Skip to content

chore: Add OpenAPI support for the Rocket.Chat e2e endpoints#39219

Merged
ggazzo merged 1 commit intoRocketChat:developfrom
ahmed-n-abdeltwab:chore/openapi-e2e
Mar 2, 2026
Merged

chore: Add OpenAPI support for the Rocket.Chat e2e endpoints#39219
ggazzo merged 1 commit intoRocketChat:developfrom
ahmed-n-abdeltwab:chore/openapi-e2e

Conversation

@ahmed-n-abdeltwab
Copy link
Copy Markdown
Contributor

@ahmed-n-abdeltwab ahmed-n-abdeltwab commented Mar 1, 2026

Description:
This PR integrates OpenAPI support into the Rocket.Chat API, migrate of Rocket.Chat API endpoints to the new OpenAPI pattern. The update includes improved API documentation, enhanced type safety, and response validation using AJV.

Key Changes:

  • Implemented the new pattern and added AJV-based JSON schema validation for API.
  • Uses the ExtractRoutesFromAPI utility from the TypeScript definitions to dynamically derive the routes from the endpoint specifications.
  • Enabled Swagger UI integration for this API.
  • Route Methods Chaining for the endpoints.
  • This does not introduce any breaking changes to the endpoint logic.

Issue Reference:
COMM-144
Relates to #34983, part of the ongoing OpenAPI integration effort.

Testing:

  • Verified that the API response schemas are correctly documented in Swagger UI.
  • All tests passed without any breaking changes

Endpoints:

  • e2e.rejectSuggestedGroupKey
  • e2e.acceptSuggestedGroupKey
  • e2e.fetchUsersWaitingForGroupKey
  • e2e.provideUsersSuggestedGroupKeys
  • e2e.resetRoomKey

Looking forward to your feedback! 🚀

Summary by CodeRabbit

  • New Features
    • Enabled OpenAPI support for end-to-end encryption endpoints with improved type validation.
    • Added new E2E endpoints for group key management: accepting/rejecting group key suggestions, fetching users awaiting keys, providing suggested group keys, and resetting room keys.

Task: ARCH-2016

- migrating to a modern chained route definition syntax and utilizing shared AJV schemas for validation to enhance API documentation and ensure type safety through response validation.
@dionisio-bot
Copy link
Copy Markdown
Contributor

dionisio-bot bot commented Mar 1, 2026

Looks like this PR is ready to merge! 🎉
If you have any trouble, please check the PR guidelines

@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Mar 1, 2026

🦋 Changeset detected

Latest commit: f539e6d

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 41 packages
Name Type
@rocket.chat/rest-typings Minor
@rocket.chat/meteor Minor
@rocket.chat/api-client Patch
@rocket.chat/core-services Patch
@rocket.chat/ddp-client Patch
@rocket.chat/http-router Patch
@rocket.chat/models Patch
@rocket.chat/ui-contexts Major
@rocket.chat/web-ui-registration Major
@rocket.chat/account-service Patch
@rocket.chat/authorization-service Patch
@rocket.chat/ddp-streamer Patch
@rocket.chat/federation-matrix Patch
@rocket.chat/omnichannel-services Patch
@rocket.chat/presence Patch
rocketchat-services Patch
@rocket.chat/omnichannel-transcript Patch
@rocket.chat/presence-service Patch
@rocket.chat/queue-worker Patch
@rocket.chat/abac Patch
@rocket.chat/network-broker Patch
@rocket.chat/omni-core-ee Patch
@rocket.chat/livechat Patch
@rocket.chat/mock-providers Patch
@rocket.chat/cron Patch
@rocket.chat/instance-status Patch
@rocket.chat/omni-core Patch
@rocket.chat/server-fetch Patch
@rocket.chat/ui-client Major
@rocket.chat/media-calls Patch
@rocket.chat/uikit-playground Patch
@rocket.chat/fuselage-ui-kit Major
@rocket.chat/gazzodown Major
@rocket.chat/ui-avatar Major
@rocket.chat/ui-video-conf Major
@rocket.chat/ui-voip Major
@rocket.chat/core-typings Minor
@rocket.chat/apps Patch
@rocket.chat/model-typings Patch
@rocket.chat/license Patch
@rocket.chat/pdf-worker Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Mar 1, 2026

Walkthrough

The PR reorganizes E2E endpoint type definitions and validators, moving them from the centralized rest-typings package to the meteor server implementation. It introduces OpenAPI support for E2E endpoints via modern chained route syntax and removes previously exported types from the public typings surface.

