Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
133 changes: 109 additions & 24 deletions apps/meteor/app/api/server/v1/stats.ts
Original file line number Diff line number Diff line change
@@ -1,13 +1,64 @@
import type { IStats } from '@rocket.chat/core-typings';
import type { PaginatedResult } from '@rocket.chat/rest-typings';
import {
ajv,
isStatisticsProps,
isStatisticsListProps,
validateUnauthorizedErrorResponse,
validateBadRequestErrorResponse,
} from '@rocket.chat/rest-typings';

import { getStatistics, getLastStatistics } from '../../../statistics/server';
import telemetryEvent from '../../../statistics/server/lib/telemetryEvents';
import type { ExtractRoutesFromAPI } from '../ApiClass';
import { API } from '../api';
import { getPaginationItems } from '../helpers/getPaginationItems';

API.v1.addRoute(
'statistics',
{ authRequired: true },
{
async get() {
type TelemetryBody = {
params?: { eventName: string; [key: string]: unknown }[];
};

const TelemetryBodySchema = {
type: 'object',
properties: {
params: {
type: 'array',
items: {
type: 'object',
properties: {
eventName: { type: 'string' },
},
required: ['eventName'],
additionalProperties: true,
},
nullable: true,
},
},
additionalProperties: true,
};

const isTelemetryBody = ajv.compile<TelemetryBody>(TelemetryBodySchema);

const statsEndpoints = API.v1
.get(
'statistics',
{
authRequired: true,
query: isStatisticsProps,
response: {
200: ajv.compile<IStats & { success: true }>({
Copy link
Copy Markdown
Contributor

@cubic-dev-ai cubic-dev-ai bot Mar 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: Response schemas claim IStats-typed payloads but do not validate IStats fields at runtime, creating a false API contract.

Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At apps/meteor/app/api/server/v1/stats.ts, line 49:

<comment>Response schemas claim `IStats`-typed payloads but do not validate `IStats` fields at runtime, creating a false API contract.</comment>

<file context>
@@ -1,13 +1,64 @@
+			authRequired: true,
+			query: isStatisticsProps,
+			response: {
+				200: ajv.compile<IStats & { success: true }>({
+					type: 'object',
+					additionalProperties: true,
</file context>
Fix with Cubic

type: 'object',
additionalProperties: true,
properties: {
success: { type: 'boolean', enum: [true] },
},
required: ['success'],
}),
400: validateBadRequestErrorResponse,
401: validateUnauthorizedErrorResponse,
},
},
async function action() {
const { refresh = 'false' } = this.queryParams;

return API.v1.success(
Expand All @@ -17,14 +68,30 @@ API.v1.addRoute(
}),
);
},
},
);

API.v1.addRoute(
'statistics.list',
{ authRequired: true },
{
async get() {
)
.get(
'statistics.list',
{
authRequired: true,
query: isStatisticsListProps,
response: {
200: ajv.compile<PaginatedResult<{ statistics: IStats[] }>>({
type: 'object',
properties: {
statistics: { type: 'array', items: { type: 'object', additionalProperties: true } },
count: { type: 'number' },
offset: { type: 'number' },
total: { type: 'number' },
success: { type: 'boolean', enum: [true] },
},
required: ['statistics', 'count', 'offset', 'total', 'success'],
additionalProperties: false,
}),
400: validateBadRequestErrorResponse,
401: validateUnauthorizedErrorResponse,
},
},
async function action() {
const { offset, count } = await getPaginationItems(this.queryParams);
const { sort, fields, query } = await this.parseJsonQuery();

Expand All @@ -41,22 +108,40 @@ API.v1.addRoute(
}),
);
},
},
);

API.v1.addRoute(
'statistics.telemetry',
{ authRequired: true },
{
post() {
)
.post(
'statistics.telemetry',
{
authRequired: true,
body: isTelemetryBody,
response: {
200: ajv.compile<void>({
type: 'object',
properties: {
success: { type: 'boolean', enum: [true] },
},
required: ['success'],
additionalProperties: false,
}),
400: validateBadRequestErrorResponse,
401: validateUnauthorizedErrorResponse,
},
},
function action() {
const events = this.bodyParams;

events?.params?.forEach((event) => {
const { eventName, ...params } = event;
void telemetryEvent.call(eventName, params);
void telemetryEvent.call(eventName as import('@rocket.chat/core-services').TelemetryEvents, params as any);
});

return API.v1.success();
},
},
);
);

export type StatsEndpoints = ExtractRoutesFromAPI<typeof statsEndpoints>;

declare module '@rocket.chat/rest-typings' {
// eslint-disable-next-line @typescript-eslint/naming-convention, @typescript-eslint/no-empty-interface
interface Endpoints extends StatsEndpoints {}
}
2 changes: 2 additions & 0 deletions packages/rest-typings/src/index.ts
Original file line number Diff line number Diff line change
Expand Up @@ -257,5 +257,7 @@ export * from './v1/cloud';
export * from './v1/banners';
export * from './default';

export * from './v1/statistics';

// Export the ajv instance for use in other packages
export * from './v1/Ajv';