fix: add permission check to the `autotransate.translateMessage` endpoint
Merged
JU
5mo ago+72-1
Proposed changes (including videos or screenshots)
The autotranslate.translateMessage endpoint doesn't check if the user can access the room before proceeding with the translation. This could lead to attackers exploiting this endpoint to retrieve data they don't have access to. The issue, however, is medium to low severity since there's no trivial way of getting message IDs for private rooms and translation would have to be enabled and configured in the workspace.
This PR adds a canAccessRoomAsync check to the endpoint and an E2E test to ensure that it will return 403 Forbidden if the user is not part of the room.
Issue(s)
https://rocketchat.atlassian.net/browse/VLN-372
Steps to test or reproduce
- N/A
Further comments
- N/A
Summary by CodeRabbit
- Bug Fixes
- The auto-translate endpoint now validates user access to the room containing the message before processing translations. Unauthorized access requests will return a 403 Forbidden response.
