feat: custom sounds create/update API endpoints with file validations

.changeset/mighty-icons-kiss.md

@@ -0,0 +1,9 @@
+---
+'@rocket.chat/model-typings': minor
+'@rocket.chat/rest-typings': minor
+'@rocket.chat/models': minor
+'@rocket.chat/meteor': minor
+'@rocket.chat/i18n': minor
+---
+
+Adds new API endpoints `custom-sounds.create` and `custom-sounds.update` to manage custom sounds with strict file validation for size and specific MIME types to ensure system compatibility.

apps/meteor/app/api/server/lib/getUploadFormData.ts

@@ -102,7 +102,9 @@ export async function getUploadFormData<
 			return reject(new MeteorError('No file uploaded'));
 		}
 		if (options.validate !== undefined && !options.validate(fields)) {
-			return reject(new MeteorError(`Invalid fields ${options.validate.errors?.join(', ')}`));
+			return reject(
+				new MeteorError(`Invalid fields ${(options.validate.errors ?? []).map((e) => `${e.instancePath} ${e.message}`).join(', ')}`),
+			);
 		}
 		return resolve(uploadedFile);
 	}

apps/meteor/app/api/server/v1/custom-sounds.ts

@@ -4,6 +4,8 @@ import type { PaginatedResult } from '@rocket.chat/rest-typings';
 import {
 	isCustomSoundsGetOneProps,
 	isCustomSoundsListProps,
+	isCustomSoundsCreateProps,
+	isCustomSoundsUpdateProps,
 	ajv,
 	validateBadRequestErrorResponse,
 	validateNotFoundErrorResponse,
@@ -12,9 +14,14 @@ import {
 } from '@rocket.chat/rest-typings';
 import { escapeRegExp } from '@rocket.chat/string-helpers';
 
+import { MAX_CUSTOM_SOUND_SIZE_BYTES, CUSTOM_SOUND_ALLOWED_MIME_TYPES } from '../../../../lib/constants';
+import { SystemLogger } from '../../../../server/lib/logger/system';
+import { insertOrUpdateSound } from '../../../custom-sounds/server/lib/insertOrUpdateSound';
+import { uploadCustomSound } from '../../../custom-sounds/server/lib/uploadCustomSound';
 import type { ExtractRoutesFromAPI } from '../ApiClass';
 import { API } from '../api';
 import { getPaginationItems } from '../helpers/getPaginationItems';
+import { getUploadFormData } from '../lib/getUploadFormData';
 
 const customSoundsEndpoints = API.v1
 	.get(
@@ -124,6 +131,140 @@ const customSoundsEndpoints = API.v1
 
