Merge branch 'develop' into bio-empty

.changeset/happy-stingrays-provide.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes issue that could cause multiple discussions to be created when creating it from a message action

.changeset/lazy-avocados-whisper.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/i18n": minor
+---
+
+Improves thread metrics featuring user avatars, better titles and repositioned elements.

.changeset/mean-cobras-sneeze.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/meteor': minor
+---
+
+Adds cursor pagination on chat.syncMessages endpoint

.changeset/pink-dodos-greet.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes sidepanel not replicating sidebar sort preference

.changeset/plenty-snakes-dream.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": minor
+---
+
+Adds a new route to allow fetching avatars by the user's id `/avatar/uid/<UserID>`

.changeset/popular-queens-brake.md

@@ -0,0 +1,17 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/core-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/apps-engine': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+These changes aims to add:
+- A brand-new omnichannel contact profile
+- The ability to communicate with known contacts only
+- Communicate with verified contacts only
+- Merge verified contacts across different channels
+- Block contact channels
+- Resolve conflicting contact information when registered via different channels
+- An advanced contact center filters

.changeset/seven-berries-check.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": patch
+"@rocket.chat/i18n": patch
+---
+
+Adds "Master volume" and "Call ringer volume" to the user preferences sound section.

.changeset/three-dragons-brush.md

@@ -0,0 +1,8 @@
+---
+'@rocket.chat/apps-engine': minor
+'@rocket.chat/livechat': minor
+'@rocket.chat/i18n': minor
+'@rocket.chat/meteor': minor
+---
+
+Prevent apps' subprocesses from crashing on unhandled rejections or uncaught exceptions

.changeset/tricky-trees-destroy.md

@@ -0,0 +1,4 @@
+---
+"@rocket.chat/meteor": patch
+---
+Adds login and permission validation for resetIrcConnection method

.changeset/twenty-news-own.md

@@ -0,0 +1,6 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/i18n": minor
+---
+
+Disables the possiblity to upload exempted apps

.changeset/unlucky-wasps-check.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where resizable handler renders over the expanded thread view while using contextualbarResizable feature preview

.github/workflows/release-candidate.yml

@@ -1,7 +1,7 @@
 name: Release candidate cut
 on:
   schedule:
-    - cron: '28 0 20 * *' # run at minute 28 to avoid the chance of delay due to high load on GH
+    - cron: '28 12 20 * *' # run at minute 28 to avoid the chance of delay due to high load on GH
 jobs:
   new-release:
     runs-on: ubuntu-latest

.yarn/patches/swiper-npm-11.1.14-8126fa478a.patch

@@ -0,0 +1,62 @@
+diff --git a/package.json b/package.json
+index 9f37b1dd9e3ea128aafb0ceef83641e864474308..795e15b1b008596f0a278ff43cb1103794c10d9d 100644
+--- a/package.json
++++ b/package.json
+@@ -24,6 +24,7 @@
+       "default": "./swiper-bundle.mjs"
+     },
+     "./css": "./swiper.css",
++    "./swiper.css": "./swiper.css",
+     "./css/bundle": "./swiper-bundle.css",
+     "./swiper-bundle.css": "./swiper-bundle.css",
+     "./css/a11y": "./modules/a11y.css",
+@@ -49,6 +50,7 @@
+     "./css/thumbs": "./modules/thumbs.css",
+     "./css/virtual": "./modules/virtual.css",
+     "./css/zoom": "./modules/zoom.css",
++    "./modules/zoom.css": "./modules/zoom.css",
+     "./less": "./swiper.less",
+     "./less/a11y": "./modules/a11y.less",
+     "./less/autoplay": "./modules/autoplay.less",
+@@ -136,6 +138,10 @@
+       "types": "./swiper-react.d.ts",
+       "default": "./swiper-react.mjs"
+     },
++    "./swiper-react.mjs": {
++      "types": "./swiper-react.d.ts",
++      "default": "./swiper-react.mjs"
++    },
+     "./vue": {
+       "types": "./swiper-vue.d.ts",
+       "default": "./swiper-vue.mjs"
+@@ -144,6 +150,10 @@
+       "types": "./types/modules/index.d.ts",
+       "default": "./modules/index.mjs"
+     },
++    "./modules/index.mjs": {
++      "types": "./types/modules/index.d.ts",
++      "default": "./modules/index.mjs"
++    },
+     "./types": "./types/index.d.ts",
+     "./package.json": "./package.json"
+   },
+@@ -152,6 +162,9 @@
+       "modules": [
+         "./types/modules/index.d.ts"
+       ],
++      "modules/index.mjs": [
++        "./types/modules/index.d.ts"
++      ],
+       "element": [
+         "./swiper-element.d.ts"
+       ],
+@@ -161,6 +174,9 @@
+       "react": [
+         "./swiper-react.d.ts"
+       ],
++      "swiper-react.mjs": [
++        "./swiper-react.d.ts"
++      ],
+       "vue": [
+         "./swiper-vue.d.ts"
+       ]

