feat: migrate batch4 client DDP callers + add 6 REST endpoints

.changeset/rest-batch4-logout-cleanup.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Moved the post-logout cleanup hook (`afterLogoutCleanUpCallback` + `Apps.IPostUserLoggedOut`) into a server-side `Accounts.onLogout` handler and into `POST /v1/users.logout`. Both DDP and REST logout paths now fire those callbacks server-side; the client no longer needs to invoke `logoutCleanUp` after detecting a logout, and the deprecated DDP method keeps its registration with a deprecation log pointing at `/v1/users.logout`.

.changeset/rest-cloud-connect-workspace.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/cloud.connectWorkspace` (replaces the deprecated `cloud:connectWorkspace` DDP method). Body is `{ token }`; auth-gated with `manage-cloud` permission. The legacy DDP method remains registered with a deprecation log pointing at the new route.

.changeset/rest-integrations-history-clear-replay.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/integrations.history.clear` and `POST /v1/integrations.outgoing.replay` (replace the deprecated `clearIntegrationHistory` and `replayOutgoingIntegration` DDP methods). Bodies `{ integrationId }` and `{ integrationId, historyId }` respectively. Permissions (`manage-outgoing-integrations` or `manage-own-outgoing-integrations`) are enforced the same way the DDP methods did. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

.changeset/rest-permissions-add-remove-role.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/permissions.addRole` and `POST /v1/permissions.removeRole` (replace the deprecated `authorization:addPermissionToRole` and `authorization:removeRoleFromPermission` DDP methods). Body is `{ permissionId, role }` on both. The same per-user permission checks (`access-permissions`, `access-setting-permissions`) the DDP methods enforced are reused. Legacy DDP methods remain registered with deprecation logs pointing at the new routes.

.changeset/rest-users-setavatar-service.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': minor
+---
+
+Extended `POST /v1/users.setAvatar` to accept an optional `service` multipart field. When provided, the value is stored as the user's `avatarOrigin`, matching what the deprecated `setAvatarFromService` DDP method did. The legacy DDP method remains registered with a deprecation log pointing at the new route.

.changeset/rest-users-verify-email.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Added `POST /v1/users.verifyEmail` (replaces the two-call DDP flow of `verifyEmail` + `afterVerifyEmail`). Body is `{ token }`; the server resolves the user, marks the email verified, and runs the anonymous→user role swap in a single request. The deprecated `afterVerifyEmail` DDP method keeps its registration with a deprecation log pointing at the new route.

apps/meteor/app/api/server/v1/cloud.ts

@@ -1,6 +1,7 @@
 import type { CloudRegistrationIntentData, CloudConfirmationPollData, CloudRegistrationStatus } from '@rocket.chat/core-typings';
 import {
 	isCloudConfirmationPollProps,
+	isCloudConnectWorkspaceProps,
 	isCloudCreateRegistrationIntentProps,
 	isCloudManualRegisterProps,
 	ajv,
@@ -11,6 +12,7 @@ import {
 
 import { CloudWorkspaceRegistrationError } from '../../../../lib/errors/CloudWorkspaceRegistrationError';
 import { SystemLogger } from '../../../../server/lib/logger/system';
+import { connectWorkspace } from '../../../cloud/server/functions/connectWorkspace';
 import { getCheckoutUrl } from '../../../cloud/server/functions/getCheckoutUrl';
 import { getConfirmationPoll } from '../../../cloud/server/functions/getConfirmationPoll';
 import {
@@ -287,6 +289,25 @@ declare module '@rocket.chat/rest-typings' {
 	}
 }
 
