feat: force End-to-End Encryption (E2EE) on private rooms

Merged
MI
2mo ago
+321-9

Proposed changes (including videos or screenshots)

Adds a workspace setting that lets administrators in regulated / high-security environments enforce E2EE on every newly created private room, so users can no longer opt out or accidentally create an unencrypted private room.

New setting — E2E_Force_Encryption_For_Private_Rooms (Admin → Settings → End-to-End Encryption)

  • Boolean, default false, public, gated by enableQuery: E2E_Enable = true
  • Label: Force_Encryption_For_Private_Rooms ("Force End-to-End Encryption (E2EE) on Private Rooms")
  • Description: Force_Encryption_For_Private_Rooms_Description

Behavior when enabled

  • Create-room modal (CreateChannelModal): for a private room the Encrypted toggle is forced on and disabled, with the hint "Enforced by workspace security policy."; public rooms keep the toggle off + disabled.
  • Server enforcement (central prepareCreateRoomCallback in app/e2e/server/beforeCreateRoom.ts): for private rooms (type === 'p') it forces encrypted: true, and rejects any request that explicitly passes encrypted: false (e.g. groups.create) with error code error-encrypted-private-rooms-enforced ("Workspace policy requires all private rooms to be encrypted.").

When disabled, the existing legacy behavior is fully retained (respects E2E_Enabled_Default_PrivateRooms and the user choice). Public rooms are never affected.

Files

  • apps/meteor/server/settings/e2e.ts — register the setting
  • apps/meteor/app/e2e/server/beforeCreateRoom.ts — server-side force + reject
  • apps/meteor/client/navbar/NavBarPagesGroup/actions/CreateChannelModal.tsx — modal state matrix (forced on / disabled)
  • apps/meteor/client/navbar/NavBarPagesGroup/actions/useEncryptedRoomDescription.ts — enforced hint text
  • packages/i18n/src/locales/en.i18n.json — 4 new keys (sorted; i18n check passes)
  • changeset included

Issue(s)

Steps to test or reproduce

  1. Admin → Settings → End-to-End Encryption: enable E2E Enable and Force End-to-End Encryption (E2EE) on Private Rooms.
  2. Open the create-channel modal, toggle Private on → the Encrypted toggle flips on, is greyed out, and shows "Enforced by workspace security policy." Toggle Private off (public) → Encrypted is off and disabled.
  3. API: POST /api/v1/groups.create with extraData.encrypted = false → rejected with error-encrypted-private-rooms-enforced. With encrypted: true or omitted → created encrypted. POST /api/v1/channels.create (public) is unaffected.

Verified end-to-end against a local server + MongoDB: groups.create with encrypted:false is rejected, encrypted:true/omitted creates an encrypted room, and public channel creation is unaffected.

Further comments

Enforcement is placed in the shared prepareCreateRoomCallback so it covers all private-room creation paths (REST groups.create, the createPrivateGroup method, teams) from a single point, rather than only the REST endpoint.

The client modal logic compiles cleanly but was not visually driven in a browser during development; the server enforcement, setting registration, and i18n were verified live.

🤖 Generated with Claude Code

CORE-2380

Summary by CodeRabbit

  • New Features

    • Added an Admin setting to require end-to-end encryption for newly created private rooms.
    • Private rooms and teams are automatically encrypted, with encryption controls locked when enforcement applies.
    • Public and federated rooms remain exempt from the policy.
    • Added clear policy indicators and localized error messages.

  • Bug Fixes

    • Prevented creation of unencrypted private rooms and discussions when enforcement is enabled.
    • Added toast notifications when discussion creation fails.