apps/meteor/.mocharc.js

@@ -36,5 +36,6 @@ module.exports = {
 		'tests/unit/lib/**/*.spec.ts',
 		'tests/unit/server/**/*.tests.ts',
 		'tests/unit/server/**/*.spec.ts',
+		'app/api/**/*.spec.ts',
 	],
 };

apps/meteor/app/api/server/lib/getServerInfo.spec.ts

@@ -22,7 +22,8 @@ const { getServerInfo } = proxyquire.noCallThru().load('./getServerInfo', {
 		settings: new Map(),
 	},
 });
-describe('#getServerInfo()', () => {
+// #ToDo: Fix those tests in a separate PR
+describe.skip('#getServerInfo()', () => {
 	beforeEach(() => {
 		hasAllPermissionAsyncMock.reset();
 		getCachedSupportedVersionsTokenMock.reset();

apps/meteor/app/api/server/lib/maybeMigrateLivechatRoom.ts

@@ -0,0 +1,36 @@
+import { isOmnichannelRoom, type IRoom } from '@rocket.chat/core-typings';
+import { Rooms } from '@rocket.chat/models';
+import type { FindOptions } from 'mongodb';
+
+import { projectionAllowsAttribute } from './projectionAllowsAttribute';
+import { migrateVisitorIfMissingContact } from '../../../livechat/server/lib/contacts/migrateVisitorIfMissingContact';
+
+/**
+ * If the room is a livechat room and it doesn't yet have a contact, trigger the migration for its visitor and source
+ * The migration will create/use a contact and assign it to every room that matches this visitorId and source.
+ **/
+export async function maybeMigrateLivechatRoom(room: IRoom | null, options: FindOptions<IRoom> = {}): Promise<IRoom | null> {
+	if (!room || !isOmnichannelRoom(room)) {
+		return room;
+	}
+
+	// Already migrated
+	if (room.contactId) {
+		return room;
+	}
+
+	// If the query options specify that contactId is not needed, then do not trigger the migration
+	if (!projectionAllowsAttribute('contactId', options)) {
+		return room;
+	}
+
+	const contactId = await migrateVisitorIfMissingContact(room.v._id, room.source);
+
+	// Did not migrate
+	if (!contactId) {
+		return room;
+	}
+
+	// Load the room again with the same options so it can be reloaded with the contactId in place
+	return Rooms.findOneById(room._id, options);
+}

apps/meteor/app/api/server/lib/projectionAllowsAttribute.spec.ts

@@ -0,0 +1,29 @@
+import { expect } from 'chai';
+
+import { projectionAllowsAttribute } from './projectionAllowsAttribute';
+
+describe('projectionAllowsAttribute', () => {
+	it('should return true if there are no options', () => {
+		expect(projectionAllowsAttribute('attributeName')).to.be.equal(true);
+	});
+
+	it('should return true if there is no projection', () => {
+		expect(projectionAllowsAttribute('attributeName', {})).to.be.equal(true);
+	});
+
+	it('should return true if the field is projected', () => {
+		expect(projectionAllowsAttribute('attributeName', { projection: { attributeName: 1 } })).to.be.equal(true);
+	});
+
+	it('should return false if the field is disallowed by projection', () => {
+		expect(projectionAllowsAttribute('attributeName', { projection: { attributeName: 0 } })).to.be.equal(false);
+	});
+
+	it('should return false if the field is not projected and others are', () => {
+		expect(projectionAllowsAttribute('attributeName', { projection: { anotherAttribute: 1 } })).to.be.equal(false);
+	});
+
+	it('should return true if the field is not projected and others are disallowed', () => {
+		expect(projectionAllowsAttribute('attributeName', { projection: { anotherAttribute: 0 } })).to.be.equal(true);
+	});
+});

