chore: Add OpenAPI support to chat.delete and chat.react endpoints

[sezallagwal]

Proposed Changes

This PR integrates OpenAPI support into the Rocket.Chat API, migrating chat.delete and chat.react endpoints to the new OpenAPI pattern. The update includes improved API documentation, enhanced type safety, and response validation using AJV.

Key Changes:

• Implemented the new pattern and added AJV-based JSON schema validation for the APIs
• Used the ExtractRoutesFromAPI utility from the TypeScript definitions to dynamically derive routes from the endpoint specifications
• Enabled Swagger UI integration for these APIs
• Applied route method chaining for the endpoints
• This does not introduce any breaking changes to the endpoint logic

Tracked in: RocketChat/Rocket.Chat-Open-API#150

---

Testing

• Verified that the API response schemas are correctly documented in Swagger UI
• Confirmed that sending an empty request body returns a 400 validation error
• All tests passed without any breaking changes

---

Endpoints

• Delete a chat message
  POST /api/v1/chat.delete

• Send a reaction
  POST /api/v1/chat.react

---

Steps to Test or Reproduce

1. Run the server locally with:

   yarn dsv

2. Navigate to:

   http://localhost:3000/api-docs/
   

3. Authorize using X-Auth-Token and X-User-Id
4. Find POST /api/v1/chat.delete and execute with:

   { "msgId": "<id>", "roomId": "<rid>" }

5. Find POST /api/v1/chat.react and execute with:

   { "emoji": ":thumbsup:", "messageId": "<id>" }

6. Execute with an empty body:

   {}

   This should return a 400 validation error.

---

Swagger UI — chat.delete:

Swagger UI — chat.react:

Summary by CodeRabbit

• New Features

  • Added public chat endpoints for ignoring users and searching messages.

• Refactor

  • Moved message delete and react routes to local, nested variants and consolidated their validation and response handling for more consistent behavior.

• Notes

  • Global/delete-react public endpoints were removed in favor of the new local route layout.

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

🦋 Changeset detected

Latest commit: 9547f23

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 41 packages

Name	Type
@rocket.chat/meteor	Minor
@rocket.chat/rest-typings	Minor
@rocket.chat/api-client	Patch
@rocket.chat/core-services	Patch
@rocket.chat/ddp-client	Patch
@rocket.chat/http-router	Patch
@rocket.chat/models	Patch
@rocket.chat/ui-contexts	Major
@rocket.chat/web-ui-registration	Major
@rocket.chat/account-service	Patch
@rocket.chat/authorization-service	Patch
@rocket.chat/ddp-streamer	Patch
@rocket.chat/federation-matrix	Patch
@rocket.chat/omnichannel-services	Patch
@rocket.chat/presence	Patch
rocketchat-services	Patch
@rocket.chat/omnichannel-transcript	Patch
@rocket.chat/presence-service	Patch
@rocket.chat/queue-worker	Patch
@rocket.chat/abac	Patch
@rocket.chat/network-broker	Patch
@rocket.chat/omni-core-ee	Patch
@rocket.chat/livechat	Patch
@rocket.chat/mock-providers	Patch
@rocket.chat/cron	Patch
@rocket.chat/instance-status	Patch
@rocket.chat/omni-core	Patch
@rocket.chat/server-fetch	Patch
@rocket.chat/ui-client	Major
@rocket.chat/media-calls	Patch
@rocket.chat/uikit-playground	Patch
@rocket.chat/fuselage-ui-kit	Major
@rocket.chat/gazzodown	Major
@rocket.chat/ui-avatar	Major
@rocket.chat/ui-video-conf	Major
@rocket.chat/ui-voip	Major
@rocket.chat/core-typings	Minor
@rocket.chat/apps	Patch
@rocket.chat/model-typings	Patch
@rocket.chat/license	Patch
@rocket.chat/pdf-worker	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 219cd4b and 9547f23.

📒 Files selected for processing (2)

• .changeset/migrate-chat-delete-react.md
• packages/rest-typings/src/v1/chat.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• .changeset/migrate-chat-delete-react.md

📜 Recent review details

⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)

• GitHub Check: cubic · AI code reviewer

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)

**/*.{ts,tsx,js}: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests
Avoid code comments in the implementation

Files:

• packages/rest-typings/src/v1/chat.ts

🧠 Learnings (11)

📓 Common learnings

Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.

Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:18.785Z
Learning: In Rocket.Chat PR reviews, maintain strict scope boundaries—when a PR is focused on a specific endpoint (e.g., rooms.favorite), avoid reviewing or suggesting changes to other endpoints that were incidentally refactored (e.g., rooms.invite) unless explicitly requested by maintainers.

