feat: status visibility - #41747
Draft
ricardogarim wants to merge 8 commits into
Draft
Conversation
Contributor
|
Looks like this PR is not ready to merge, because of the following issues:
Please fix the issues and try again If you have any trouble, please check the PR guidelines |
|
Contributor
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdds configurable status visibility with role and user denials. The change persists visibility settings, caches access decisions, masks restricted statuses across APIs and presence events, and adds account and admin controls. ChangesStatus visibility controls and contracts
Visibility enforcement
Response and presence handling
Estimated code review effort: 4 (Complex) | ~60 minutes Sequence Diagram(s)sequenceDiagram
participant Admin
participant AdminUserForm
participant saveUser
participant StatusVisibilityChecker
participant Presence
Admin->>AdminUserForm: change visibility roles or denied users
AdminUserForm->>saveUser: submit visibility settings
saveUser->>StatusVisibilityChecker: invalidate visibility decisions
StatusVisibilityChecker->>Presence: notify visibility change
Presence-->>AdminUserForm: emit corrected presence state
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Warning Review ran into problems🔥 ProblemsErrors were encountered while retrieving linked issues. Errors (1)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## develop #41747 +/- ##
===========================================
- Coverage 69.04% 69.03% -0.01%
===========================================
Files 4224 4228 +4
Lines 166089 166448 +359
Branches 29557 29658 +101
===========================================
+ Hits 114669 114903 +234
- Misses 46261 46372 +111
- Partials 5159 5173 +14
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
coderabbitai
Bot
added
the
type: feature
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/meteor/server/api/v1/im.ts`:
- Around line 596-603: The membersWithSubscriptionInfo mapping currently exposes
subscription.status for restricted members; when canSee(member._id) is false,
remove or normalize that field to offline while preserving visible members’
subscription data. Update the subscription construction in the
membersWithSubscriptionInfo callback and add a regression test covering a denied
DM member.
In `@apps/meteor/server/lib/statusVisibilityChecker.ts`:
- Around line 94-105: Update the target reconciliation loop around
restrictedTargets and known so targets confirmed by the current model query as
no longer configured are removed from restrictedTargets, allowing unrestricted
targets to remain visible after invalidation. Preserve the fail-closed behavior
for targets whose current configuration is unknown, and keep configured
restricted targets marked as before.
In `@apps/meteor/server/lib/users/saveUser/saveNewUser.ts`:
- Around line 63-69: In the new-user save flow, update the code after
Users.updateFromUpdater to call notifyStatusVisibilityChanged with the newly
created user’s _id as the sole target. Ensure this notification runs after both
status visibility fields have been persisted, matching the existing saveUser.ts
behavior.
In `@apps/meteor/server/lib/users/saveUser/saveUser.ts`:
- Around line 42-43: Update the unresolved deny-list input type in saveUser’s
options declaration from IUser['_id'][] to string[] (or the project’s non-null
username type), matching resolveStatusVisibilityDenied’s username-based lookup;
retain IUser['_id'][] only for the persisted user field.
In `@apps/meteor/server/modules/listeners/listeners.module.ts`:
- Around line 157-162: Update the presence.invalidateVisibility handler to
derive correction targets from all invalidation modes: use the provided targets,
select watched targets associated with viewers when only viewers are provided,
and select all active presence subscriptions for global invalidations with
neither field. Pass the resulting targets to pushStatusVisibilityCorrection so
connected clients are corrected immediately while preserving the existing
empty-target guard.
In `@packages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.ts`:
- Around line 187-191: Remove nullable: true from every visibility array
property in packages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.ts
(lines 187-191), packages/rest-typings/src/v1/users/UserCreateParamsPOST.ts
(lines 40-41), and packages/rest-typings/src/v1/users/UsersUpdateParamsPOST.ts
(lines 73-82). Keep each property as an array of strings so the schemas reject
null consistently with the TypeScript contracts.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: fc931a02-7b60-4ca9-b178-409ea87d6b00
📒 Files selected for processing (33)
apps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/client/views/account/profile/AccountProfileForm.tsxapps/meteor/client/views/account/profile/AccountProfilePage.tsxapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/client/views/admin/users/AdminUserForm.tsxapps/meteor/jest.config.tsapps/meteor/server/api/v1/im.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.tsapps/meteor/server/modules/listeners/listeners.module.tsapps/meteor/server/publications/spotlight.tsapps/meteor/server/settings/accounts.tsapps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tspackages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tspackages/i18n/src/locales/en.i18n.jsonpackages/model-typings/src/models/IUsersModel.tspackages/models/src/models/Users.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.ts
📜 Review details
🧰 Additional context used
📓 Path-based instructions (4)
**/*.{ts,tsx,js}
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation
Files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/jest.config.tspackages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tsapps/meteor/server/settings/accounts.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/client/views/admin/users/AdminUserForm.tsxapps/meteor/client/views/account/profile/AccountProfilePage.tsxapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tspackages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.tsapps/meteor/server/publications/spotlight.tsapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/client/views/account/profile/AccountProfileForm.tsxapps/meteor/server/modules/listeners/listeners.module.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
apps/meteor/**
📄 CodeRabbit inference engine (CLAUDE.md)
The main Rocket.Chat Meteor application resides in
apps/meteor/; place its application code there rather than in other monorepo areas.