Changes

Cohort / File(s) Summary
Changeset Documentation
.changeset/swift-badgers-try.md
Adds minor version bump changeset for @rocket.chat/rest-typings and @rocket.chat/meteor packages with OpenAPI support and shared AJV schemas for E2E endpoints.
E2E API Server Implementation
apps/meteor/app/api/server/v1/e2e.ts
Introduces new E2E types (E2EFetchUsersWaitingForGroupKeyProps, E2EProvideUsersGroupKeyProps, E2EResetRoomKeyProps), corresponding AJV schemas and validators, and five new API routes (acceptSuggestedGroupKey, rejectSuggestedGroupKey, fetchUsersWaitingForGroupKey, provideUsersSuggestedGroupKeys, resetRoomKey). Changes E2eEndpoints from exported to internal type alias.
REST Typings Migration
packages/rest-typings/src/v1/e2e.ts
Removes E2E type definitions, validators, and endpoint mappings (E2eGetUsersOfRoomWithoutKeyProps, E2EProvideUsersGroupKeyProps, E2EFetchUsersWaitingForGroupKeyProps, E2EResetRoomKeyProps and their validators, plus five endpoint routes). Retains only setUserPublicAndPrivateKeys endpoint in public typings.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

Suggested labels

type: chore

🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title 'chore: Add OpenAPI support for the Rocket.Chat e2e endpoints' accurately describes the main objective of the pull request, which is to migrate e2e endpoints to support OpenAPI with AJV schema validation and modern route definition syntax.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@ahmed-n-abdeltwab
Copy link
Copy Markdown
Contributor Author

@ggazzo 👍

@ahmed-n-abdeltwab ahmed-n-abdeltwab marked this pull request as ready for review March 2, 2026 10:22
@ahmed-n-abdeltwab ahmed-n-abdeltwab requested review from a team as code owners March 2, 2026 10:22
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 3 files

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (2)
apps/meteor/app/api/server/v1/e2e.ts (2)

362-365: Avoid per-iteration object spread in the accumulator.

This creates a new object every iteration; mutating the accumulator is cheaper and clearer on this hot path.

Suggested refactor
-			const usersWaitingForE2EKeys = (await Subscriptions.findUsersWithPublicE2EKeyByRids(roomIds, this.userId).toArray()).reduce<
-				Record<string, { _id: string; public_key: string }[]>
-			>((acc, { rid, users }) => ({ [rid]: users, ...acc }), {});
+			const usersWaitingForE2EKeys = (await Subscriptions.findUsersWithPublicE2EKeyByRids(roomIds, this.userId).toArray()).reduce<
+				Record<string, { _id: string; public_key: string }[]>
+			>((acc, { rid, users }) => {
+				acc[rid] = users;
+				return acc;
+			}, {});
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/app/api/server/v1/e2e.ts` around lines 362 - 365, The reduce used
to build usersWaitingForE2EKeys currently returns a new object each iteration
via ({ [rid]: users, ...acc }), causing unnecessary allocations; change the
reducer passed to
Subscriptions.findUsersWithPublicE2EKeyByRids(...).toArray().reduce to mutate
the accumulator instead (assign acc[rid] = users and then return acc) so the
same object is reused across iterations; keep the initial accumulator as {} and
leave the surrounding await/variable name usersWaitingForE2EKeys unchanged.

425-425: Remove inline implementation comment.

This line is non-functional and can be dropped to keep the migration diff focused.

As per coding guidelines "**/*.{ts,tsx,js}: Avoid code comments in the implementation".

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/app/api/server/v1/e2e.ts` at line 425, Remove the non-functional
inline comment "// This should have permissions" from the implementation in the
e2e.ts diff; simply delete that comment line so the migration diff contains only
functional code and adheres to the rule avoiding implementation comments in
.ts/.tsx/.js files.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@apps/meteor/app/api/server/v1/e2e.ts`:
- Around line 450-458: The current e2e.resetRoomKey flow sets LockMap.set(rid,
true) and then throws Errors from branches that occur before a surrounding
try/finally, leaking the lock and causing undocumented 500s; fix by either
performing all validation/permission checks (calls to canAccessRoomIdAsync and
the duplicate-lock check) before setting LockMap, or ensure LockMap.set(rid,
true) happens inside a try block with a finally that always clears the lock
(LockMap.delete(rid)); update the branches that currently throw
('error-e2e-key-reset-in-progress' and 'error-not-allowed') so they occur in the
safe location relative to the try/finally using the same function/method names
shown (LockMap, canAccessRoomIdAsync, e2e.resetRoomKey) to prevent lock leakage
and ensure clients receive typed API errors instead of 500s.

---

Nitpick comments:
In `@apps/meteor/app/api/server/v1/e2e.ts`:
- Around line 362-365: The reduce used to build usersWaitingForE2EKeys currently
returns a new object each iteration via ({ [rid]: users, ...acc }), causing
unnecessary allocations; change the reducer passed to
Subscriptions.findUsersWithPublicE2EKeyByRids(...).toArray().reduce to mutate
the accumulator instead (assign acc[rid] = users and then return acc) so the
same object is reused across iterations; keep the initial accumulator as {} and
leave the surrounding await/variable name usersWaitingForE2EKeys unchanged.
- Line 425: Remove the non-functional inline comment "// This should have
permissions" from the implementation in the e2e.ts diff; simply delete that
comment line so the migration diff contains only functional code and adheres to
the rule avoiding implementation comments in .ts/.tsx/.js files.

ℹ️ Review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 3c30636 and f539e6d.

📒 Files selected for processing (3)
  • .changeset/swift-badgers-try.md
  • apps/meteor/app/api/server/v1/e2e.ts
  • packages/rest-typings/src/v1/e2e.ts
💤 Files with no reviewable changes (1)
  • packages/rest-typings/src/v1/e2e.ts
📜 Review details
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: cubic · AI code reviewer
🧰 Additional context used
📓 Path-based instructions (1)
**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

  • apps/meteor/app/api/server/v1/e2e.ts
🧠 Learnings (19)
📓 Common learnings
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:18.785Z
Learning: In Rocket.Chat PR reviews, maintain strict scope boundaries—when a PR is focused on a specific endpoint (e.g., rooms.favorite), avoid reviewing or suggesting changes to other endpoints that were incidentally refactored (e.g., rooms.invite) unless explicitly requested by maintainers.
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38913
File: packages/ddp-client/src/legacy/types/SDKLegacy.ts:34-34
Timestamp: 2026-02-25T20:10:16.987Z
Learning: In the RocketChat/Rocket.Chat monorepo, packages/ddp-client and apps/meteor do not use TypeScript project references. Module augmentations in apps/meteor (e.g., declare module 'rocket.chat/rest-typings') are not visible when compiling packages/ddp-client in isolation, which is why legacy SDK methods that depend on OperationResult types for OpenAPI-migrated endpoints must remain commented out.
📚 Learning: 2026-02-24T19:09:09.561Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.

Applied to files:

  • .changeset/swift-badgers-try.md
📚 Learning: 2026-02-25T20:10:16.987Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38913
File: packages/ddp-client/src/legacy/types/SDKLegacy.ts:34-34
Timestamp: 2026-02-25T20:10:16.987Z
Learning: In the RocketChat/Rocket.Chat monorepo, packages/ddp-client and apps/meteor do not use TypeScript project references. Module augmentations in apps/meteor (e.g., declare module 'rocket.chat/rest-typings') are not visible when compiling packages/ddp-client in isolation, which is why legacy SDK methods that depend on OperationResult types for OpenAPI-migrated endpoints must remain commented out.

Applied to files:

  • .changeset/swift-badgers-try.md
  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2026-02-24T19:05:56.710Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 0
File: :0-0
Timestamp: 2026-02-24T19:05:56.710Z
Learning: Rocket.Chat repo context: When a workspace manifest on develop already pins a dependency version (e.g., packages/web-ui-registration → "rocket.chat/ui-contexts": "27.0.1"), a lockfile change in a feature PR that upgrades only that dependency’s resolution is considered a manifest-driven sync and can be kept, preferably as a small "chore: sync yarn.lock with manifests" commit.

Applied to files:

  • .changeset/swift-badgers-try.md
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Group related tests in the same file

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/page-objects/**/*.ts : Utilize existing page objects pattern from `apps/meteor/tests/e2e/page-objects/`

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : All test files must be created in `apps/meteor/tests/e2e/` directory

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Ensure tests run reliably in parallel without shared state conflicts

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2026-02-24T19:09:01.522Z
Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:01.522Z
Learning: In Rocket.Chat OpenAPI migration PRs for endpoints under apps/meteor/app/api/server/v1, avoid introducing logic changes. Only perform scope-tight changes that preserve behavior; style-only cleanups (e.g., removing inline comments) may be deferred to follow-ups to keep the migration PR focused.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Use `expect` matchers for assertions (`toEqual`, `toContain`, `toBeTruthy`, `toHaveLength`, etc.) instead of `assert` statements in Playwright tests

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.spec.ts : Utilize Playwright fixtures (`test`, `page`, `expect`) for consistency in test files

