**Actionable comments posted: 1**

🤖 Prompt for all review comments with AI agents

``` Verify each finding against the current code and only fix it if needed. Inline comments: In `@apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx`: - Around line 12-17: The permission mock for hasAtLeastOnePermission ignores the scope/rid so tests don't verify scoped checks; update the mocked function in ComposerPopupProvider.spec.tsx (the jest.mock that defines hasAtLeastOnePermission and uses mockGrantedPermissions) to accept the second argument (scope) and validate that the granted entry includes the room id—either by asserting scope === expectedRid when called or by encoding grants with a composite key (e.g., `${scope}:${permission}`) and checking mockGrantedPermissions for that composite, so the mock enforces room-scoped permission checks used by ComposerPopupProvider. ```

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR: - [ ] Push a commit to this branch (recommended) - [ ] Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

**Configuration used**: Organization UI **Review profile**: CHILL **Plan**: Pro **Run ID**: `bd8e36e6-3bf6-49c1-85df-5d74e2c09ac3`

📥 Commits

Reviewing files that changed from the base of the PR and between 097441b44bd615d0175e8a9d75dc4e42c4f986a4 and 6571622cc4e88de5fd0f860266259b60de7b0962.

📒 Files selected for processing (2)

* `apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx` * `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx`

📜 Review details

🧰 Additional context used

📓 Path-based instructions (1)

**/*.{ts,tsx,js}

**📄 CodeRabbit inference engine (.cursor/rules/playwright.mdc)** > `**/*.{ts,tsx,js}`: Write concise, technical TypeScript/JavaScript with accurate typing in Playwright tests > Avoid code comments in the implementation Files: - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx` - `apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx`

🧠 Learnings (18)

📓 Common learnings

``` Learnt from: smirk-dev Repo: RocketChat/Rocket.Chat PR: 39625 File: apps/meteor/app/api/server/v1/push.ts:85-97 Timestamp: 2026-03-14T14:58:58.834Z Learning: In RocketChat/Rocket.Chat, the `push.token` POST/DELETE endpoints in `apps/meteor/app/api/server/v1/push.ts` were already migrated to the chained router API pattern on `develop` prior to PR `#39625`. `cleanTokenResult` (which strips `authToken` and returns `PushTokenResult`) and `isPushTokenPOSTProps`/`isPushTokenDELETEProps` validators already exist on `develop`. PR `#39625` only migrates `push.get` and `push.info` to the chained pattern. Do not flag `cleanTokenResult` or `PushTokenResult` as newly introduced behavior-breaking changes when reviewing this PR. ``` ``` Learnt from: ggazzo Repo: RocketChat/Rocket.Chat PR: 35995 File: apps/meteor/app/api/server/v1/rooms.ts:1107-1112 Timestamp: 2026-02-23T17:53:18.785Z Learning: In Rocket.Chat PR reviews, maintain strict scope boundaries—when a PR is focused on a specific endpoint (e.g., rooms.favorite), avoid reviewing or suggesting changes to other endpoints that were incidentally refactored (e.g., rooms.invite) unless explicitly requested by maintainers. ```

📚 Learning: 2025-11-04T16:49:19.107Z

``` Learnt from: ricardogarim Repo: RocketChat/Rocket.Chat PR: 37377 File: apps/meteor/ee/server/hooks/federation/index.ts:86-88 Timestamp: 2025-11-04T16:49:19.107Z Learning: In Rocket.Chat's federation system (apps/meteor/ee/server/hooks/federation/), permission checks follow two distinct patterns: (1) User-initiated federation actions (creating rooms, adding users to federated rooms, joining from invites) should throw MeteorError to inform users they lack 'access-federation' permission. (2) Remote server-initiated federation events should silently skip/ignore when users lack permission. The beforeAddUserToRoom hook only executes for local user-initiated actions, so throwing an error there is correct. Remote federation events are handled separately by the federation Matrix package with silent skipping logic. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx`

📚 Learning: 2026-03-11T22:04:20.529Z

``` Learnt from: juliajforesti Repo: RocketChat/Rocket.Chat PR: 39545 File: apps/meteor/client/views/room/body/hooks/useHasNewMessages.ts:59-61 Timestamp: 2026-03-11T22:04:20.529Z Learning: In `apps/meteor/client/views/room/body/hooks/useHasNewMessages.ts`, the `msg.u._id === uid` early-return in the `streamNewMessage` handler is intentional: the "New messages" indicator is designed to notify about messages from other users only. Self-sent messages — including those sent from a different session/device — are always skipped, by design. Do not flag this as a multi-session regression. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx`

