regression: channels.list.joined rejects the fields query param

[tassoevan]

Proposed changes (including videos or screenshots)

GET /api/v1/channels.list.joined started returning HTTP 400 (must NOT have additional properties) whenever the fields query param was provided, even with ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=true.

The typed-route migration in #41415 (b3eee9b) replaced the endpoint's loose params with a strict ajvQuery schema using additionalProperties: false, but the property list omitted fields — while the handler still reads it:

const { sort, fields } = await this.parseJsonQuery();

So the param was rejected at validation before the handler could apply (or ignore) it.

This adds fields back to the channels.list.joined query schema, restoring the 8.7.x behavior until the param's scheduled removal in 9.0.0:

• flag disabled — HTTP 200, fields ignored;
• flag enabled — HTTP 200, fields applied as the projection, with the existing deprecation warning.

additionalProperties: false is kept, so genuinely unknown params still get a 400.

No changeset: this is a regression against unreleased 8.8.0 code, not a change end users saw in a released version.

Issue(s)

https://rocketchat.atlassian.net/browse/CORE-2644

Regression from #41415.

Steps to test or reproduce

curl -i --get 'https://SERVER/api/v1/channels.list.joined' \
  -H 'X-User-Id: USER_ID' \
  -H 'X-Auth-Token: AUTH_TOKEN' \
  --data-urlencode 'fields={"topic":0}'

Before: HTTP 400 must NOT have additional properties. After: HTTP 200.

Automated coverage added in apps/meteor/tests/end-to-end/api/channels.ts under [/channels.list.joined]:

• fields alone is accepted (200 instead of 400);
• fields together with every other supported param (roomId, roomName, _id, query, sort, count, offset) is accepted, guarding the whole property list rather than the single key added;
• an unknown param still returns 400 must NOT have additional properties, proving the schema was not simply loosened.

The tests assert acceptance and response shape rather than the projection itself, since parseJsonQuery only honors fields when ALLOW_UNSAFE_QUERY_AND_FIELDS_API_PARAMS=TRUE, which the e2e suite does not set.

Further comments

channels.list has the same shape — its isChannelsListProps schema also omits fields while the handler reads it via parseJsonQuery. Left out of this PR to keep the regression fix scoped; worth a follow-up sweep over the other endpoints migrated in #41415.

Summary by CodeRabbit

• New Features

  • Added support for selecting specific fields in joined channel list results.
  • Field selection works alongside filtering, sorting, pagination, and channel identifiers.

• Bug Fixes

  • Added validation to reject unsupported query parameters with a clear error response.

CORE-2644

[dionisio-bot]

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 0686131

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[hacktron-app]

Hacktron Security Check - Skipped

Reason: OSS PR review limit reached for this approved repository and developer. New OSS PRs for this repository will resume at the start of the next cycle.

Wait for the next cycle. OSS quota is limited to the approved OSS repository and cannot be used on paid repositories.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8482b0bc-30d0-4575-9f92-a976d470ca4a

📥 Commits

Reviewing files that changed from the base of the PR and between a533489 and 0686131.

📒 Files selected for processing (2)

• apps/meteor/server/api/v1/channels.ts
• apps/meteor/tests/end-to-end/api/channels.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (4)

• GitHub Check: 📦 Build Packages
• GitHub Check: cubic · AI code reviewer
• GitHub Check: CodeQL-Build
• GitHub Check: CodeQL-Build

🧰 Additional context used

📓 Path-based instructions (2)

The main Rocket.Chat Meteor application resides in `apps/meteor/`; place its application code there rather than in other monorepo areas.

📄 CodeRabbit inference engine (CLAUDE.md)

Files:

• apps/meteor/tests/end-to-end/api/channels.ts
• apps/meteor/server/api/v1/channels.ts

Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

Files:

• apps/meteor/tests/end-to-end/api/channels.ts
• apps/meteor/server/api/v1/channels.ts

🔇 Additional comments (2)

apps/meteor/server/api/v1/channels.ts (1)

1514-1525: LGTM!

apps/meteor/tests/end-to-end/api/channels.ts (1)

434-449: LGTM!

Also applies to: 451-470, 472-485

---

Walkthrough

The channels.list.joined endpoint now accepts the optional fields query parameter. End-to-end tests cover standalone and combined usage, plus rejection of unknown query parameters.

Changes

Joined channels projection

Layer / File(s)	Summary
Endpoint schema and validation apps/meteor/server/api/v1/channels.ts, apps/meteor/tests/end-to-end/api/channels.ts	The endpoint accepts fields as a string. Tests cover supported parameters, combined filters and pagination, successful responses, and unknown-parameter rejection.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 06861

This localized fix restores the supported fields parameter for joined-channel requests without broadening channel access or weakening validation, so no actionable merge-blocking risk remains after normal checks and review.

Suggested labels: type: bug

Suggested reviewers: julio-rocketchat, kevlehman, ggazzo

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the regression and the affected channels.list.joined endpoint. It matches the main change, which restores support for the fields query parameter.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2 files.

Warning

Errors were encountered while retrieving linked issues.

Errors (1)

• JIRA integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-8.8.0@a533489). Learn more about missing BASE report.

Additional details and impacted files

@@               Coverage Diff                @@
##             release-8.8.0   #41979   +/-   ##
================================================
  Coverage                 ?   69.38%           
================================================
  Files                    ?     4254           
  Lines                    ?   168901           
  Branches                 ?    30150           
================================================
  Hits                     ?   117184           
  Misses                   ?    46560           
  Partials                 ?     5157           

Flag	Coverage Δ
e2e	58.80% <ø> (?)
e2e-api	45.90% <ø> (?)
unit	71.30% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.