Files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/jest.config.tsapps/meteor/server/settings/accounts.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/client/views/admin/users/AdminUserForm.tsxapps/meteor/client/views/account/profile/AccountProfilePage.tsxapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tsapps/meteor/server/publications/spotlight.tsapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/client/views/account/profile/AccountProfileForm.tsxapps/meteor/server/modules/listeners/listeners.module.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
packages/**
📄 CodeRabbit inference engine (CLAUDE.md)
Shared libraries belong in
packages/, while other services belong inapps/andee/.
Files:
packages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tspackages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.tspackages/i18n/src/locales/en.i18n.json
**/*.spec.ts
📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)
**/*.spec.ts: Use descriptive test names that clearly communicate expected behavior in Playwright tests
Use.spec.tsextension for test files (e.g.,login.spec.ts)
Files:
apps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/lib/statusVisibilityChecker.spec.ts
🧠 Learnings (15)
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.
Applied to files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/jest.config.tspackages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tsapps/meteor/server/settings/accounts.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tspackages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.tsapps/meteor/server/publications/spotlight.tsapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/server/modules/listeners/listeners.module.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
📚 Learning: 2026-02-26T19:25:44.063Z
Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.
Applied to files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/jest.config.tspackages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tsapps/meteor/server/settings/accounts.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tspackages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.tsapps/meteor/server/publications/spotlight.tsapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/server/modules/listeners/listeners.module.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
📚 Learning: 2026-05-06T12:21:44.083Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 40256
File: apps/meteor/client/components/CreateDiscussion/CreateDiscussion.tsx:121-149
Timestamp: 2026-05-06T12:21:44.083Z
Learning: Field wrappers in rocket.chat/fuselage-forms (Field, FieldLabel, FieldRow, FieldError, FieldHint) auto-create htmlFor/id associations, aria-describedby, and role="alert" for errors. Do not manually set htmlFor, id, aria-describedby, or role attributes when using these wrappers. This automatic wiring does not apply to plain rocket.chat/fuselage components, which require explicit ID wiring per the accessibility docs. In code reviews, prefer using fuselage-forms wrappers for form fields and verify there is no unnecessary manual ID/aria wiring in files that use these wrappers. If a component uses plain fuselage components, ensure proper id wiring as per docs.
Applied to files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/jest.config.tspackages/core-services/src/events/Events.tspackages/core-typings/src/IUser.tsapps/meteor/server/settings/accounts.tspackages/rest-typings/src/v1/users/UserCreateParamsPOST.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/client/views/admin/users/AdminUserForm.tsxapps/meteor/client/views/account/profile/AccountProfilePage.tsxapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tspackages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.tsapps/meteor/server/publications/spotlight.tsapps/meteor/client/views/account/profile/getProfileInitialValues.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/client/views/account/profile/AccountProfileForm.tsxapps/meteor/server/modules/listeners/listeners.module.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
📚 Learning: 2026-08-05T22:02:59.828Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 41707
File: apps/meteor/server/hooks/messages/processThreads.ts:66-68
Timestamp: 2026-08-05T22:02:59.828Z
Learning: In Rocket.Chat Meteor server code, `callbacks.runAsync` returns its input item rather than the asynchronous callback promise. Callers of `afterReadMessages` must invoke `callbacks.runAsync` without awaiting it, keeping read-receipt I/O off the message-send path; this includes `apps/meteor/server/hooks/messages/processThreads.ts`.