apps/meteor/app/api/server/lib/projectionAllowsAttribute.ts

@@ -0,0 +1,19 @@
+import type { IRocketChatRecord } from '@rocket.chat/core-typings';
+import type { FindOptions } from 'mongodb';
+
+export function projectionAllowsAttribute(attributeName: string, options?: FindOptions<IRocketChatRecord>): boolean {
+	if (!options?.projection) {
+		return true;
+	}
+
+	if (attributeName in options.projection) {
+		return Boolean(options.projection[attributeName]);
+	}
+
+	const projectingAllowedFields = Object.values(options.projection).some((value) => Boolean(value));
+
+	// If the attribute is not on the projection list, return the opposite of the values in the projection. aka:
+	//     if the projection is specifying blocked fields, then this field is allowed;
+	//     if the projection is specifying allowed fields, then this field is blocked;
+	return !projectingAllowedFields;
+}

apps/meteor/app/api/server/lib/users.ts

@@ -183,20 +183,22 @@ export async function findPaginatedUsersByStatus({
 		...(canSeeExtension ? { freeSwitchExtension: 1 } : {}),
 	};
 
-	match.$or = [
-		...(canSeeAllUserInfo ? [{ 'emails.address': { $regex: escapeRegExp(searchTerm || ''), $options: 'i' } }] : []),
-		{
-			username: { $regex: escapeRegExp(searchTerm || ''), $options: 'i' },
-		},
-		{
-			name: { $regex: escapeRegExp(searchTerm || ''), $options: 'i' },
-		},
-	];
+	if (searchTerm?.trim()) {
+		match.$or = [
+			...(canSeeAllUserInfo ? [{ 'emails.address': { $regex: escapeRegExp(searchTerm || ''), $options: 'i' } }] : []),
+			{
+				username: { $regex: escapeRegExp(searchTerm || ''), $options: 'i' },
+			},
+			{
+				name: { $regex: escapeRegExp(searchTerm || ''), $options: 'i' },
+			},
+		];
+	}
 	if (roles?.length && !roles.includes('all')) {
 		match.roles = { $in: roles };
 	}
 
-	const { cursor, totalCount } = await Users.findPaginated(
+	const { cursor, totalCount } = Users.findPaginated(
 		{
 			...match,
 		},

apps/meteor/app/api/server/v1/assets.ts

@@ -1,13 +1,19 @@
+import { Settings } from '@rocket.chat/models';
 import { isAssetsUnsetAssetProps } from '@rocket.chat/rest-typings';
 
-import { RocketChatAssets, setAsset, unsetAsset, refreshClients } from '../../../assets/server';
+import { updateAuditedByUser } from '../../../../server/settings/lib/auditedSettingUpdates';
+import { RocketChatAssets, refreshClients } from '../../../assets/server';
+import { notifyOnSettingChangedById } from '../../../lib/server/lib/notifyListener';
 import { settings } from '../../../settings/server';
 import { API } from '../api';
 import { getUploadFormData } from '../lib/getUploadFormData';
 
 API.v1.addRoute(
 	'assets.setAsset',
-	{ authRequired: true },
+	{
+		authRequired: true,
+		permissionsRequired: ['manage-assets'],
+	},
 	{
 		async post() {
 			const asset = await getUploadFormData(
@@ -29,7 +35,19 @@ API.v1.addRoute(
 				throw new Error('Invalid asset');
 			}
 
-			await setAsset(this.userId, fileBuffer, mimetype, assetName);
+			const { key, value } = await RocketChatAssets.setAssetWithBuffer(fileBuffer, mimetype, assetName);
+
+			const { modifiedCount } = await updateAuditedByUser({
+				_id: this.userId,
+				username: this.user.username!,
+				ip: this.requestIp,
+				useragent: this.request.headers['user-agent'] || '',
+			})(Settings.updateValueById, key, value);
+
+			if (modifiedCount) {
+				void notifyOnSettingChangedById(key);
+			}
+
 			if (refreshAllClients) {
 				await refreshClients(this.userId);
 			}
@@ -44,6 +62,7 @@ API.v1.addRoute(
 	{
 		authRequired: true,
 		validateParams: isAssetsUnsetAssetProps,
+		permissionsRequired: ['manage-assets'],
 	},
 	{
 		async post() {
@@ -52,7 +71,20 @@ API.v1.addRoute(
 			if (!isValidAsset) {
 				throw Error('Invalid asset');
 			}
-			await unsetAsset(this.userId, assetName);
+
+			const { key, value } = await RocketChatAssets.unsetAsset(assetName);
+
+			const { modifiedCount } = await updateAuditedByUser({
+				_id: this.userId,
+				username: this.user.username!,
+				ip: this.requestIp,
+				useragent: this.request.headers['user-agent'] || '',
+			})(Settings.updateValueById, key, value);
+
+			if (modifiedCount) {
+				void notifyOnSettingChangedById(key);
+			}
+
 			if (refreshAllClients) {
 				await refreshClients(this.userId);
 			}