feat: Virtru as attribute store (#40634)

Author: KevLehman

.changeset/khaki-gifts-follow.md

@@ -0,0 +1,13 @@
+---
+"@rocket.chat/meteor": minor
+"@rocket.chat/abac": minor
+---
+
+Allows using Virtru as the attribute store for ABAC decisions.
+
+### Important
+
+- When using virtru as the store, the internal attribute store is disabled.
+- On switch, existing ABAC attributes from rooms will be removed. Rooms will continue to be private & no users will be removed until you add attributes again.
+- Users are only allowed to see & edit rooms they have access to. Access decision is evaluated on Virtru
+- A user/app with the `bypass-abac-store-validation` permission can assign any attributes to rooms, even if the user doesn't have them assigned on Virtru.

apps/meteor/app/api/server/lib/rooms.ts

@@ -1,7 +1,8 @@
-import type { IRoom, ISubscription, RoomAdminFieldsType, RoomType } from '@rocket.chat/core-typings';
+import type { IRoom, IRoomAbacRedaction, ISubscription, RoomAdminFieldsType, RoomType } from '@rocket.chat/core-typings';
 import { Rooms, Subscriptions } from '@rocket.chat/models';
 import type { FindOptions, Sort } from 'mongodb';
 
+import { scopeAdminRoomsForAbac } from './scopeAdminRoomsForAbac';
 import { adminFields } from '../../../../lib/rooms/adminFields';
 import { hasAtLeastOnePermissionAsync, hasPermissionAsync } from '../../../authorization/server/functions/hasPermission';
 import { stripABACManagedFieldsForAdmin } from '../../../authorization/server/lib/isABACManagedRoom';
@@ -17,7 +18,7 @@ export async function findAdminRooms({
 	types: Array<RoomType | 'discussions' | 'teams'>;
 	pagination: { offset: number; count: number; sort: Sort };
 }): Promise<{
-	rooms: IRoom[];
+	rooms: Array<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>;
 	count: number;
 	offset: number;
 	total: number;
@@ -49,14 +50,20 @@ export async function findAdminRooms({
 	]);
 
 	return {
-		rooms,
+		rooms: await scopeAdminRoomsForAbac(rooms, uid),
 		count: rooms.length,
 		offset,
 		total,
 	};
 }
 
-export async function findAdminRoom({ uid, rid }: { uid: string; rid: string }): Promise<Pick<IRoom, RoomAdminFieldsType> | null> {
+export async function findAdminRoom({
+	uid,
+	rid,
+}: {
+	uid: string;
+	rid: string;
+}): Promise<(Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction) | null> {
 	if (!(await hasPermissionAsync(uid, 'view-room-administration'))) {
 		throw new Error('error-not-authorized');
 	}
@@ -65,7 +72,9 @@ export async function findAdminRoom({ uid, rid }: { uid: string; rid: string }):
 	if (!room) {
 		return null;
 	}
-	return stripABACManagedFieldsForAdmin(room);
+
+	const [scoped] = await scopeAdminRoomsForAbac([stripABACManagedFieldsForAdmin(room)], uid);
+	return scoped ?? null;
 }
 
 export async function findChannelAndPrivateAutocomplete({ uid, selector }: { uid: string; selector: { name: string } }): Promise<{

apps/meteor/app/api/server/lib/scopeAdminRoomsForAbac.ts

@@ -0,0 +1,7 @@
+import type { IRoom, IRoomAbacRedaction, RoomAdminFieldsType } from '@rocket.chat/core-typings';
+import { makeFunction } from '@rocket.chat/patch-injection';
+
+export const scopeAdminRoomsForAbac = makeFunction(
+	async (rooms: Pick<IRoom, RoomAdminFieldsType>[], _uid: string): Promise<Array<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>> =>
+		rooms,
+);

apps/meteor/app/api/server/v1/rooms.ts

@@ -1,6 +1,7 @@
 import { FederationMatrix, MeteorError, Team } from '@rocket.chat/core-services';
 import {
 	type IRoom,
+	type IRoomAbacRedaction,
 	type IUpload,
 	type RequiredField,
 	type RoomAdminFieldsType,
@@ -89,6 +90,7 @@ import {
 	findChannelAndPrivateAutocompleteWithPagination,
 	findRoomsAvailableForTeams,
 } from '../lib/rooms';
+import { scopeAdminRoomsForAbac } from '../lib/scopeAdminRoomsForAbac';
 