+API.v1.post(
+	'cloud.connectWorkspace',
+	{
+		authRequired: true,
+		permissionsRequired: ['manage-cloud'],
+		body: isCloudConnectWorkspaceProps,
+		response: {
+			200: successResponseSchema,
+			400: validateBadRequestErrorResponse,
+			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
+		},
+	},
+	async function action() {
+		await connectWorkspace(this.bodyParams.token);
+		return API.v1.success();
+	},
+);
+
 API.v1.get(
 	'cloud.checkoutUrl',
 	{

apps/meteor/app/api/server/v1/integrations.ts

@@ -8,6 +8,8 @@ import {
 	isIntegrationsGetProps,
 	isIntegrationsUpdateProps,
 	isIntegrationsListProps,
+	isIntegrationsClearHistoryProps,
+	isIntegrationsReplayProps,
 	validateBadRequestErrorResponse,
 	validateForbiddenErrorResponse,
 	validateUnauthorizedErrorResponse,
@@ -16,6 +18,10 @@ import { escapeRegExp } from '@rocket.chat/string-helpers';
 import { Match, check } from 'meteor/check';
 import type { Filter } from 'mongodb';
 
+import {
+	clearIntegrationHistoryMethod,
+	replayOutgoingIntegrationMethod,
+} from '../../../integrations/server/functions/clearIntegrationHistory';
 import {
 	mountIntegrationHistoryQueryBasedOnPermissions,
 	mountIntegrationQueryBasedOnPermissions,
@@ -363,3 +369,47 @@ API.v1.put(
 		}
 	},
 );
+
+const voidIntegrationsResponse = ajv.compile<void>({
+	type: 'object',
+	properties: { success: { type: 'boolean', enum: [true] } },
+	required: ['success'],
+	additionalProperties: false,
+});
+
+API.v1.post(
+	'integrations.history.clear',
+	{
+		authRequired: true,
+		body: isIntegrationsClearHistoryProps,
+		response: {
+			200: voidIntegrationsResponse,
+			400: validateBadRequestErrorResponse,
+			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
+		},
+	},
+	async function action() {
+		await clearIntegrationHistoryMethod(this.userId, this.bodyParams.integrationId);
+		return API.v1.success();
+	},
+);
+
+API.v1.post(
+	'integrations.outgoing.replay',
+	{
+		authRequired: true,
+		body: isIntegrationsReplayProps,
+		response: {
+			200: voidIntegrationsResponse,
+			400: validateBadRequestErrorResponse,
+			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
+		},
+	},
+	async function action() {
+		const { integrationId, historyId } = this.bodyParams;
+		await replayOutgoingIntegrationMethod(this.userId, { integrationId, historyId });
+		return API.v1.success();
+	},
+);

apps/meteor/app/api/server/v1/permissions.ts

@@ -9,6 +9,7 @@ import {
 } from '@rocket.chat/rest-typings';
 import { Meteor } from 'meteor/meteor';
 
+import { addPermissionToRoleMethod, removeRoleFromPermissionMethod } from '../../../authorization/server/functions/permissionRole';
 import { permissionsGetMethod } from '../../../authorization/server/streamer/permissions';
 import { notifyOnPermissionChangedById } from '../../../lib/server/lib/notifyListener';
 import type { ExtractRoutesFromAPI } from '../ApiClass';
@@ -62,6 +63,25 @@ const isPermissionsListAll = ajvQuery.compile<PermissionsListAllProps>(permissio
 
 const isBodyParamsValidPermissionUpdate = ajv.compile<PermissionsUpdateProps>(permissionUpdatePropsSchema);
 
