chore(api): migrate sessions (device management) endpoints to typed HTTP methods

Draft
DE
3mo ago
+246-128

Proposed changes (including videos or screenshots)

Continues the REST API endpoint migration (batch 5), converting the device-management sessions/* endpoints from API.v1.addRoute() to the typed HTTP-method style (API.v1.get/API.v1.post) with elaborate response schemas.

Migrated routes in apps/meteor/ee/server/api/sessions.ts:

  • sessions/list (GET)
  • sessions/info (GET)
  • sessions/logout.me (POST)
  • sessions/list.all (GET)
  • sessions/info.admin (GET)
  • sessions/logout (POST)

Key changes:

  • Request validators moved to the proper option: query for GET (isSessionsPaginateProps/isSessionsProps), body for POST (isSessionsProps).
  • Response validators added for 200 plus the relevant error statuses (400/401/403, and 404 where the route can return "Session not found").
  • Elaborate response schemas instead of weak { type: 'object' }:
    • Registered DeviceManagementSession and DeviceManagementPopulatedSession in the core-typings typia registry (packages/core-typings/src/Ajv.ts) and reference them via $ref (the populated variant references ISessionDevice/IUser sub-schemas).
    • sessions/list / sessions/list.all: PaginatedResult<{ sessions: … }> with count/offset/total.
    • sessions/info / sessions/info.admin: allOf of the entity $ref plus { success: true }. allOf (rather than additionalProperties: false) preserves the existing behavior of returning the full session document.
    • sessions/logout(.me): { sessionId }.
  • Preserved existing licensing (license: ['device-management'] + License.hasModule guard), 2FA, permission, and error semantics. Handlers are unchanged aside from being standalone async function action().
  • Existing manual Endpoints declarations are preserved; no duplicate declarations added.

Excludes endpoints already migrated in #41356.

Issue(s)

N/A — part of the ongoing API endpoint migration.

Steps to test or reproduce

  • yarn workspace @rocket.chat/core-typings run build
  • npx eslint apps/meteor/ee/server/api/sessions.ts packages/core-typings/src/Ajv.ts
  • npx tsc --noEmit --skipLibCheck (no errors in changed files)
  • API e2e: apps/meteor/tests/end-to-end/api/method.roomNameExists.ts / device-management suites

Further comments

Local TypeScript + ESLint pass. sessions/info narrows the model's ISession result to DeviceManagementSession so the SuccessResult types line up; runtime behavior (returning the full document) is unchanged and validated by the allOf schema.

Link to Devin session: https://app.devin.ai/sessions/daf03dc59cb54e958e31a9e9c72fb162