fix: Users without preview permission possibility of subscribe to public channel stream (#35194)

.changeset/lemon-lions-learn.md

+---
+"@rocket.chat/meteor": patch
+---
+
+fixes the possibility of see new messages without being subscribed to a public channel.

apps/meteor/app/lib/server/methods/getChannelHistory.ts

+import { Authorization } from '@rocket.chat/core-services';
 import type { IMessage, MessageTypesValues } from '@rocket.chat/core-typings';
 import type { ServerMethods } from '@rocket.chat/ddp-client';
-import { Messages, Subscriptions, Rooms } from '@rocket.chat/models';
+import { Messages, Rooms } from '@rocket.chat/models';
 import { check } from 'meteor/check';
 import { Meteor } from 'meteor/meteor';
 
-import { canAccessRoomAsync } from '../../../authorization/server';
-import { hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
 import { settings } from '../../../settings/server/cached';
 import { normalizeMessagesForUser } from '../../../utils/server/lib/normalizeMessagesForUser';
 import { getHiddenSystemMessages } from '../lib/getHiddenSystemMessages';
@@ -62,16 +61,8 @@ export const getChannelHistory = async ({
 		return false;
 	}
 
-	if (!(await canAccessRoomAsync(room, { _id: fromUserId }))) {
-		return false;
-	}
-
 	// Make sure they can access the room
-	if (
-		room.t === 'c' &&
-		!(await hasPermissionAsync(fromUserId, 'preview-c-room')) &&
-		!(await Subscriptions.findOneByRoomIdAndUserId(rid, fromUserId, { projection: { _id: 1 } }))
-	) {
+	if (!(await Authorization.canReadRoom(room, { _id: fromUserId }))) {
 		return false;
 	}
 

apps/meteor/server/modules/notifications/notifications.module.ts

@@ -101,16 +101,7 @@ export class NotificationsModule {
 				return false;
 			}
 
-			const canAccess = await Authorization.canAccessRoom(room, { _id: this.userId || '' }, extraData);
-			if (!canAccess) {
-				// verify if can preview messages from public channels
-				if (room.t === 'c' && this.userId) {
-					return Authorization.hasPermission(this.userId, 'preview-c-room');
-				}
-				return false;
-			}
-
-			return true;
+			return Authorization.canReadRoom(room, { _id: this.userId || '' }, extraData);
 		});
 
 		this.streamRoomMessage.allowRead('__my_messages__', 'all');

apps/meteor/server/services/authorization/canReadRoom.ts

+import type { RoomAccessValidator } from '@rocket.chat/core-services';
+import { Authorization } from '@rocket.chat/core-services';
+import { Subscriptions } from '@rocket.chat/models';
+
+import { canAccessRoom } from './canAccessRoom';
+
+export const canReadRoom: RoomAccessValidator = async (...args) => {
+	if (!(await canAccessRoom(...args))) {
+		return false;
+	}
+
+	const [room, user] = args;
+
+	if (
+		user?._id &&
+		room?.t === 'c' &&
+		!(await Authorization.hasPermission(user._id, 'preview-c-room')) &&
+		!(await Subscriptions.findOneByRoomIdAndUserId(room?._id, user._id, { projection: { _id: 1 } }))
+	) {
+		return false;
+	}
+
+	return true;
+};

apps/meteor/server/services/authorization/service.ts

@@ -5,6 +5,7 @@ import { Subscriptions, Rooms, Users, Roles, Permissions } from '@rocket.chat/mo
 import mem from 'mem';
 
 import { canAccessRoom } from './canAccessRoom';
+import { canReadRoom } from './canReadRoom';
 import { AuthorizationUtils } from '../../../app/authorization/lib/AuthorizationUtils';
 
 import './canAccessRoomLivechat';
@@ -80,6 +81,10 @@ export class Authorization extends ServiceClass implements IAuthorization {
 		return canAccessRoom(...args);
 	}
 
+	async canReadRoom(...args: Parameters<RoomAccessValidator>): Promise<boolean> {
+		return canReadRoom(...args);
+	}
+
 	async canAccessRoomId(rid: IRoom['_id'], uid: IUser['_id']): Promise<boolean> {
 		const room = await Rooms.findOneById<Pick<IRoom, '_id' | 't' | 'teamId' | 'prid'>>(rid, {
 			projection: {

packages/core-services/src/types/IAuthorization.ts

@@ -11,6 +11,7 @@ export interface IAuthorization {
 	hasPermission(userId: string, permissionId: string, scope?: string): Promise<boolean>;
 	hasAtLeastOnePermission(userId: string, permissions: string[], scope?: string): Promise<boolean>;
 	canAccessRoom: RoomAccessValidator;
+	canReadRoom: RoomAccessValidator;
 	canAccessRoomId(rid: IRoom['_id'], uid?: IUser['_id']): Promise<boolean>;
 	getUsersFromPublicRoles(): Promise<(IRocketChatRecord & Pick<IUser, '_id' | 'username' | 'roles'>)[]>;
 }