+type PermissionRolePayload = { permissionId: string; role: string };
+
+const isPermissionRolePayload = ajv.compile<PermissionRolePayload>({
+	type: 'object',
+	properties: {
+		permissionId: { type: 'string', minLength: 1 },
+		role: { type: 'string', minLength: 1 },
+	},
+	required: ['permissionId', 'role'],
+	additionalProperties: false,
+});
+
+const voidPermissionResponse = ajv.compile<void>({
+	type: 'object',
+	properties: { success: { type: 'boolean', enum: [true] } },
+	required: ['success'],
+	additionalProperties: false,
+});
+
 const permissionsEndpoints = API.v1
 	.get(
 		'permissions.listAll',
@@ -185,6 +205,42 @@ const permissionsEndpoints = API.v1
 				permissions: result,
 			});
 		},
+	)
+	.post(
+		'permissions.addRole',
+		{
+			authRequired: true,
+			body: isPermissionRolePayload,
+			response: {
+				200: voidPermissionResponse,
+				400: validateBadRequestErrorResponse,
+				401: validateUnauthorizedErrorResponse,
+				403: validateForbiddenErrorResponse,
+			},
+		},
+		async function action() {
+			const { permissionId, role } = this.bodyParams;
+			await addPermissionToRoleMethod(this.userId, permissionId, role);
+			return API.v1.success();
+		},
+	)
+	.post(
+		'permissions.removeRole',
+		{
+			authRequired: true,
+			body: isPermissionRolePayload,
+			response: {
+				200: voidPermissionResponse,
+				400: validateBadRequestErrorResponse,
+				401: validateUnauthorizedErrorResponse,
+				403: validateForbiddenErrorResponse,
+			},
+		},
+		async function action() {
+			const { permissionId, role } = this.bodyParams;
+			await removeRoleFromPermissionMethod(this.userId, permissionId, role);
+			return API.v1.success();
+		},
 	);
 
 export type PermissionsEndpoints = ExtractRoutesFromAPI<typeof permissionsEndpoints>;

apps/meteor/app/api/server/v1/users.ts

@@ -38,10 +38,12 @@ import type { Filter } from 'mongodb';
 import { generatePersonalAccessTokenOfUser } from '../../../../imports/personal-access-tokens/server/api/methods/generateToken';
 import { regeneratePersonalAccessTokenOfUser } from '../../../../imports/personal-access-tokens/server/api/methods/regenerateToken';
 import { removePersonalAccessTokenOfUser } from '../../../../imports/personal-access-tokens/server/api/methods/removeToken';
+import { runUserLogoutCleanUp } from '../../../../server/hooks/userLogoutCleanUp';
 import { UserChangedAuditStore } from '../../../../server/lib/auditServerEvents/userChanged';
 import { i18n } from '../../../../server/lib/i18n';
 import { SystemLogger } from '../../../../server/lib/logger/system';
 import { resetUserE2EEncriptionKey } from '../../../../server/lib/resetUserE2EKey';
+import { runAfterVerifyEmail } from '../../../../server/lib/users/runAfterVerifyEmail';
 import { registerUser } from '../../../../server/methods/registerUser';
 import { requestDataDownload } from '../../../../server/methods/requestDataDownload';
 import { resetAvatar } from '../../../../server/methods/resetAvatar';
@@ -343,7 +345,9 @@ API.v1
 				}
 			}
 
-			await setUserAvatar(user, fileBuffer, mimetype, 'rest');
+			const service = typeof fields.service === 'string' && fields.service.length > 0 ? fields.service : 'rest';
+
+			await setUserAvatar(user, fileBuffer, mimetype, service as 'rest');
 
 			return API.v1.success();
 		},
@@ -1877,6 +1881,8 @@ API.v1
 				return API.v1.forbidden();
 			}
 
+			const user = await Users.findOneById(userId);
+
 			// this method logs the user out automatically, if successful returns 1, otherwise 0
 			if (!(await Users.unsetLoginTokens(userId))) {
 				throw new Meteor.Error('error-invalid-user-id', 'Invalid user id');
@@ -1886,6 +1892,10 @@ API.v1
 
 			void notifyOnUserChange({ clientAction: 'updated', id: userId, diff: { 'services.resume.loginTokens': [] } });
 
+			if (user) {
+				await runUserLogoutCleanUp(user);
+			}
+
 			return API.v1.success({
 				message: `User ${userId} has been logged out!`,
 			});
@@ -2080,6 +2090,38 @@ API.v1
 		},
 	);
 
