Skip to content

fix: clean up login tokens in users.deactivateidle#40570

Merged
julio-rocketchat merged 1 commit into
release-7.10.12from
backport-7.10.12-40496
May 16, 2026
Merged

fix: clean up login tokens in users.deactivateidle#40570
julio-rocketchat merged 1 commit into
release-7.10.12from
backport-7.10.12-40496

Conversation

@dionisio-bot
Copy link
Copy Markdown
Contributor

@dionisio-bot dionisio-bot Bot commented May 15, 2026

Backport of #40496

@dionisio-bot dionisio-bot Bot requested review from a team as code owners May 15, 2026 20:42
@dionisio-bot dionisio-bot Bot requested a review from julio-rocketchat May 15, 2026 20:42
@changeset-bot
Copy link
Copy Markdown

changeset-bot Bot commented May 15, 2026

🦋 Changeset detected

Latest commit: fbd0540

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 39 packages
Name Type
@rocket.chat/model-typings Patch
@rocket.chat/models Patch
@rocket.chat/meteor Patch
@rocket.chat/apps Patch
@rocket.chat/account-service Patch
@rocket.chat/authorization-service Patch
@rocket.chat/ddp-streamer Patch
@rocket.chat/omnichannel-transcript Patch
@rocket.chat/presence-service Patch
@rocket.chat/queue-worker Patch
@rocket.chat/stream-hub-service Patch
@rocket.chat/omnichannel-services Patch
rocketchat-services Patch
@rocket.chat/core-services Patch
@rocket.chat/cron Patch
@rocket.chat/instance-status Patch
@rocket.chat/omni-core Patch
@rocket.chat/omni-core-ee Patch
@rocket.chat/presence Patch
@rocket.chat/network-broker Patch
@rocket.chat/core-typings Patch
@rocket.chat/rest-typings Patch
@rocket.chat/uikit-playground Patch
@rocket.chat/api-client Patch
@rocket.chat/ddp-client Patch
@rocket.chat/freeswitch Patch
@rocket.chat/fuselage-ui-kit Patch
@rocket.chat/gazzodown Patch
@rocket.chat/http-router Patch
@rocket.chat/livechat Patch
@rocket.chat/ui-avatar Patch
@rocket.chat/ui-client Patch
@rocket.chat/ui-contexts Patch
@rocket.chat/web-ui-registration Patch
@rocket.chat/license Patch
@rocket.chat/pdf-worker Patch
@rocket.chat/mock-providers Patch
@rocket.chat/ui-video-conf Patch
@rocket.chat/ui-voip Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@dionisio-bot dionisio-bot Bot added the backport Used to inform backported PR label May 15, 2026
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 5 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/meteor/app/api/server/v1/users.ts">

<violation number="1" location="apps/meteor/app/api/server/v1/users.ts:423">
P2: The new read-then-update flow is non-atomic and can send `watch.users` updates for users that were not actually deactivated.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
Re-trigger cubic

lastLoggedIn.setDate(lastLoggedIn.getDate() - daysIdle);

// since we're deactiving users that are not logged in, there is no need to send data through WS
const ids = await Users.findActiveNotLoggedInAfterWithRole(lastLoggedIn, role, { projection: { _id: 1 } })
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The new read-then-update flow is non-atomic and can send watch.users updates for users that were not actually deactivated.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/users.ts, line 423:

<comment>The new read-then-update flow is non-atomic and can send `watch.users` updates for users that were not actually deactivated.</comment>

<file context>
@@ -420,9 +420,20 @@ API.v1.addRoute(
 			lastLoggedIn.setDate(lastLoggedIn.getDate() - daysIdle);
 
-			// since we're deactiving users that are not logged in, there is no need to send data through WS
+			const ids = await Users.findActiveNotLoggedInAfterWithRole(lastLoggedIn, role, { projection: { _id: 1 } })
+				.map(({ _id }: { _id: string }) => _id)
+				.toArray();
</file context>

@codecov
Copy link
Copy Markdown

codecov Bot commented May 15, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release-7.10.12@46e01d8). Learn more about missing BASE report.

Additional details and impacted files

Impacted file tree graph

@@                Coverage Diff                 @@
##             release-7.10.12   #40570   +/-   ##
==================================================
  Coverage                   ?   66.26%           
==================================================
  Files                      ?     3311           
  Lines                      ?   111285           
  Branches                   ?    21068           
==================================================
  Hits                       ?    73741           
  Misses                     ?    34815           
  Partials                   ?     2729           
Flag Coverage Δ
e2e 57.48% <ø> (?)
e2e-api 35.61% <ø> (?)
unit 71.50% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@julio-rocketchat julio-rocketchat merged commit efeaccc into release-7.10.12 May 16, 2026
226 of 243 checks passed
@julio-rocketchat julio-rocketchat deleted the backport-7.10.12-40496 branch May 16, 2026 05:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport Used to inform backported PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants