Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/strong-insects-brush.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@rocket.chat/meteor': patch
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we use minor instead of patch anymore for this project

---

Migrated users.getPreferences to OpenAPI pattern with AJV validation
2 changes: 1 addition & 1 deletion .vscode/settings.json
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,4 @@
"tmid",
"tshow"
]
}
}
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.vscode settings is out of the scoop for this PR could you fix this

45 changes: 33 additions & 12 deletions apps/meteor/app/api/server/v1/users.ts
Original file line number Diff line number Diff line change
Expand Up @@ -752,6 +752,21 @@ API.v1.addRoute(
},
);

const UserPreferencesResponseSchema = {
type: 'object',
properties: {
preferences: {
type: 'object',
additionalProperties: true,
},
success: { type: 'boolean', enum: [true] },
},
required: ['preferences', 'success'],
additionalProperties: false,
};

const isUserPreferencesResponse = ajv.compile(UserPreferencesResponseSchema);

const usersEndpoints = API.v1
.post(
'users.createToken',
Expand Down Expand Up @@ -877,26 +892,32 @@ const usersEndpoints = API.v1

return API.v1.success({ suggestions });
},
);

API.v1.addRoute(
'users.getPreferences',
{ authRequired: true },
{
async get() {
)
.get(
'users.getPreferences',
{
authRequired: true,
response: {
400: validateBadRequestErrorResponse,
401: validateUnauthorizedErrorResponse,
200: isUserPreferencesResponse,
},
},
async function action() {
const user = await Users.findOneById(this.userId);

if (user?.settings) {
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: users.getPreferences regresses null-safe behavior by failing when settings is missing and may throw if settings.preferences is null.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/users.ts, line 909:

<comment>`users.getPreferences` regresses null-safe behavior by failing when `settings` is missing and may throw if `settings.preferences` is `null`.</comment>

<file context>
@@ -909,21 +906,19 @@ const usersEndpoints = API.v1
-			if (!user) {
-				throw new Meteor.Error('error-invalid-user', 'Invalid user');
-			}
+			if (user?.settings) {
+				const { preferences = {} } = user.settings;
+				preferences.language = user.language;
</file context>
Fix with Cubic

const { preferences = {} } = user?.settings;
preferences.language = user?.language;
const { preferences = {} } = user.settings;
preferences.language = user.language;

return API.v1.success({
preferences,
});
}

return API.v1.failure(i18n.t('Accounts_Default_User_Preferences_not_available').toUpperCase());
},
},
);
);

API.v1.addRoute(
'users.forgotPassword',
Expand Down Expand Up @@ -1554,7 +1575,7 @@ settings.watch<number>('Rate_Limiter_Limit_RegisterUser', (value) => {
API.v1.updateRateLimiterDictionaryForRoute(userRegisterRoute, value);
});

type UsersEndpoints = ExtractRoutesFromAPI<typeof usersEndpoints>;
export type UsersEndpoints = ExtractRoutesFromAPI<typeof usersEndpoints>;

declare module '@rocket.chat/rest-typings' {
// eslint-disable-next-line @typescript-eslint/naming-convention, @typescript-eslint/no-empty-interface
Expand Down