+API.v1.post(
+	'users.verifyEmail',
+	{
+		authRequired: false,
+		body: ajv.compile<{ token: string }>({
+			type: 'object',
+			properties: {
+				token: { type: 'string', minLength: 1 },
+			},
+			required: ['token'],
+			additionalProperties: false,
+		}),
+		response: {
+			200: voidSuccessResponse,
+			400: validateBadRequestErrorResponse,
+		},
+	},
+	async function action() {
+		const { token } = this.bodyParams;
+
+		const user = await Users.findOne<Pick<IUser, '_id'>>({ 'services.email.verificationTokens.token': token }, { projection: { _id: 1 } });
+
+		await Meteor.callAsync('verifyEmail', token);
+
+		if (user) {
+			await runAfterVerifyEmail(user._id);
+		}
+
+		return API.v1.success();
+	},
+);
+
 settings.watch<number>('Rate_Limiter_Limit_RegisterUser', (value) => {
 	const userRegisterRoute = '/api/v1/users.registerpost';
 

apps/meteor/app/authorization/server/functions/permissionRole.ts

@@ -0,0 +1,78 @@
+import { License } from '@rocket.chat/core-services';
+import { Permissions } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import { hasPermissionAsync } from './hasPermission';
+import { notifyOnPermissionChangedById } from '../../../lib/server/lib/notifyListener';
+import { CONSTANTS, AuthorizationUtils } from '../../lib';
+
+export const addPermissionToRoleMethod = async (uid: string | null, permissionId: string, role: string): Promise<void> => {
+	if (role === 'guest' && !AuthorizationUtils.hasRestrictionsToRole(role) && (await License.hasValidLicense())) {
+		AuthorizationUtils.addRolePermissionWhiteList(role, await License.getGuestPermissions());
+	}
+
+	if (AuthorizationUtils.isPermissionRestrictedForRole(permissionId, role)) {
+		throw new Meteor.Error('error-action-not-allowed', 'Permission is restricted', {
+			method: 'authorization:addPermissionToRole',
+			action: 'Adding_permission',
+		});
+	}
+
+	const permission = await Permissions.findOneById(permissionId);
+
+	if (!permission) {
+		throw new Meteor.Error('error-invalid-permission', 'Permission does not exist', {
+			method: 'authorization:addPermissionToRole',
+			action: 'Adding_permission',
+		});
+	}
+
+	if (
+		!uid ||
+		!(await hasPermissionAsync(uid, 'access-permissions')) ||
+		(permission.level === CONSTANTS.SETTINGS_LEVEL && !(await hasPermissionAsync(uid, 'access-setting-permissions')))
+	) {
+		throw new Meteor.Error('error-action-not-allowed', 'Adding permission is not allowed', {
+			method: 'authorization:addPermissionToRole',
+			action: 'Adding_permission',
+		});
+	}
+
+	if (permission.groupPermissionId) {
+		await Permissions.addRole(permission.groupPermissionId, role);
+		void notifyOnPermissionChangedById(permission.groupPermissionId);
+	}
+
+	await Permissions.addRole(permission._id, role);
+
+	void notifyOnPermissionChangedById(permission._id);
+};
+
+export const removeRoleFromPermissionMethod = async (uid: string | null, permissionId: string, role: string): Promise<void> => {
+	const permission = await Permissions.findOneById(permissionId);
+
+	if (!permission) {
+		throw new Meteor.Error('error-permission-not-found', 'Permission not found', {
+			method: 'authorization:removeRoleFromPermission',
+		});
+	}
+
+	if (
+		!uid ||
+		!(await hasPermissionAsync(uid, 'access-permissions')) ||
+		(permission.level === CONSTANTS.SETTINGS_LEVEL && !(await hasPermissionAsync(uid, 'access-setting-permissions')))
+	) {
+		throw new Meteor.Error('error-action-not-allowed', 'Removing permission is not allowed', {
+			method: 'authorization:removeRoleFromPermission',
+			action: 'Removing_permission',
+		});
+	}
+
+	if (permission.groupPermissionId) {
+		await Permissions.removeRole(permission.groupPermissionId, role);
+		void notifyOnPermissionChangedById(permission.groupPermissionId);
+	}
+
+	await Permissions.removeRole(permission._id, role);
+	void notifyOnPermissionChangedById(permission._id);
+};