📚 Learning: 2026-02-24T19:09:09.561Z

Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38974
File: apps/meteor/app/api/server/v1/im.ts:220-221
Timestamp: 2026-02-24T19:09:09.561Z
Learning: In RocketChat/Rocket.Chat OpenAPI migration PRs for apps/meteor/app/api/server/v1 endpoints, maintainers prefer to avoid any logic changes; style-only cleanups (like removing inline comments) may be deferred to follow-ups to keep scope tight.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-02-25T20:10:16.987Z

Learnt from: ahmed-n-abdeltwab
Repo: RocketChat/Rocket.Chat PR: 38913
File: packages/ddp-client/src/legacy/types/SDKLegacy.ts:34-34
Timestamp: 2026-02-25T20:10:16.987Z
Learning: In the RocketChat/Rocket.Chat monorepo, packages/ddp-client and apps/meteor do not use TypeScript project references. Module augmentations in apps/meteor (e.g., declare module 'rocket.chat/rest-typings') are not visible when compiling packages/ddp-client in isolation, which is why legacy SDK methods that depend on OperationResult types for OpenAPI-migrated endpoints must remain commented out.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-02-23T17:53:18.785Z

Learnt from: ggazzo
Repo: RocketChat/Rocket.Chat PR: 35995
File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112
Timestamp: 2026-02-23T17:53:18.785Z
Learning: In Rocket.Chat PR reviews, maintain strict scope boundaries—when a PR is focused on a specific endpoint (e.g., rooms.favorite), avoid reviewing or suggesting changes to other endpoints that were incidentally refactored (e.g., rooms.invite) unless explicitly requested by maintainers.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2025-09-16T13:33:49.237Z

Learnt from: cardoso
Repo: RocketChat/Rocket.Chat PR: 36890
File: apps/meteor/tests/e2e/e2e-encryption/e2ee-otr.spec.ts:21-26
Timestamp: 2025-09-16T13:33:49.237Z
Learning: In Rocket.Chat test files, the im.delete API endpoint accepts either a `roomId` parameter (requiring the actual DM room _id) or a `username` parameter (for the DM partner's username). It does not accept slug-like constructions such as concatenating usernames together.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-02-24T19:36:55.089Z

Learnt from: juliajforesti
Repo: RocketChat/Rocket.Chat PR: 38493
File: apps/meteor/tests/e2e/page-objects/fragments/home-content.ts:60-82
Timestamp: 2026-02-24T19:36:55.089Z
Learning: In RocketChat/Rocket.Chat e2e tests (apps/meteor/tests/e2e/page-objects/fragments/home-content.ts), thread message preview listitems do not have aria-roledescription="message", so lastThreadMessagePreview locator cannot be scoped to messageListItems (which filters for aria-roledescription="message"). It should remain scoped to page.getByRole('listitem') or mainMessageList.getByRole('listitem').

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-01-17T01:51:47.764Z

Learnt from: tassoevan
Repo: RocketChat/Rocket.Chat PR: 38219
File: packages/core-typings/src/cloud/Announcement.ts:5-6
Timestamp: 2026-01-17T01:51:47.764Z
Learning: In packages/core-typings/src/cloud/Announcement.ts, the AnnouncementSchema.createdBy field intentionally overrides IBannerSchema.createdBy (object with _id and optional username) with a string enum ['cloud', 'system'] to match existing runtime behavior. This is documented as technical debt with a FIXME comment at apps/meteor/app/cloud/server/functions/syncWorkspace/handleCommsSync.ts:53 and should not be flagged as an error until the runtime behavior is corrected.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2025-12-10T21:00:54.909Z

Learnt from: KevLehman
Repo: RocketChat/Rocket.Chat PR: 37091
File: ee/packages/abac/jest.config.ts:4-7
Timestamp: 2025-12-10T21:00:54.909Z
Learning: Rocket.Chat monorepo: Jest testMatch pattern '<rootDir>/src/**/*.spec.(ts|js|mjs)' is valid in this repo and used across multiple packages (e.g., packages/tools, ee/packages/omnichannel-services). Do not flag it as invalid in future reviews.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2025-09-16T13:33:49.237Z

