponseisn't imported. This is the same gap flagged in a prior review round and appears unresolved for this route (it is now moot forroles.updatesince that route's license gate was removed).🔧 Proposed fix
-import { ajv, validateBadRequestErrorResponse } from '`@rocket.chat/rest-typings`'; +import { ajv, validateBadRequestErrorResponse, validateForbiddenErrorResponse } from '`@rocket.chat/rest-typings`';response: { + 403: validateForbiddenErrorResponse, },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@apps/meteor/ee/server/api/roles.ts` around lines 101 - 111, Add the missing forbidden-response schema for the license-gated roles.create route by importing validateForbiddenErrorResponse and including a 403 entry in its response configuration alongside the existing 200 and 400 schemas.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/ee/server/api/sessions.ts`:
- Around line 113-137: Update sessionInfoResponseSchema and
sessionInfoAdminResponseSchema so success is declared within the same object as
the referenced session properties, avoiding the allOf sibling conflict with
additionalProperties: false. Preserve the required true-valued success field and
each route’s existing DeviceManagementSession or
DeviceManagementPopulatedSession schema.
---
Duplicate comments:
In `@apps/meteor/ee/server/api/roles.ts`:
- Around line 101-111: Add the missing forbidden-response schema for the
license-gated roles.create route by importing validateForbiddenErrorResponse and
including a 403 entry in its response configuration alongside the existing 200
and 400 schemas.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: cf28df94-3572-4238-9bd7-10d4f1b06b68
📒 Files selected for processing (4)
apps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/sessions.tspackages/core-typings/src/Ajv.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (4)
- GitHub Check: 📦 Build Packages
- GitHub Check: CodeQL-Build
- GitHub Check: Hacktron Security Check
- GitHub Check: CodeQL-Build
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/sessions.ts
🧠 Learnings (3)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/sessions.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/sessions.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
packages/core-typings/src/Ajv.tsapps/meteor/ee/server/api/roles.tsapps/meteor/ee/server/api/licenses.tsapps/meteor/ee/server/api/sessions.ts
🔇 Additional comments (4)
packages/core-typings/src/Ajv.ts (1)
22-22: LGTM!Also applies to: 68-69
apps/meteor/ee/server/api/licenses.ts (1)
1-176: LGTM!apps/meteor/ee/server/api/roles.ts (1)
91-99: LGTM!Also applies to: 147-186
apps/meteor/ee/server/api/sessions.ts (1)
6-12: LGTM!Also applies to: 87-112, 139-147, 149-184, 186-221, 223-257, 259-306, 308-335, 337-373
51ae842 to
cd4fd5d
Compare
Convert the 12 remaining API.v1.addRoute endpoints in ee/server/api/ sessions.ts, licenses.ts and roles.ts to typed API.v1.get/post with AJV request/response validation (keep-manual: the Endpoints types already exist). - Register DeviceManagementSession/DeviceManagementPopulatedSession in core-typings so session responses use strong $ref schemas. sessions/info projects to DeviceManagementSession explicitly so the raw ISession loginToken never leaks. - licenses.info validates license/announcement as open objects: LicenseInfo is a large, loosely-matching shape (branded module names, partial limits, nested ILicenseV3) that a strict $ref can't validate without fighting the type. - Declare every returned status code: 403 for permission-gated licenses.add/ validate, 400 for the body-validated session logout routes. - roles.update drops the route-level custom-roles license gate so protected-role updates (allowed in-action without the module) aren't rejected by middleware. - validateParams -> query/body; licenses.add uses isLicensesAddProps instead of the inline check(); roles drops the now-dead internal re-validation.
cd4fd5d to
9d1f31e
Compare
sampaiodiego
added
the
stat: QA assured
dionisio-bot
Bot
added
the
stat: ready to merge
2 participants
Proposal
Migrates the 12 remaining
API.v1.addRouteendpoints in the EE misc files to the typed router (API.v1.get/post) with AJV request/response validation. Keep-manual pattern — theEndpointstypes already exist (declare modulein sessions/roles,LicensesEndpointsin rest-typings).Files
ee/server/api/sessions.ts(6) — device-management list/info/logout (+admin, 2FA-gated).ee/server/api/licenses.ts(4) — info/add/validate/maxActiveUsers.ee/server/api/roles.ts(2) — create/update.Notes
DeviceManagementSession,DeviceManagementPopulatedSession,LicenseInfo,ICloudSyncAnnouncementincore-typings/Ajv.tsso responses use strong$refschemas (no weak{ type: 'object' }).IRolewas already registered.licenses.validate's object-shaped 400 gets an explicit schema.licenses.addreplaces the inlinecheck()withbody: isLicensesAddProps;roles.create/updatedrop the now-dead internal re-validation (the body schema runs first). License/permission/2FA gates unchanged.twoFactorRequired/permissionsRequired/licenseoptions preserved.No changeset (pure conversion).
ARCH-2314
Summary by CodeRabbit