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-24T17:08:17.065Z
Learnt from: CR
Repo: RocketChat/Rocket.Chat PR: 0
File: .cursor/rules/playwright.mdc:0-0
Timestamp: 2025-11-24T17:08:17.065Z
Learning: Applies to apps/meteor/tests/e2e/**/*.{ts,spec.ts} : Follow Page Object Model pattern consistently in Playwright tests

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings by mapping subscription documents to room IDs, never undefined, even when user has no room subscriptions.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-09-25T09:59:26.461Z
Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: AppUserBridge.getUserRoomIds in apps/meteor/app/apps/server/bridges/users.ts always returns an array of strings (mapping subscription documents to room IDs), never undefined, even when user has no room subscriptions.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-10-28T16:53:42.761Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37205
File: ee/packages/federation-matrix/src/FederationMatrix.ts:296-301
Timestamp: 2025-10-28T16:53:42.761Z
Learning: In the Rocket.Chat federation-matrix integration (ee/packages/federation-matrix/), the createRoom method from rocket.chat/federation-sdk will support a 4-argument signature (userId, roomName, visibility, displayName) in newer versions. Code using this 4-argument call is forward-compatible with planned library updates and should not be flagged as an error.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2025-11-04T16:49:19.107Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 37377
File: apps/meteor/ee/server/hooks/federation/index.ts:86-88
Timestamp: 2025-11-04T16:49:19.107Z
Learning: In Rocket.Chat's federation system (apps/meteor/ee/server/hooks/federation/), permission checks follow two distinct patterns: (1) User-initiated federation actions (creating rooms, adding users to federated rooms, joining from invites) should throw MeteorError to inform users they lack 'access-federation' permission. (2) Remote server-initiated federation events should silently skip/ignore when users lack permission. The beforeAddUserToRoom hook only executes for local user-initiated actions, so throwing an error there is correct. Remote federation events are handled separately by the federation Matrix package with silent skipping logic.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2026-02-23T17:53:06.802Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:06.802Z
Learning: During PR reviews that touch endpoint files under apps/meteor/app/api/server/v1, enforce strict scope: if a PR targets a specific endpoint (e.g., rooms.favorite), do not propose changes to unrelated endpoints (e.g., rooms.invite) unless maintainers explicitly request them. Focus feedback on the touched endpoint's behavior, API surface, and related tests; avoid broad cross-endpoint changes in the same PR unless requested.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

  • apps/meteor/app/api/server/v1/e2e.ts
🔇 Additional comments (3)
.changeset/swift-badgers-try.md (1)

1-6: Changeset content is aligned with the migration scope.

The package bump intent and description are consistent with the OpenAPI e2e migration in this PR.

apps/meteor/app/api/server/v1/e2e.ts (2)

44-171: Schema and validator additions look solid.

These type/schema/validator additions are consistent with the OpenAPI migration and keep request shapes constrained.


270-423: Good chained-route migration for the new e2e endpoints.

The new route definitions are clean, scoped, and include explicit response validators.

Comment on lines +450 to +458
if (LockMap.has(rid)) {
throw new Error('error-e2e-key-reset-in-progress');
}

LockMap.set(rid, true);

if (!(await canAccessRoomIdAsync(rid, this.userId))) {
throw new Error('error-not-allowed');
}
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

e2e.resetRoomKey can leak lock state and emit undocumented 500 responses.

Two branches throw generic Error before the try/finally, so the lock may remain set until TTL expiry and clients can get 500s instead of typed API errors.

Suggested fix
 		async function action() {
 			const { rid, e2eKey, e2eKeyId } = this.bodyParams;
 			if (!(await hasPermissionAsync(this.userId, 'toggle-room-e2e-encryption', rid))) {
 				return API.v1.forbidden('error-not-allowed');
 			}
+			if (!(await canAccessRoomIdAsync(rid, this.userId))) {
+				return API.v1.forbidden('error-not-allowed');
+			}
 			if (LockMap.has(rid)) {
-				throw new Error('error-e2e-key-reset-in-progress');
+				return API.v1.failure('error-e2e-key-reset-in-progress');
 			}
 
 			LockMap.set(rid, true);
-
-			if (!(await canAccessRoomIdAsync(rid, this.userId))) {
-				throw new Error('error-not-allowed');
-			}
 
 			try {
 				await resetRoomKey(rid, this.userId, e2eKey, e2eKeyId);
 				return API.v1.success();
 			} catch (e) {