 			return API.v1.success({ sound });
 		},
+	)
+	.post(
+		'custom-sounds.create',
+		{
+			response: {
+				200: ajv.compile<{ sound: Pick<ICustomSound, '_id'>; success: boolean }>({
+					additionalProperties: false,
+					type: 'object',
+					properties: {
+						success: {
+							type: 'boolean',
+							description: 'Indicates if the request was successful.',
+						},
+						sound: {
+							type: 'object',
+							properties: {
+								_id: {
+									type: 'string',
+									description: 'The ID of the sound.',
+								},
+							},
+							required: ['_id'],
+						},
+					},
+					required: ['success', 'sound'],
+				}),
+				400: validateBadRequestErrorResponse,
+				401: validateUnauthorizedErrorResponse,
+				403: validateForbiddenErrorResponse,
+			},
+			authRequired: true,
+			permissionsRequired: ['manage-sounds'],
+		},
+		async function action() {
+			const { fields, fileBuffer, mimetype } = await getUploadFormData(
+				{
+					request: this.request,
+				},
+				{
+					field: 'sound',
+					sizeLimit: MAX_CUSTOM_SOUND_SIZE_BYTES,
+					validate: isCustomSoundsCreateProps,
+				},
+			);
+
+			if (!CUSTOM_SOUND_ALLOWED_MIME_TYPES.includes(mimetype)) {
+				return API.v1.failure('MIME type not allowed');
+			}
+
+			try {
+				const _id = await insertOrUpdateSound({
+					name: fields.name,
+					extension: fields.extension,
+				});
+				await uploadCustomSound(fileBuffer, mimetype, { _id, name: fields.name, extension: fields.extension });
+				return API.v1.success({ sound: { _id } });
+			} catch (error) {
+				SystemLogger.error({ error });
+				return API.v1.failure(error instanceof Error ? error.message : 'Unknown error');
+			}
+		},
+	)
+	.post(
+		'custom-sounds.update',
+		{
+			response: {
+				200: ajv.compile<{ success: boolean }>({
+					additionalProperties: false,
+					type: 'object',
+					properties: {
+						success: {
+							type: 'boolean',
+							description: 'Indicates if the request was successful.',
+						},
+					},
+					required: ['success'],
+				}),
+				400: validateBadRequestErrorResponse,
+				401: validateUnauthorizedErrorResponse,
+				403: validateForbiddenErrorResponse,
+			},
+			authRequired: true,
+			permissionsRequired: ['manage-sounds'],
+		},
+		async function action() {
+			const { fields, fileBuffer, mimetype } = await getUploadFormData(
+				{
+					request: this.request,
+				},
+				{
+					field: 'sound',
+					fileOptional: true,
+					sizeLimit: MAX_CUSTOM_SOUND_SIZE_BYTES,
+					validate: isCustomSoundsUpdateProps,
+				},
+			);
+
+			if (fileBuffer && !CUSTOM_SOUND_ALLOWED_MIME_TYPES.includes(mimetype)) {
+				return API.v1.failure('MIME type not allowed');
+			}
+
+			if (fileBuffer && !fields.extension) return API.v1.failure('Extension required');
+
+			const soundToUpdate = await CustomSounds.findOneById<Pick<ICustomSound, '_id' | 'name' | 'extension'>>(fields._id, {
+				projection: { _id: 1, name: 1, extension: 1 },
+			});
+			if (!soundToUpdate) {
+				return API.v1.failure('Custom Sound not found.');
+			}
+
+			const nextExtension = fileBuffer ? fields.extension : soundToUpdate.extension;
+
+			try {
+				if (fileBuffer) {
+					await uploadCustomSound(fileBuffer, mimetype, {
+						_id: fields._id,
+						name: fields.name,
+						previousExtension: soundToUpdate.extension,
+						extension: nextExtension,
+					});
+				}
+				await insertOrUpdateSound({
+					_id: fields._id,
+					name: fields.name,
+					extension: nextExtension,
+					previousName: soundToUpdate.name,
+					previousExtension: soundToUpdate.extension,
+				});
+			} catch (error) {
+				SystemLogger.error({ error });
+				return API.v1.failure(error instanceof Error ? error.message : 'Unknown error');
+			}
+			return API.v1.success({});
+		},
 	);
 
 export type CustomSoundEndpoints = ExtractRoutesFromAPI<typeof customSoundsEndpoints>;

apps/meteor/app/custom-sounds/server/lib/insertOrUpdateSound.ts

@@ -0,0 +1,64 @@
+import { api } from '@rocket.chat/core-services';
+import { CustomSounds } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+import type { ICustomSoundData } from '../methods/insertOrUpdateSound';
+import { RocketChatFileCustomSoundsInstance } from '../startup/custom-sounds';
+
+export const insertOrUpdateSound = async (soundData: ICustomSoundData): Promise<string> => {
+	// silently strip colon; this allows for uploading :soundname: as soundname
+	soundData.name = (soundData.name || '').replace(/:/g, '');
+
+	if (!soundData.name.trim()) {
+		throw new Meteor.Error('error-the-field-is-required', 'The field Name is required', {
+			method: 'insertOrUpdateSound',
+			field: 'Name',
+		});
+	}
+
+	// allow all characters except colon, whitespace, comma, >, <, &, ", ', /, \, (, )
+	// more practical than allowing specific sets of characters; also allows foreign languages
+	const nameValidation = /[\s,:><&"'\/\\\(\)]/;
+
+	if (nameValidation.test(soundData.name)) {
+		throw new Meteor.Error('error-input-is-not-a-valid-field', `${soundData.name} is not a valid name`, {
+			method: 'insertOrUpdateSound',
+			input: soundData.name,
+			field: 'Name',
+		});
+	}
+
+	const matchingResults = await CustomSounds.findByName(soundData.name, soundData._id).toArray();
+
+	if (matchingResults.length > 0) {
+		throw new Meteor.Error('Custom_Sound_Error_Name_Already_In_Use', 'The custom sound name is already in use', {
+			method: 'insertOrUpdateSound',
+		});
+	}
+
+	if (!soundData._id) {
+		return (
+			await CustomSounds.create({
+				name: soundData.name,
+				extension: soundData.extension,
+			})
+		).insertedId;
+	}
+
+	if (soundData.newFile) {
+		await RocketChatFileCustomSoundsInstance.deleteFile(`${soundData._id}.${soundData.previousExtension}`);
+	}
+
+	if (soundData.name !== soundData.previousName || soundData.extension !== soundData.previousExtension) {
+		await CustomSounds.updateById(soundData._id, { name: soundData.name, extension: soundData.extension });
+		void api.broadcast('notify.updateCustomSound', {
+			soundData: {
+				_id: soundData._id,
+				name: soundData.name,
+				extension: soundData.extension,
+			},
+		});
+	}
+
+	return soundData._id;
+};

apps/meteor/app/custom-sounds/server/lib/uploadCustomSound.ts

@@ -0,0 +1,35 @@
+import { api } from '@rocket.chat/core-services';
+import type { RequiredField } from '@rocket.chat/core-typings';
+
+import { RocketChatFile } from '../../../file/server';
+import type { ICustomSoundData } from '../methods/insertOrUpdateSound';
+import { RocketChatFileCustomSoundsInstance } from '../startup/custom-sounds';
+
+export const uploadCustomSound = async (
+	buffer: Buffer,
+	contentType: string,
+	soundData: RequiredField<ICustomSoundData, '_id'>,
+): Promise<void> => {
+	const rs = RocketChatFile.bufferToStream(buffer);
+	await RocketChatFileCustomSoundsInstance.deleteFile(`${soundData._id}.${soundData.previousExtension}`);
+
+	return new Promise((resolve, reject) => {
+		const ws = RocketChatFileCustomSoundsInstance.createWriteStream(`${soundData._id}.${soundData.extension}`, contentType);
+
+		ws.on('error', (err: Error) => {
+			reject(err);
+		});
+
+		rs.on('error', (err: Error) => {
+			ws.destroy();
+			reject(err);
+		});
+
+		ws.on('end', () => {
+			setTimeout(() => api.broadcast('notify.updateCustomSound', { soundData }), 500);
+			resolve();
+		});
+
+		rs.pipe(ws);
+	});
+};

apps/meteor/app/custom-sounds/server/methods/insertOrUpdateSound.ts

@@ -1,11 +1,9 @@
-import { api } from '@rocket.chat/core-services';
 import type { ServerMethods } from '@rocket.chat/ddp-client';
-import { CustomSounds } from '@rocket.chat/models';
 import { check } from 'meteor/check';
 import { Meteor } from 'meteor/meteor';
 
 import { hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
-import { RocketChatFileCustomSoundsInstance } from '../startup/custom-sounds';
+import { insertOrUpdateSound } from '../lib/insertOrUpdateSound';
 
 export type ICustomSoundData = {
 	_id?: string;
@@ -32,71 +30,9 @@ Meteor.methods<ServerMethods>({
 		if (!this.userId || !(await hasPermissionAsync(this.userId, 'manage-sounds'))) {
 			throw new Meteor.Error('not_authorized');
 		}
-
-		if (!soundData.name?.trim()) {
-			throw new Meteor.Error('error-the-field-is-required', 'The field Name is required', {
-				method: 'insertOrUpdateSound',
-				field: 'Name',
-			});
-		}
-
-		// let nameValidation = new RegExp('^[0-9a-zA-Z-_+;.]+$');
-
-		// allow all characters except colon, whitespace, comma, >, <, &, ", ', /, \, (, )
-		// more practical than allowing specific sets of characters; also allows foreign languages
-		const nameValidation = /[\s,:><&"'\/\\\(\)]/;
-
-		// silently strip colon; this allows for uploading :soundname: as soundname
-		soundData.name = soundData.name.replace(/:/g, '');
-
-		if (nameValidation.test(soundData.name)) {
-			throw new Meteor.Error('error-input-is-not-a-valid-field', `${soundData.name} is not a valid name`, {
-				method: 'insertOrUpdateSound',
-				input: soundData.name,
-				field: 'Name',
-			});
-		}
-
-		let matchingResults = [];
-
 		if (soundData._id) {
 			check(soundData._id, String);
-			matchingResults = await CustomSounds.findByNameExceptId(soundData.name, soundData._id).toArray();
-		} else {
-			matchingResults = await CustomSounds.findByName(soundData.name).toArray();
 		}
-
-		if (matchingResults.length > 0) {
-			throw new Meteor.Error('Custom_Sound_Error_Name_Already_In_Use', 'The custom sound name is already in use', {
-				method: 'insertOrUpdateSound',
-			});
-		}
-
-		if (!soundData._id) {
-			return (
-				await CustomSounds.create({
-					name: soundData.name,
-					extension: soundData.extension,
-				})
-			).insertedId;
-		}
-
-		// update sound
-		if (soundData.newFile) {
-			await RocketChatFileCustomSoundsInstance.deleteFile(`${soundData._id}.${soundData.previousExtension}`);
-		}
-
-		if (soundData.name !== soundData.previousName) {
-			await CustomSounds.setName(soundData._id, soundData.name);
-			void api.broadcast('notify.updateCustomSound', {
-				soundData: {
-					_id: soundData._id,
-					name: soundData.name,
-					extension: soundData.extension,
-				},
-			});
-		}
-
-		return soundData._id;
+		return insertOrUpdateSound(soundData);
 	},
 });