 export async function findRoomByIdOrName({
 	params,
@@ -712,10 +714,15 @@ API.v1.get(
 		authRequired: true,
 		query: isRoomsAdminRoomsProps,
 		response: {
-			200: ajv.compile<{ rooms: IRoom[]; count: number; offset: number; total: number }>({
+			200: ajv.compile<{
+				rooms: Array<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>;
+				count: number;
+				offset: number;
+				total: number;
+			}>({
 				type: 'object',
 				properties: {
-					rooms: { type: 'array', items: { type: 'object' } }, // relaxed: IRoom with admin fields
+					rooms: { type: 'array', items: { type: 'object' } }, // relaxed: IRoom with admin fields + optional ABAC redaction
 					count: { type: 'number' },
 					offset: { type: 'number' },
 					total: { type: 'number' },
@@ -785,10 +792,17 @@ API.v1.get(
 		authRequired: true,
 		query: isRoomsAdminRoomsGetRoomProps,
 		response: {
-			200: ajv.compile<Pick<IRoom, RoomAdminFieldsType>>({
+			200: ajv.compile<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>({
 				allOf: [
 					{ $ref: '#/components/schemas/IRoomAdmin' },
-					{ type: 'object', properties: { success: { type: 'boolean', enum: [true] } }, required: ['success'] },
+					{
+						type: 'object',
+						properties: {
+							success: { type: 'boolean', enum: [true] },
+							abacAttributesRedacted: { type: 'boolean' },
+						},
+						required: ['success'],
+					},
 				],
 			}),
 			400: validateBadRequestErrorResponse,
@@ -1447,7 +1461,7 @@ export const roomEndpoints = API.v1
 				401: validateUnauthorizedErrorResponse,
 				403: validateUnauthorizedErrorResponse,
 				200: ajv.compile<{
-					rooms: IRoom[];
+					rooms: Array<Pick<IRoom, RoomAdminFieldsType> & IRoomAbacRedaction>;
 					count: number;
 					offset: number;
 					total: number;
@@ -1485,7 +1499,7 @@ export const roomEndpoints = API.v1
 			const [rooms, total] = await Promise.all([cursor.map(stripABACManagedFieldsForAdmin).toArray(), totalCount]);
 
 			return API.v1.success({
-				rooms,
+				rooms: await scopeAdminRoomsForAbac(rooms, this.userId),
 				count: rooms.length,
 				offset,
 				total,

apps/meteor/client/views/admin/ABAC/ABACLogsTab/LogsPage.tsx

@@ -114,6 +114,14 @@ const LogsPage = () => {
 									.join(', ') ?? t('Empty'),
 							room: event.data?.find((item) => item.key === 'room')?.value?.name ?? '',
 						};
+					case 'abac.attribute.store.switched':
+						return {
+							...eventInfo,
+							element: t('ABAC_Attribute_Store'),
+							action: t('ABAC_Attribute_Store_Switched'),
+							name: `${event.data?.find((item) => item.key === 'from')?.value} -> ${event.data?.find((item) => item.key === 'to')?.value}`,
+							room: t('ABAC_Rooms_Affected', { count: Number(event.data?.find((item) => item.key === 'roomsAffected')?.value ?? 0) }),
+						};
 					default:
 						return null;
 				}

apps/meteor/client/views/admin/ABAC/ABACRoomsTab/RoomForm.tsx

@@ -1,4 +1,4 @@
-import { Box, Field, FieldLabel, FieldRow, FieldError, ButtonGroup, Button, ContextualbarFooter } from '@rocket.chat/fuselage';
+import { Box, Callout, Field, FieldLabel, FieldRow, FieldError, ButtonGroup, Button, ContextualbarFooter } from '@rocket.chat/fuselage';
 import { useEffectEvent } from '@rocket.chat/fuselage-hooks';
 import { GenericModal, ContextualbarScrollableContent } from '@rocket.chat/ui-client';
 import { useSetModal } from '@rocket.chat/ui-contexts';
@@ -16,14 +16,15 @@ type RoomFormProps = {
 	onSave: (data: RoomFormData) => void;
 	roomInfo?: { rid: string; name: string };
 	setSelectedRoomLabel: Dispatch<SetStateAction<string>>;
+	redacted?: boolean;
 };
 
 export type RoomFormData = {
 	room: string;
 	attributes: { key: string; values: string[] }[];
 };
 