Also applies to: 460-468

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@apps/meteor/app/api/server/v1/e2e.ts` around lines 450 - 458, The current
e2e.resetRoomKey flow sets LockMap.set(rid, true) and then throws Errors from
branches that occur before a surrounding try/finally, leaking the lock and
causing undocumented 500s; fix by either performing all validation/permission
checks (calls to canAccessRoomIdAsync and the duplicate-lock check) before
setting LockMap, or ensure LockMap.set(rid, true) happens inside a try block
with a finally that always clears the lock (LockMap.delete(rid)); update the
branches that currently throw ('error-e2e-key-reset-in-progress' and
'error-not-allowed') so they occur in the safe location relative to the
try/finally using the same function/method names shown (LockMap,
canAccessRoomIdAsync, e2e.resetRoomKey) to prevent lock leakage and ensure
clients receive typed API errors instead of 500s.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isnt this out of the scoop for this pr

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ahmed-n-abdeltwab You're absolutely right—this is out of scope for the OpenAPI migration. The goal of this PR is to migrate endpoints to the new OpenAPI pattern without introducing logic changes, and fixing the lock leakage bug would be a behavioral change to the endpoint's error handling.

The issue I flagged is a pre-existing bug (the lock leak and generic Error throws were already present), so it should be addressed separately to keep this migration PR focused.

Would you like me to open a follow-up issue to track this bug for a future PR?


🧠 Learnings used
Learnt from: dougfabris
Repo: RocketChat/Rocket.Chat PR: 32703
File: apps/meteor/client/lib/chats/flows/uploadFiles.ts:52-58
Timestamp: 2026-02-12T15:39:28.416Z
Learning: In `apps/meteor/client/lib/chats/flows/uploadFiles.ts`, when E2E encryption is required but not allowed (e.g., `E2E_Enable_Encrypt_Files` setting is disabled), the function intentionally abandons the entire upload queue and displays a toast error. This fail-fast behavior prevents partial uploads when encryption requirements cannot be met and is the expected behavior, not a bug.

Learnt from: Dnouv
Repo: RocketChat/Rocket.Chat PR: 37057
File: packages/apps-engine/src/definition/accessors/IUserRead.ts:23-27
Timestamp: 2025-09-25T09:59:26.461Z
Learning: UserBridge.doGetUserRoomIds in packages/apps-engine/src/server/bridges/UserBridge.ts has a bug where it implicitly returns undefined when the app lacks read permission (missing return statement in the else case of the permission check).

Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:06.802Z
Learning: During PR reviews that touch endpoint files under apps/meteor/app/api/server/v1, enforce strict scope: if a PR targets a specific endpoint (e.g., rooms.favorite), do not propose changes to unrelated endpoints (e.g., rooms.invite) unless maintainers explicitly request them. Focus feedback on the touched endpoint's behavior, API surface, and related tests; avoid broad cross-endpoint changes in the same PR unless requested.

Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:01.522Z
Learning: In Rocket.Chat OpenAPI migration PRs for endpoints under apps/meteor/app/api/server/v1, avoid introducing logic changes. Only perform scope-tight changes that preserve behavior; style-only cleanups (e.g., removing inline comments) may be deferred to follow-ups to keep the migration PR focused.

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

@codecov
Copy link
Copy Markdown

codecov bot commented Mar 2, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.69%. Comparing base (3c30636) to head (f539e6d).
⚠️ Report is 36 commits behind head on develop.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop   #39219      +/-   ##
===========================================
- Coverage    70.76%   70.69%   -0.08%     
===========================================
  Files         3195     3195              
  Lines       113106   113106              
  Branches     20522    20535      +13     
===========================================
- Hits         80041    79957      -84     
- Misses       31018    31098      +80     
- Partials      2047     2051       +4     
Flag Coverage Δ
e2e 60.37% <ø> (-0.07%) ⬇️
e2e-api 47.79% <ø> (-0.06%) ⬇️
unit 71.33% <ø> (-0.09%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ggazzo
Copy link
Copy Markdown
Member

ggazzo commented Mar 2, 2026

/jira ARCH-1464

@ggazzo ggazzo added the stat: QA assured Means it has been tested and approved by a company insider label Mar 2, 2026
@dionisio-bot dionisio-bot bot added the stat: ready to merge PR tested and approved waiting for merge label Mar 2, 2026
@dionisio-bot dionisio-bot bot enabled auto-merge March 2, 2026 14:49
@ggazzo ggazzo disabled auto-merge March 2, 2026 14:49
@ggazzo ggazzo merged commit 78b3fe3 into RocketChat:develop Mar 2, 2026
58 checks passed
@ahmed-n-abdeltwab
Copy link
Copy Markdown
Contributor Author

thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

community stat: QA assured Means it has been tested and approved by a company insider stat: ready to merge PR tested and approved waiting for merge type: chore

Projects

Development

Successfully merging this pull request may close these issues.

3 participants