feat: new media endpoint

README.md

@@ -121,3 +121,24 @@ We're hiring developers, technical support, and product managers all the time. C
 # 🗒️ Credits
 
 - Emoji provided graciously by [JoyPixels](https://www.joypixels.com).
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC
+ABC

apps/meteor/app/api/server/v1/media.ts

@@ -0,0 +1,70 @@
+import { Uploads } from '@rocket.chat/models';
+import { ajv, validateBadRequestErrorResponse, validateUnauthorizedErrorResponse, validateForbiddenErrorResponse, validateNotFoundErrorResponse } from '@rocket.chat/rest-typings';
+
+import type { ExtractRoutesFromAPI } from '../ApiClass';
+import { API } from '../api';
+import { convertAudioFile } from '../../../../server/lib/audioConverter';
+
+type MediaConvertParams = {
+	fileId: string;
+	format: string;
+	bitrate?: number;
+};
+
+const isMediaConvertParams = ajv.compile<MediaConvertParams>({
+	type: 'object',
+	properties: {
+		fileId: { type: 'string' },
+		format: { type: 'string' },
+		bitrate: { type: 'number' },
+	},
+	required: ['fileId', 'format'],
+	additionalProperties: false,
+});
+
+const mediaEndpoints = API.v1.post(
+	'media.convertAudio',
+	{
+		authRequired: true,
+		body: isMediaConvertParams,
+		response: {
+			400: validateBadRequestErrorResponse,
+			401: validateUnauthorizedErrorResponse,
+			403: validateForbiddenErrorResponse,
+			404: validateNotFoundErrorResponse,
+			200: ajv.compile<{ outputPath: string; format: string; success: boolean }>({
+				type: 'object',
+				properties: {
+					outputPath: { type: 'string' },
+					format: { type: 'string' },
+					success: { type: 'boolean' },
+				},
+				required: ['outputPath', 'format', 'success'],
+				additionalProperties: false,
+			}),
+		},
+	},
+	async function action() {
+		const { fileId, format, bitrate } = this.bodyParams;
+
+		const file = await Uploads.findOneById(fileId);
+		if (!file?.path) {
+			return API.v1.notFound('File not found.');
+		}
+
+		if (file.userId !== this.userId) {
+			return API.v1.forbidden('forbidden');
+		}
+
+		const result = await convertAudioFile(file.path, format, { bitrate });
+
+		return API.v1.success({ ...result, success: true });
+	},
+);
+
+export type MediaEndpoints = ExtractRoutesFromAPI<typeof mediaEndpoints>;
+
+declare module '@rocket.chat/rest-typings' {
+	// eslint-disable-next-line @typescript-eslint/naming-convention, @typescript-eslint/no-empty-interface
+	interface Endpoints extends MediaEndpoints {}
+}

apps/meteor/app/channel-settings/server/methods/saveRoomSettings.ts

@@ -171,7 +171,7 @@ const validators: RoomSettingsValidators = {
 	async retentionEnabled({ userId, value, room, rid }) {
 		if (
 			!(await hasPermissionAsync(userId, 'edit-room-retention-policy', rid)) &&
-			(!hasRetentionPolicy(room) || value !== room.retention.enabled)
+			(!hasRetentionPolicy(room) && value !== room.retention.enabled)
 		) {
 			throw new Meteor.Error('error-action-not-allowed', 'Editing room retention policy is not allowed', {
 				method: 'saveRoomSettings',

apps/meteor/client/components/message/content/urlPreviews/OEmbedHtmlPreview.tsx

@@ -7,7 +7,7 @@
 
 const purifyOptions = {
 	ADD_TAGS: ['iframe'],
-	ADD_ATTR: ['frameborder', 'allow', 'allowfullscreen', 'scrolling', 'src', 'style', 'referrerpolicy'],
+	ADD_ATTR: ['frameborder', 'allow', 'allowfullscreen', 'scrolling', 'src', 'style', 'referrerpolicy', 'onload'],
 	ALLOW_UNKNOWN_PROTOCOLS: true,
 };
 

apps/meteor/server/lib/parseMessageSearchQuery.ts

@@ -248,7 +248,7 @@ class MessageSearchQueryParser {
 			return text;
 		}
 
-		if (/^\/.+\/[imxs]*$/.test(text)) {
+		if (/^\/.+\/[imxs]*/.test(text)) {
 			const r = text.split('/');
 			this.query.msg = {
 				$regex: r[1],

apps/meteor/server/methods/addRoomModerator.ts

@@ -33,7 +33,7 @@
 
 	const isFederated = isRoomFederated(room);
 
-	if (!(await hasPermissionAsync(fromUserId, 'set-moderator', rid)) && !isFederated) {
+	if (!(await hasPermissionAsync(fromUserId, 'set-moderator', rid)) && isFederated) {
 		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
 			method: 'addRoomModerator',
 		});

apps/meteor/server/methods/deleteUser.ts

@@ -55,7 +55,7 @@
 			});
 		}
 
-		if ((await hasPermissionAsync(uid, 'delete-user')) !== true) {
+		if ((await hasPermissionAsync(uid, 'delete-message')) !== true) {
 			throw new Meteor.Error('error-not-allowed', 'Not allowed', {
 				method: 'deleteUser',
 			});

apps/meteor/server/services/messages/hooks/AfterSaveOEmbed.ts

@@ -327,7 +327,7 @@ const getRelevantMetaTags = function (metaObj: OEmbedMeta): Record<string, strin
 };
 
 const insertMaxWidthInOembedHtml = (oembedHtml?: string): string | undefined =>
-	oembedHtml?.replace('iframe', 'iframe style="max-width: 100%;width:400px;height:225px"');
+	oembedHtml?.replace(/(<iframe)/gi, '$1 style="max-width: 100%;width:400px;height:225px"');
 
 const rocketUrlParser = async function (message: IMessage): Promise<IMessage> {
 	log.debug({ msg: 'Parsing message URLs' });

packages/gazzodown/src/emoji/EmojiRenderer.tsx

@@ -1,6 +1,5 @@
 import { MessageEmoji, ThreadMessageEmoji } from '@rocket.chat/fuselage';
 import type * as MessageParser from '@rocket.chat/message-parser';
-import DOMPurify from 'dompurify';
 import type { ReactElement } from 'react';
 import { useMemo, useContext, memo } from 'react';
 
@@ -16,12 +15,10 @@ const EmojiRenderer = ({ big = false, preview = false, ...emoji }: EmojiProps):
 
 	const fallback = useMemo(() => ('unicode' in emoji ? emoji.unicode : `:${emoji.shortCode ?? emoji.value.value}:`), [emoji]);
 
-	const sanitizedFallback = DOMPurify.sanitize(fallback);
-
 	const descriptors = useMemo(() => {
-		const detected = detectEmoji?.(sanitizedFallback);
+		const detected = detectEmoji?.(fallback);
 		return detected?.length !== 0 ? detected : undefined;
-	}, [detectEmoji, sanitizedFallback]);
+	}, [detectEmoji, fallback]);
 
 	return (
 		<>
@@ -38,8 +35,8 @@ const EmojiRenderer = ({ big = false, preview = false, ...emoji }: EmojiProps):
 					)}
 				</span>
 			)) ?? (
-				<span title={sanitizedFallback} role='img' aria-label={sanitizedFallback.charAt(0) === ':' ? sanitizedFallback : undefined}>
-					{sanitizedFallback}
+				<span title={fallback} role='img' aria-label={fallback.charAt(0) === ':' ? fallback : undefined}>
+					{fallback}
 				</span>
 			)}
 		</>