Applied to files:
apps/meteor/server/startup/index.tsapps/meteor/server/startup/statusVisibility.tsapps/meteor/server/settings/accounts.tsapps/meteor/server/lib/resolveStatusVisibilityDenied.tsapps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/meteor-methods/users/getUserStatusText.tsapps/meteor/server/lib/users/saveUser/saveNewUser.tsapps/meteor/server/api/v1/users.tsapps/meteor/server/lib/statusVisibilityChecker.spec.tsapps/meteor/server/publications/spotlight.tsapps/meteor/server/lib/users/getFullUserData.tsapps/meteor/server/api/v1/im.tsapps/meteor/server/lib/statusVisibility.tsapps/meteor/server/modules/listeners/listeners.module.tsapps/meteor/server/lib/authorization/constant/permissions.tsapps/meteor/server/lib/statusVisibilityChecker.tsapps/meteor/server/lib/users/saveUser/saveUser.tsapps/meteor/server/lib/notifications/core/lib/Presence.tsapps/meteor/server/meteor-methods/users/saveUserPreferences.ts
📚 Learning: 2026-05-11T23:14:59.316Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 40469
File: packages/rest-typings/src/v1/users.ts:337-337
Timestamp: 2026-05-11T23:14:59.316Z
Learning: In Rocket.Chat REST endpoint typings (e.g., packages/rest-typings/src/v1/users.ts and other rest-typings files), keep the established convention of deriving field types from the domain model (e.g., use IUser indexed access like IUser['statusExpiresAt']) rather than swapping individual fields to serialized primitives (like string) in an ad-hoc way. If a truly different “serialized” representation is needed, perform the refactor consistently across the codebase (not just a single endpoint/field) and ensure all related REST typings stay aligned with the shared serialization types.
Applied to files:
packages/rest-typings/src/v1/users/UserCreateParamsPOST.tspackages/rest-typings/src/v1/users/UsersSetPreferenceParamsPOST.tspackages/rest-typings/src/v1/users/UsersUpdateParamsPOST.ts
📚 Learning: 2026-02-10T16:32:42.586Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 38528
File: apps/meteor/client/startup/roles.ts:14-14
Timestamp: 2026-02-10T16:32:42.586Z
Learning: In Rocket.Chat's Meteor client code, DDP streams use EJSON and Date fields arrive as Date objects; do not manually construct new Date() in stream handlers (for example, in sdk.stream()). Only REST API responses return plain JSON where dates are strings, so implement explicit conversion there if needed. Apply this guidance to all TypeScript files under apps/meteor/client to ensure consistent date handling in DDP streams and REST responses.
Applied to files:
apps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/client/views/account/profile/getProfileInitialValues.ts
📚 Learning: 2026-05-11T20:30:35.265Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 40480
File: apps/meteor/client/meteor/startup/accounts.ts:59-61
Timestamp: 2026-05-11T20:30:35.265Z
Learning: In Rocket.Chat’s Meteor client code, when calling `dispatchToastMessage` with `{ type: 'error' }`, pass the raw caught error object as `message` without manual normalization. `dispatchToastMessage` is designed to accept `message: unknown` for error toasts, so avoid converting errors to strings (e.g., `String(error)`) or extracting `error.message` before passing them.
Applied to files:
apps/meteor/client/hooks/useStatusVisibilityEnabled.tsapps/meteor/client/views/account/profile/getProfileInitialValues.ts
📚 Learning: 2026-04-14T21:10:31.855Z
Learnt from: dougfabris
Repo: RocketChat/Rocket.Chat PR: 36292
File: apps/meteor/client/hooks/useHasValidLocationHash.ts:7-12
Timestamp: 2026-04-14T21:10:31.855Z
Learning: When reviewing files in apps/meteor/client/hooks/, do not treat JSDoc-style comments on React hooks (especially exported hooks) as a violation of any “avoid code comments in implementation” guideline. It’s acceptable to use JSDoc to document the public API of exported hooks (e.g., parameter/return types, intended usage), as long as it documents behavior/contracts rather than adding narrative implementation comments.
Applied to files:
apps/meteor/client/hooks/useStatusVisibilityEnabled.ts
📚 Learning: 2026-02-24T19:22:48.358Z
Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 38493
File: apps/meteor/tests/e2e/omnichannel/omnichannel-send-pdf-transcript.spec.ts:66-67
Timestamp: 2026-02-24T19:22:48.358Z
Learning: In Playwright end-to-end tests (e.g., under apps/meteor/tests/e2e/...), prefer locating elements by translated text (getByText) and ARIA roles (getByRole) over data-qa attributes. If translation values change, update the corresponding test locators accordingly. Never use data-qa locators. This guideline applies to all Playwright e2e test specs in the repository and helps keep tests robust to UI text changes and accessible semantics.
