RocketChat / RocketChat/Rocket.Chat

Livechat triggers: agent sender resolution is globally cached for 1 hour, causing cross-trigger sender leakage

Open
#39,150 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: bug valid
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

Livechat trigger agent resolution is cached globally for 1 hour in the widget, causing sender/agent leakage across different trigger configurations.

A trigger action that resolves agent A can affect later trigger actions that should resolve agent B (or queue), because getAgent() reuses a single module-level cached Promise instead of caching by trigger sender context.

Steps to reproduce:
  1. Enable Livechat and create two triggers:
    • Trigger 1:
      • Condition: chat-opened-by-visitor
      • Action: send-message
      • Params: sender=custom, name=agent_one, msg=first trigger message
    • Trigger 2:
      • Condition: after-guest-registration
      • Action: send-message
      • Params: sender=custom, name=agent_two, msg=second trigger message
  2. Open /livechat as a fresh visitor and open the widget.
  3. Confirm Trigger 1 fires and message sender is agent_one.
  4. Register/send first visitor message so Trigger 2 fires.
  5. Observe Trigger 2 message sender.
Expected behavior:

Each trigger action should resolve sender/agent independently from its own action params.

For the example above, Trigger 2 should use agent_two.

Actual behavior:

Trigger 2 may reuse the cached result from Trigger 1 and still use agent_one (or stale queue result), because sender resolution is globally cached for 1 hour.

Server Setup Information:
  • Version of Rocket.Chat Server: develop (observed from current source code path)
  • License Type: N/A
  • Number of Users: N/A
  • Operating System: N/A
  • Deployment Method: Local development
  • Number of Running Instances: 1
  • DB Replicaset Oplog: N/A
  • NodeJS Version: N/A
  • MongoDB Version: N/A
Client Setup Information
  • Desktop App or Browser Version: Browser (Livechat widget)
  • Operating System: Any
Additional context

Relevant code paths:

  • packages/livechat/src/lib/triggerUtils.ts
    • Global cache: let agentPromise ...
    • TTL: agentCacheExpiry = 3600000
    • getAgent() returns the same cached promise for all actions during TTL.
  • packages/livechat/src/lib/triggers.js
    • Multiple triggers share execution path: processTriggers -> schedule -> fire.
  • packages/livechat/src/lib/triggerActions.ts
    • Both send-message and use-external-service actions call getAgent().

This creates cross-trigger contamination and stale sender behavior.

Relevant logs:

No server error is required to reproduce.
Behavior is visible in widget trigger messages (sender mismatch with configured trigger action params).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in packages/livechat/src/lib/triggerUtils.ts by inspecting the module-level agentPromise, its one-hour expiry, and getAgent(). Then trace the calls from packages/livechat/src/lib/triggerActions.ts through packages/livechat/src/lib/triggers.js; done means separate trigger actions resolve their configured senders independently without reusing another trigger's agent or queue result.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, typescript
Domain
frontend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.