-const RoomForm = ({ onClose, onSave, roomInfo, setSelectedRoomLabel }: RoomFormProps) => {
+const RoomForm = ({ onClose, onSave, roomInfo, setSelectedRoomLabel, redacted = false }: RoomFormProps) => {
 	const {
 		control,
 		handleSubmit,
@@ -110,10 +111,17 @@ const RoomForm = ({ onClose, onSave, roomInfo, setSelectedRoomLabel }: RoomFormP
 						</FieldError>
 					)}
 				</Field>
-				<RoomFormAttributeFields fields={fields} remove={remove} />
+				{redacted && (
+					<Box mbe={16}>
+						<Callout type='warning' title={t('ABAC_Attributes_Redacted')}>
+							{t('ABAC_Attributes_Redacted_Description')}
+						</Callout>
+					</Box>
+				)}
+				<RoomFormAttributeFields fields={fields} remove={remove} disabled={redacted} />
 				<Button
 					w='full'
-					disabled={fields.length >= 10}
+					disabled={redacted || fields.length >= 10}
 					onClick={() => {
 						append({ key: '', values: [] });
 					}}
@@ -124,7 +132,7 @@ const RoomForm = ({ onClose, onSave, roomInfo, setSelectedRoomLabel }: RoomFormP
 			<ContextualbarFooter>
 				<ButtonGroup stretch>
 					<Button onClick={onClose}>{t('Cancel')}</Button>
-					<Button type='submit' form={formId} disabled={!isValid || !isDirty} primary>
+					<Button type='submit' form={formId} disabled={redacted || !isValid || !isDirty} primary>
 						{t('Save')}
 					</Button>
 				</ButtonGroup>

apps/meteor/client/views/admin/ABAC/ABACRoomsTab/RoomFormAttributeField.tsx

@@ -12,9 +12,17 @@ type ABACAttributeAutocompleteProps = {
 	index: number;
 	attributeList: { value: string; label: string; attributeValues: string[] }[];
 	required?: boolean;
+	disabled?: boolean;
 };
 
-const RoomFormAttributeField = ({ labelId, onRemove, index, attributeList, required = false }: ABACAttributeAutocompleteProps) => {
+const RoomFormAttributeField = ({
+	labelId,
+	onRemove,
+	index,
+	attributeList,
+	required = false,
+	disabled = false,
+}: ABACAttributeAutocompleteProps) => {
 	const { t } = useTranslation();
 
 	const { control, getValues, resetField } = useFormContext<RoomFormData>();
@@ -71,6 +79,7 @@ const RoomFormAttributeField = ({ labelId, onRemove, index, attributeList, requi
 					mbe={4}
 					error={keyFieldState.error?.message}
 					withTruncatedText
+					disabled={disabled}
 					onChange={(value) => {
 						keyField.onChange(value);
 						resetField(`attributes.${index}.values`, { defaultValue: [] });
@@ -94,6 +103,7 @@ const RoomFormAttributeField = ({ labelId, onRemove, index, attributeList, requi
 					options={valueOptions}
 					placeholder={t('ABAC_Select_Attribute_Values')}
 					error={valuesFieldState.error?.message}
+					disabled={disabled}
 				/>
 			</FieldRow>
 			{valuesFieldState.error && (
@@ -102,7 +112,7 @@ const RoomFormAttributeField = ({ labelId, onRemove, index, attributeList, requi
 				</FieldError>
 			)}
 			{index !== 0 && (
-				<Button onClick={onRemove} title={t('Remove')} mbs={8}>
+				<Button onClick={onRemove} title={t('Remove')} mbs={8} disabled={disabled}>
 					{t('Remove')}
 				</Button>
 			)}

apps/meteor/client/views/admin/ABAC/ABACRoomsTab/RoomFormAttributeFields.spec.tsx

@@ -43,7 +43,9 @@ const appRoot = mockAppRoot()
 		ABAC_Search_Attribute: 'Search attribute',
 		ABAC_Select_Attribute_Values: 'Select attribute values',
 		Remove: 'Remove',
+		ABAC_Picker_External_Store_Helper: 'Available attributes are limited to those you possess.',
 	})
+	.withSetting('ABAC_Attribute_Store', 'local')
 	.build();
 
