fix(api)!: return 403 for authorization failures, reserve 401 for missing session by surjeetkumar8006 · Pull Request #41658 · RocketChat/Rocket.Chat

surjeetkumar8006 · 2026-08-02T11:15:13Z

Proposal
Fixes REST API HTTP status code semantics for authentication vs authorization failures and aligns validation errorType naming consistency across the typed router, resolving #41589.

Endpoints
ApiClass, Router, permissionsMiddleware, rooms.getMembers, rooms.hide, rooms.bannedUsers

Notes
Reserve 401 status strictly for unauthenticated requests (!user / missing session).
Remap permission denials (error-unauthorized / error-not-authorized) to 403 (forbidden).
Align Router.ts body validation error type from invalid-params to error-invalid-params matching ajvQuery failure responses.
Clean up dead applyBreakingChanges branch in permissions.ts middleware and update rooms.ts response schemas to validateForbiddenErrorResponse.
No changeset (API semantics alignment).

Task: #41589

Summary by CodeRabbit
Refactor: Standardized REST API error handling to return 403 Forbidden for authorization failures and reserved 401 Unauthorized strictly for unauthenticated missing-session requests.
Bug Fixes: Aligned body validation errorType in Hono typed router to 'error-invalid-params' for consistency with query validation errors across all REST endpoints.

Summary by CodeRabbit

Bug Fixes
- Authorization failures now consistently return HTTP 403, while HTTP 401 is reserved for missing or invalid sessions.
- Updated room access endpoints to report forbidden access correctly.
- Standardized invalid request body errors under the error-invalid-params error type.

…sing session (RocketChat#41589) - Map error-unauthorized and error-not-authorized to 403 Forbidden in ApiClass - Align Router.ts body validation errorType to 'error-invalid-params' - Clean up permissions middleware dead branch - Update rooms endpoints permission checks and schemas from 401 to 403 Closes RocketChat#41589

dionisio-bot · 2026-08-02T11:15:18Z

Looks like this PR is not ready to merge, because of the following issues:

This PR is missing the 'stat: QA assured' label
This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

changeset-bot · 2026-08-02T11:15:19Z

🦋 Changeset detected

Latest commit: 7b2e48c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/http-router	Patch
@rocket.chat/core-services	Patch
@rocket.chat/federation-matrix	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

CLAassistant · 2026-08-02T11:15:21Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

dionisio-bot

Changeset mismatch

The PR title indicates a breaking change (!), but no changeset declares a major bump — at least one is required.

Please align the PR title, milestone and changesets.

coderabbitai · 2026-08-02T11:15:42Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6d54460a-2dc1-4d66-96a4-012f7e1cd445

📥 Commits

Reviewing files that changed from the base of the PR and between 94478c6 and 7b2e48c.

📒 Files selected for processing (5)

.changeset/real-mails-count.md
apps/meteor/server/api/ApiClass.ts
apps/meteor/server/api/v1/middlewares/permissions.ts
apps/meteor/server/api/v1/rooms.ts
packages/http-router/src/Router.ts

Walkthrough

The API now returns 403 for authorization failures when a session exists. Missing sessions continue to use 401. Body-validation failures now use error-invalid-params, with release metadata documenting the changes.

Changes

API error contracts

Layer / File(s)	Summary
Authorization response mapping `apps/meteor/server/api/ApiClass.ts`, `apps/meteor/server/api/v1/middlewares/permissions.ts`	The route error mapper recognizes `error-not-authorized`. Permission failures now always return forbidden responses.
Room endpoint authorization statuses `apps/meteor/server/api/v1/rooms.ts`	`rooms.membersOrderedByRole`, `rooms.hide`, and `rooms.bannedUsers` declare and return HTTP 403 when access is denied.
Body validation error type `packages/http-router/src/Router.ts`	Body-validation failures now use `error-invalid-params`.
Release metadata `.changeset/real-mails-count.md`	The changeset records the authorization status-code updates for both packages.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

REST API: 401/403 semantics inverted — error-unauthorized means permission denied, error-invalid-user means unauthenticated #41589 — The PR implements the issue’s proposed authorization and invalid-parameter response changes.

Possibly related PRs

RocketChat/Rocket.Chat#41387 — Both PRs modify room authorization handling, but target different endpoints and access-control behavior.
RocketChat/Rocket.Chat#41590 — This PR implements the same REST authorization-status changes across the API mapper, permissions middleware, and room endpoints.

Suggested labels: type: bug

Suggested reviewers: sampaiodiego

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Warning

⚠️ This pull request shows signs of AI-generated slop (description_diff_mismatch). It has been flagged by CodeRabbit slop detection and should be reviewed carefully.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b7abb0fc1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-08-02T11:19:50Z


 		if (findResult.broadcast && !(await hasPermissionAsync(this.user, 'view-broadcast-member-list', findResult._id))) {
-			return API.v1.unauthorized();
+			return API.v1.forbidden();


Register the new 403 response

For rooms.membersOrderedByRole, the response spec above this action still only registers 200/400/401/404. When this broadcast-room permission branch is hit under TEST_MODE, the typed router looks up a validator for status 403 and throws Missing response validator... instead of returning the intended forbidden response; it also leaves the generated route metadata without the new 403. Add 403: validateForbiddenErrorResponse to this endpoint's response map along with the behavior change.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-08-02T11:19:50Z

 						{
 							success: false,
-							errorType: 'invalid-params',
+							errorType: 'error-invalid-params',


Update body-validation expectations

When packages/http-router/src/Router.spec.ts runs, the two invalid body cases still assert errorType is invalid-params; this line now emits error-invalid-params, so the existing package test fails even though the behavior change is intentional. Please update those expectations in the same change, or preserve the old emitted value.

Useful? React with 👍 / 👎.

surjeetkumar8006 requested a review from a team as a code owner August 2, 2026 11:15

dionisio-bot Bot added the community label Aug 2, 2026

dionisio-bot Bot requested changes Aug 2, 2026

View reviewed changes

chore: add changeset for PR RocketChat#41658

7b2e48c

surjeetkumar8006 closed this Aug 2, 2026

coderabbitai Bot added the type: bug label Aug 2, 2026

chatgpt-codex-connector Bot reviewed Aug 2, 2026

View reviewed changes

Navigation Menu

Uh oh!

fix(api)!: return 403 for authorization failures, reserve 401 for missing session - #41658

fix(api)!: return 403 for authorization failures, reserve 401 for missing session#41658
surjeetkumar8006 wants to merge 2 commits into
RocketChat:developfrom
surjeetkumar8006:fix/api-401-403-semantics-41589

surjeetkumar8006 commented Aug 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

dionisio-bot Bot commented Aug 2, 2026

Uh oh!

changeset-bot Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

CLAassistant commented Aug 2, 2026

Uh oh!

dionisio-bot Bot left a comment

Uh oh!

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading

Review failed

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

surjeetkumar8006 commented Aug 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

dionisio-bot Bot commented Aug 2, 2026

Uh oh!

changeset-bot Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

CLAassistant commented Aug 2, 2026

Uh oh!

dionisio-bot Bot left a comment

Choose a reason for hiding this comment

Changeset mismatch

Uh oh!

coderabbitai Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Aug 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

surjeetkumar8006 commented Aug 2, 2026 •

edited by coderabbitai Bot

Loading

changeset-bot Bot commented Aug 2, 2026 •

edited

Loading

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading