fix: `canAccessRoom` throwing when the user's `_id` is undefined

Merged
NA
2mo ago
+125-1

Proposed changes (including videos or screenshots)

In https://github.com/RocketChat/Rocket.Chat/pull/38622 we added a method name isPartialUser, which checks for the existence of the _id property in the user object rather than checking it's truthy. That implementation returned true every time the user _id came as undefined, getting into the conditional that hydrates the object querying to the user's collection by _id, and hence, throwing 'User not found' error.

Issue(s)

SUP-1093 Regression in 8.3.0: loadMissedMessages throws User not found for unauthenticated callers, reachable from an unauthenticated public endpoint

Steps to test or reproduce

Precondition: You need to have a room with the GENERAL _id, or tweak the body based on your needs.

This can be tested via API, use the POST method against http://localhost:3000/api/v1/method.callAnon/loadMissedMessages, no headers.

Body template:

{"message":"{\"msg\":\"method\",\"id\":\"42\",\"method\":\"loadMissedMessages\",\"params\":[\"GENERAL\",{\"$date\":1700000000000}]}"

Expected result: You shouldn't get an 'User not found' error in console. The response should contain success: true.

Further comments

Summary by CodeRabbit

Bug Fixes

  • Fixed an authorization error that could occur when a user ID was undefined.
  • Improved handling of incomplete user information during room access checks.
  • Preserved correct anonymous-access decisions when user IDs are empty.

Tests

  • Added coverage for user hydration, missing users, incomplete users, and anonymous access scenarios.