Learnt from: cardoso
Repo: RocketChat/Rocket.Chat PR: 36890
File: apps/meteor/tests/e2e/e2e-encryption/e2ee-otr.spec.ts:21-26
Timestamp: 2025-09-16T13:33:49.237Z
Learning: The im.delete API endpoint accepts either a `roomId` parameter (requiring the actual DM room _id) or a `username` parameter (for the DM partner's username). Constructing slug-like identifiers like `user2${Users.userE2EE.data.username}` doesn't work for this endpoint.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In the Rocket.Chat repository, do not reference Biome lint rules in code review feedback. Biome is not used even if biome.json exists; only reference Biome rules if there is explicit, project-wide usage documented. For TypeScript files, review lint implications without Biome guidance unless the project enables Biome rules.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

📚 Learning: 2026-02-26T19:25:44.063Z

Learnt from: gabriellsh
Repo: RocketChat/Rocket.Chat PR: 38778
File: packages/ui-voip/src/providers/useMediaSession.ts:192-192
Timestamp: 2026-02-26T19:25:44.063Z
Learning: In this repository (RocketChat/Rocket.Chat), Biome lint rules are not used even if a biome.json exists. When reviewing TypeScript files (e.g., packages/ui-voip/src/providers/useMediaSession.ts), ensure lint suggestions do not reference Biome-specific rules. Rely on general ESLint/TypeScript lint rules and project conventions instead.

Applied to files:

• packages/rest-typings/src/v1/chat.ts

🔇 Additional comments (1)

packages/rest-typings/src/v1/chat.ts (1)

932-940: ChatEndpoints typing change is consistent with the migration.

This updated section keeps chat.ignoreUser and chat.search while not re-adding chat.delete/chat.react to rest-typings, which matches the OpenAPI relocation intent.

---

Walkthrough

Migrates global chat.delete and chat.react routes into local API.v1.chat chained endpoints with AJV request/response validation; adds a changeset documenting the migration and updates public REST typings to remove the relocated endpoints and add chat.ignoreUser and chat.search.

Changes

Cohort / File(s)	Summary
Changeset \.changeset/migrate-chat-delete-react.md	Adds a changeset describing migration to chained route syntax and AJV validation; records dependency patch/minor updates.
API implementation apps/meteor/app/api/server/v1/chat.ts	Removes global chat.delete and chat.react routes; introduces local API.v1.chat.delete and API.v1.chat.react endpoints, new types (ChatDeleteLocal, ChatReactLocal), AJV schemas/validators (ChatDeleteLocalSchema, ChatReactLocalSchema, isChatDeleteLocalProps, isChatReactLocalProps), and response schemas. Core permission and business logic preserved but routing/validation reorganized.
Public typings packages/rest-typings/src/v1/chat.ts	Removes public /v1/chat.delete and /v1/chat.react endpoint types/schemas; adds /v1/chat.ignoreUser (GET) and /v1/chat.search (GET) endpoint types and return shapes.

Sequence Diagram(s)

sequenceDiagram
  rect rgba(240,240,255,0.5)
    participant Client
    participant API as API.v1.chat
    participant Validator
    participant Auth as PermissionCheck
    participant DB as MessagesDB
  end

  Client->>API: POST /v1/chat.delete { msgId, roomId, ... }
  API->>Validator: validate request (AJV)
  Validator-->>API: validated params
  API->>Auth: check permissions (user, room)
  Auth-->>API: allowed/denied
  API->>DB: fetch message by msgId
  DB-->>API: message
  API->>DB: perform delete/react operation
  DB-->>API: result
  API-->>Client: 200 { _id, ts, message: {...} } or 403/404

Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

Suggested labels

community

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: migrating chat.delete and chat.react endpoints to support OpenAPI with AJV schema validation and modern chaining syntax.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/rest-typings/src/v1/chat.ts">

<violation number="1" location="packages/rest-typings/src/v1/chat.ts:1005">
P2: `/v1/chat.delete` was removed from `ChatEndpoints`, but the endpoint is still used in app code and `Endpoints` still depends on `ChatEndpoints`, so type coverage for this REST route is dropped.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[sezallagwal]

Fixed in the latest commit — retained /v1/chat.delete in ChatEndpoints for client-side type coverage. @cubic-dev-ai

[ahmed-n-abdeltwab]

Thanks for providing the screenshots! also Once you solve these issues, this PR will be ready

[sezallagwal]

@cubic-dev-ai re-run

[cubic-dev-ai]

@cubic-dev-ai re-run

@sezallagwal I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 3 files

[sezallagwal]

I have resolved the issues. Please have a look @ahmed-n-abdeltwab

[ahmed-n-abdeltwab]

please take a look at these issues

[sezallagwal]

Thanks for the detailed review, @ahmed-n-abdeltwab! I missed the individual thread comments before, but they’re all fixed in the latest commit.