fix: DM from a deactivated user not in read-only (#40767)

Co-authored-by: cubic-dev-ai[bot] <191113872+cubic-dev-ai[bot]@users.noreply.github.com>

Author: KevLehman

.changeset/early-deer-fry.md

@@ -0,0 +1,5 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixes an issue that allowed users to create a DM and send messages to a deactivated account

apps/meteor/app/lib/server/functions/createDirectRoom.ts

@@ -82,6 +82,9 @@ export async function createDirectRoom(
 
 	const isNewRoom = !room;
 
+	// Mirror setUserActiveStatus: a 1-on-1 DM containing a deactivated user is read-only
+	const isReadOnlyForDeactivatedMember = uids.length === 2 && roomMembers.some((member) => member.active === false);
+
 	const roomInfo = {
 		t: 'd',
 		usernames,
@@ -90,6 +93,7 @@ export async function createDirectRoom(
 		ts: new Date(),
 		uids,
 		...roomExtraData,
+		...(isReadOnlyForDeactivatedMember && { ro: true, reactWhenReadOnly: false }),
 	};
 
 	if (isNewRoom) {

apps/meteor/tests/end-to-end/api/methods.ts

@@ -2802,6 +2802,7 @@ describe('Meteor.methods', () => {
 		let testUserCredentials: Credentials;
 		let dmId: IRoom['_id'];
 		let dmTestId: IRoom['_id'];
+		let dmWithDeactivatedId: IRoom['_id'];
 
 		before(async () => {
 			testUser = await createUser();
@@ -2857,6 +2858,7 @@ describe('Meteor.methods', () => {
 			Promise.all([
 				deleteRoom({ type: 'd', roomId: dmId }),
 				deleteRoom({ type: 'd', roomId: dmTestId }),
+				...(dmWithDeactivatedId ? [deleteRoom({ type: 'd', roomId: dmWithDeactivatedId })] : []),
 				deleteUser(testUser),
 				deleteUser(testUser2),
 			]),
@@ -2997,6 +2999,41 @@ describe('Meteor.methods', () => {
 				.catch(done);
 		});
 
+		it('should create a new direct conversation as readonly when the target user is already deactivated', async () => {
+			const createRes = await request
+				.post(methodCall('createDirectMessage'))
+				.set(credentials)
+				.send({
+					message: JSON.stringify({
+						method: 'createDirectMessage',
+						params: [testUser2.username],
+						id: 'id',
+						msg: 'method',
+					}),
+				});
+
+			const createResult = JSON.parse(createRes.body.message);
+			expect(createResult.result).to.be.an('object');
+			expect(createResult.result).to.have.property('rid').that.is.an('string');
+			dmWithDeactivatedId = createResult.result.rid;
+
+			const roomRes = await request
+				.post(methodCall('getRoomByTypeAndName'))
+				.set(credentials)
+				.send({
+					message: JSON.stringify({
+						method: 'getRoomByTypeAndName',
+						params: ['d', dmWithDeactivatedId],
+						id: 'id',
+						msg: 'method',
+					}),
+				});
+
+			expect(roomRes.body.success).to.equal(true);
+			const result = JSON.parse(roomRes.body.message);
+			expect(result.result.ro).to.equal(true);
+		});
+
 		it('should activate another user', (done) => {
 			void request
 				.post(methodCall('setUserActiveStatus'))