Applied to files:
apps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/lib/statusVisibilityChecker.spec.ts
📚 Learning: 2026-03-06T18:10:15.268Z
Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 39397
File: packages/gazzodown/src/code/CodeBlock.spec.tsx:47-68
Timestamp: 2026-03-06T18:10:15.268Z
Learning: In tests (especially those using testing-library/dom/jsdom) for Rocket.Chat components, the HTML <code> element has an implicit ARIA role of 'code'. Therefore, screen.getByRole('code') or screen.findByRole('code') will locate <code> elements even without a role attribute. Do not flag findByRole('code') as invalid in reviews; prefer using the implicit role instead of adding role="code" unless necessary for accessibility.
Applied to files:
apps/meteor/server/lib/statusVisibility.spec.tsapps/meteor/server/lib/statusVisibilityChecker.spec.ts
📚 Learning: 2026-03-27T14:52:56.865Z
Learnt from: dougfabris
Repo: RocketChat/Rocket.Chat PR: 39892
File: apps/meteor/client/views/room/contextualBar/Threads/Thread.tsx:150-155
Timestamp: 2026-03-27T14:52:56.865Z
Learning: In Rocket.Chat, there are two different `ModalBackdrop` components with different prop APIs. During review, confirm the import source: (1) `rocket.chat/fuselage` `ModalBackdrop` uses `ModalBackdropProps` based on `BoxProps` (so it supports `onClick` and other Box/DOM props) and does not have an `onDismiss` prop; (2) `rocket.chat/ui-client` `ModalBackdrop` uses a narrower props interface like `{ children?: ReactNode; onDismiss?: () => void }` and handles Escape keypress and outside mouse-up, and it does not forward arbitrary DOM props such as `onClick`. Flag mismatched props (e.g., `onDismiss` passed to the fuselage component or `onClick` passed to the ui-client component) and ensure the usage matches the correct component being imported.
Applied to files:
apps/meteor/client/views/admin/users/AdminUserForm.tsxapps/meteor/client/views/account/profile/AccountProfilePage.tsxapps/meteor/client/views/account/profile/AccountProfileForm.tsx
📚 Learning: 2026-07-29T23:45:21.859Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41632
File: apps/meteor/server/api/v1/groups.ts:948-959
Timestamp: 2026-07-29T23:45:21.859Z
Learning: For API v1 routes under apps/meteor/server/api/v1, keep item-level response schemas strict by using `$ref`-based schemas for list and messages (and ensure they intentionally mirror the corresponding route contracts, as done in channels.ts). Only use “loose”/non-`$ref` item schemas when the underlying data source is inherently partial (e.g., uploads where `content` can be `null`, or queries like `findUsersOfRoom` with a fixed projection). Do not relax item schemas merely because the route supports an optional client `fields` projection—optional field selection alone is not a reason to change schema strictness.
Applied to files:
apps/meteor/server/api/v1/users.tsapps/meteor/server/api/v1/im.ts
📚 Learning: 2026-07-31T02:44:35.111Z
Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 41635
File: apps/meteor/ee/server/api/sessions.ts:114-138
Timestamp: 2026-07-31T02:44:35.111Z
Learning: In Rocket.Chat typed REST response schemas, accept the composition of a Typia-generated entity schema with an `allOf` branch requiring `success: true`: `allOf: [{ $ref: <entity schema> }, { properties: { success: { type: 'boolean', enum: [true] } }, required: ['success'] }]`. Do not flag this pattern when used for REST endpoints, provided TEST_MODE response validation passes, as demonstrated by the `IOAuthApps` and `IEmailInbox` endpoints.
Applied to files:
apps/meteor/server/api/v1/users.tsapps/meteor/server/api/v1/im.ts
📚 Learning: 2026-07-15T01:31:50.632Z
Learnt from: ricardogarim
Repo: RocketChat/Rocket.Chat PR: 41382
File: packages/model-typings/src/models/IPushTokenModel.ts:10-10
Timestamp: 2026-07-15T01:31:50.632Z
Learning: In Rocket.Chat’s push-token model, APNs/GCM standard tokens and PushKit VoIP tokens use distinct, globally-unique token string values. As a result, when deduplicating/looking up tokens, key identity solely on `{ tokenValue, appName }` (e.g., for `findOneByTokenAndAppName`, `removeDuplicateTokens`) and do **not** include `tokenType` in the uniqueness criteria to avoid collisions between standard and VoIP tokens.
Applied to files:
packages/models/src/models/Users.tspackages/model-typings/src/models/IUsersModel.ts
📚 Learning: 2026-08-10T13:36:55.243Z
Learnt from: abhinavkrin
Repo: RocketChat/Rocket.Chat PR: 41736
File: packages/i18n/src/locales/th-TH.i18n.json:398-398
Timestamp: 2026-08-10T13:36:55.243Z
Learning: During the coordinated i18n interpolation migration for `Channel_already_exist`, do not flag locale files that still use `%s` until the English base translation and all affected locales are converted together to `{{channelName}}`. Partial locale-only conversions fail the i18n `extra-placeholders` check; the coordinated conversion is owned by the related migration change.
Applied to files:
packages/i18n/src/locales/en.i18n.json
🔇 Additional comments (25)
apps/meteor/server/lib/resolveStatusVisibilityDenied.ts (1)
1-12: LGTM!apps/meteor/server/meteor-methods/users/saveUserPreferences.ts (1)
15-16: LGTM!Also applies to: 59-59, 136-136, 177-180, 198-201
packages/core-services/src/events/Events.ts (1)
160-160: LGTM!apps/meteor/server/startup/index.ts (1)
9-9: LGTM!apps/meteor/server/startup/statusVisibility.ts (1)
1-12: LGTM!apps/meteor/server/lib/notifications/core/lib/Presence.ts (1)
1-9: LGTM!Also applies to: 25-36, 50-57, 72-77, 94-100, 112-112, 131-136, 157-186
packages/core-typings/src/IUser.ts (1)
193-194: LGTM!apps/meteor/server/lib/authorization/constant/permissions.ts (1)
79-79: LGTM!apps/meteor/server/settings/accounts.ts (1)
776-795: LGTM!packages/model-typings/src/models/IUsersModel.ts (1)
356-356: LGTM!apps/meteor/client/hooks/useStatusVisibilityEnabled.ts (1)
1-11: LGTM!apps/meteor/client/views/account/profile/AccountProfileForm.tsx (1)
29-38: LGTM!Also applies to: 49-51, 146-146, 174-177, 292-306
apps/meteor/client/views/account/profile/AccountProfilePage.tsx (1)
15-15: LGTM!Also applies to: 40-49
apps/meteor/client/views/account/profile/getProfileInitialValues.ts (1)
16-19: LGTM!Also applies to: 29-29
apps/meteor/client/views/admin/users/AdminUserForm.tsx (1)
43-46: LGTM!Also applies to: 89-90, 117-117, 178-189, 198-200, 514-550
packages/i18n/src/locales/en.i18n.json (1)
308-318: LGTM!Also applies to: 7307-7307
packages/models/src/models/Users.ts (1)
2327-2345: LGTM!apps/meteor/server/lib/statusVisibility.ts (1)
1-73: LGTM!apps/meteor/server/lib/statusVisibility.spec.ts (1)
1-145: LGTM!apps/meteor/jest.config.ts (1)
54-54: LGTM!apps/meteor/server/lib/users/getFullUserData.ts (1)
7-8: LGTM!Also applies to: 43-44, 127-127, 147-166
apps/meteor/server/api/v1/users.ts (1)
52-53: LGTM!Also applies to: 252-254, 770-776, 1566-1571, 1581-1601
apps/meteor/server/meteor-methods/users/getUserStatusText.ts (1)
5-5: LGTM!Also applies to: 23-25
apps/meteor/server/publications/spotlight.ts (1)
7-8: LGTM!Also applies to: 71-76
apps/meteor/server/lib/statusVisibilityChecker.ts (1)
20-21: 🔒 Security & PrivacyRemove the
awaitrecommendation.License.hasModulereturns a synchronousboolean, so the second call is not an unresolvedPromiseand cannot enable status visibility incorrectly.> Likely an incorrect or invalid review comment.
ricardogarim
force-pushed
the
feat/status-visibility
branch
from
August 12, 2026 21:16
2df6667 to
adf7ebe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proposed changes (including videos or screenshots)
Adds status visibility: control over who can see a user's presence and status message. Off by default, behind
Accounts_StatusVisibility_Enabledand the presence licence modules.Three scopes. Roles grant, named people block — nothing can widen.
Resolution: a viewer sees the status if they hold one of the granted roles and appear in neither block list. An unset scope means "everyone", so an unconfigured workspace behaves exactly as today.
Use cases
view-restricted-user-statusalways see the real status; so does the user themselvesAnyone outside the result sees that user as offline — status, text, source, expiry, default and connection all suppressed together, so it is indistinguishable from genuinely offline. Blocking takes effect immediately, with no reload.
Issue(s)
Steps to test or reproduce
Further comments
Enforcement is one predicate applied at every read surface (
users.presence,users.list,users.info,im.members, spotlight,getUserStatusText) and on the presence stream. Verdicts are resolved once per subscription and cached, because the emit path is synchronous and cannot query.Summary by CodeRabbit