 const FormProviderWrapper = ({ children, defaultValues }: { children: ReactNode; defaultValues?: Partial<RoomFormData> }) => {
@@ -133,4 +135,37 @@ describe('RoomFormAttributeFields', () => {
 		expect(screen.getByText('Public')).toBeInTheDocument();
 		expect(screen.getByText('Internal')).toBeInTheDocument();
 	});
+
+	it('should render fields with disabled inputs when disabled prop is true', () => {
+		const fields = [{ id: 'field-1' }, { id: 'field-2' }];
+
+		render(
+			<FormProviderWrapper>
+				<RoomFormAttributeFields fields={fields} remove={mockRemove} disabled />
+			</FormProviderWrapper>,
+			{ wrapper: appRoot },
+		);
+
+		const attributeLabels = screen.getAllByText('Attribute');
+		expect(attributeLabels).toHaveLength(2);
+
+		screen.getAllByPlaceholderText('Search attribute').forEach((input) => expect(input).toBeDisabled());
+		screen.getAllByRole('combobox').forEach((input) => expect(input).toBeDisabled());
+		expect(screen.getByRole('button', { name: 'Remove' })).toBeDisabled();
+	});
+
+	it('should render fields without disabled state when disabled prop is false', () => {
+		const fields = [{ id: 'field-1' }];
+
+		render(
+			<FormProviderWrapper>
+				<RoomFormAttributeFields fields={fields} remove={mockRemove} disabled={false} />
+			</FormProviderWrapper>,
+			{ wrapper: appRoot },
+		);
+
+		expect(screen.getAllByText('Attribute')).toHaveLength(1);
+		screen.getAllByPlaceholderText('Search attribute').forEach((input) => expect(input).not.toBeDisabled());
+		screen.getAllByRole('combobox').forEach((input) => expect(input).not.toBeDisabled());
+	});
 });

apps/meteor/client/views/admin/ABAC/ABACRoomsTab/RoomFormAttributeFields.tsx

@@ -1,39 +1,52 @@
-import { Field, FieldLabel, InputBoxSkeleton } from '@rocket.chat/fuselage';
+import { Box, Field, FieldLabel, InputBoxSkeleton } from '@rocket.chat/fuselage';
 import { useTranslation } from 'react-i18next';
 
 import RoomFormAttributeField from './RoomFormAttributeField';
 import { useAttributeList } from '../hooks/useAttributeList';
+import { useIsExternalAttributeStore } from '../hooks/useIsExternalAttributeStore';
 
 type RoomFormAttributeFieldsProps = {
 	fields: { id: string }[];
 	remove: (index: number) => void;
+	disabled?: boolean;
 };
 
-const RoomFormAttributeFields = ({ fields, remove }: RoomFormAttributeFieldsProps) => {
+const RoomFormAttributeFields = ({ fields, remove, disabled = false }: RoomFormAttributeFieldsProps) => {
 	const { t } = useTranslation();
+	const isExternalAttributeStore = useIsExternalAttributeStore();
 
 	const { data: attributeList, isLoading } = useAttributeList();
 
 	if (isLoading || !attributeList) {
 		return <InputBoxSkeleton />;
 	}
 
-	return fields.map((field, index) => (
-		<Field key={field.id}>
-			<FieldLabel id={field.id} required={index === 0}>
-				{t('Attribute')}
-			</FieldLabel>
-			<RoomFormAttributeField
-				labelId={field.id}
-				attributeList={attributeList.attributes}
-				required={index === 0}
-				onRemove={() => {
-					remove(index);
-				}}
-				index={index}
-			/>
-		</Field>
-	));
+	return (
+		<>
+			{isExternalAttributeStore && (
+				<Box mbe={8} color='annotation' fontSize='p2'>
+					{t('ABAC_Picker_External_Store_Helper')}
+				</Box>
+			)}
+			{fields.map((field, index) => (
+				<Field key={field.id}>
+					<FieldLabel id={field.id} required={index === 0}>
+						{t('Attribute')}
+					</FieldLabel>
+					<RoomFormAttributeField
+						labelId={field.id}
+						attributeList={attributeList.attributes}
+						required={index === 0}
+						onRemove={() => {
+							remove(index);
+						}}
+						index={index}
+						disabled={disabled}
+					/>
+				</Field>
+			))}
+		</>
+	);
 };
 
 export default RoomFormAttributeFields;

apps/meteor/client/views/admin/ABAC/ABACRoomsTab/RoomFormAutocomplete.tsx

@@ -28,7 +28,7 @@ const RoomFormAutocomplete = ({ value, onSelectedRoom, ...props }: RoomFormAutoc
 		placeholderData: keepPreviousData,
 		select: (data) =>
 			data.rooms
-				.filter((room) => !room.abacAttributes || room.abacAttributes.length === 0)
+				.filter((room) => !room.abacAttributesRedacted && (!room.abacAttributes || room.abacAttributes.length === 0))
 				.map((room) => ({
 					value: room._id,
 					label: { name: room.fname || room.name },