RocketChat / RocketChat/Rocket.Chat

Missing Ajv Schema Validation on users REST API endpoints

Open
#39,223 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

type: feature
Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description

The legacy users REST API endpoints currently lack explicit schema validation. Inputs are weakly typed or imperatively checked inside the handlers, which can lead to runtime regressions.

The following endpoints need to be formally typed and migrated using ajv via @rocket.chat/rest-typings:

  • users.getAvatar
  • users.deleteOwnAccount
  • users.resetAvatar
  • users.forgotPassword

Proposed Solution

  1. Add TypeBox/Ajv JSON schemas to packages/rest-typings.
  2. Export the typing boundaries.
  3. Attach the validateParams option onto the API.v1.addRoute config block for these endpoints.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in packages/rest-typings and inspect the existing TypeBox/Ajv schema patterns and exported typing boundaries. Then locate the API.v1.addRoute config blocks for users.getAvatar, users.deleteOwnAccount, users.resetAvatar, and users.forgotPassword, and compare how validateParams is attached elsewhere. Done means each listed endpoint has a schema in rest-typings and uses its exported boundary for validation.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
api, backend-api-design
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.