📚 Learning: 2026-04-17T17:38:15.994Z

``` Learnt from: d-gubert Repo: RocketChat/Rocket.Chat PR: 39858 File: packages/ui-kit/src/interactions/UserInteraction.ts:33-33 Timestamp: 2026-04-17T17:38:15.994Z Learning: In RocketChat/Rocket.Chat (`packages/ui-kit/src/interactions/UserInteraction.ts`), `ViewSubmitUserInteraction` and `ViewClosedUserInteraction` intentionally do NOT include `rid` when the interaction originates from a **modal** surface. Modals are not scoped to a room, so no room id is available in that context. The `rid?: string` field is optional to support the contextual bar surface (where room context exists) while remaining absent for modals. Do not flag the absence of `rid` in modal viewSubmit/viewClosed interactions as a missing-context bug. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx`

📚 Learning: 2026-03-09T18:39:21.178Z

``` Learnt from: Harxhit Repo: RocketChat/Rocket.Chat PR: 39476 File: apps/meteor/server/methods/addAllUserToRoom.ts:0-0 Timestamp: 2026-03-09T18:39:21.178Z Learning: In apps/meteor/server/methods/addAllUserToRoom.ts, the implementation uses a single cursor pass (Users.find(userFilter).batchSize(100)) that collects both the full user objects (collectedUsers: IUser[]) and their usernames (usernames: string[]) in one iteration. `beforeAddUserToRoom` is then called once with the full usernames batch (preserving batch-validation semantics), and the subsequent subscription/message processing loop iterates over the same stable `collectedUsers` array — no second DB query is made. This avoids any race condition between validation and processing while preserving the original batch-validation behavior. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx`

📚 Learning: 2026-03-27T14:52:56.865Z

``` Learnt from: dougfabris Repo: RocketChat/Rocket.Chat PR: 39892 File: apps/meteor/client/views/room/contextualBar/Threads/Thread.tsx:150-155 Timestamp: 2026-03-27T14:52:56.865Z Learning: In Rocket.Chat, there are two different `ModalBackdrop` components with different prop APIs. During review, confirm the import source: (1) `rocket.chat/fuselage` `ModalBackdrop` uses `ModalBackdropProps` based on `BoxProps` (so it supports `onClick` and other Box/DOM props) and does not have an `onDismiss` prop; (2) `rocket.chat/ui-client` `ModalBackdrop` uses a narrower props interface like `{ children?: ReactNode; onDismiss?: () => void }` and handles Escape keypress and outside mouse-up, and it does not forward arbitrary DOM props such as `onClick`. Flag mismatched props (e.g., `onDismiss` passed to the fuselage component or `onClick` passed to the ui-client component) and ensure the usage matches the correct component being imported. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.tsx` - `apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx`

📚 Learning: 2025-12-10T21:00:54.909Z

``` Learnt from: KevLehman Repo: RocketChat/Rocket.Chat PR: 37091 File: ee/packages/abac/jest.config.ts:4-7 Timestamp: 2025-12-10T21:00:54.909Z Learning: Rocket.Chat monorepo: Jest testMatch pattern '/src/**/*.spec.(ts|js|mjs)' is valid in this repo and used across multiple packages (e.g., packages/tools, ee/packages/omnichannel-services). Do not flag it as invalid in future reviews. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx`

📚 Learning: 2026-04-17T18:33:27.211Z

``` Learnt from: d-gubert Repo: RocketChat/Rocket.Chat PR: 39858 File: apps/meteor/tests/e2e/apps/uikit-interactions.spec.ts:123-151 Timestamp: 2026-04-17T18:33:27.211Z Learning: In RocketChat/Rocket.Chat (`apps/meteor/tests/e2e/apps/uikit-interactions.spec.ts`), `executeBlockActionHandler` invocations originating from a **modal** surface intentionally do NOT include a `block_action_room` (room property) in the interaction payload. Modals are not scoped to a room, so no room id is available in that context. Do not flag the absence of a room assertion in the modal block-action test as a missing coverage bug; instead, document it explicitly with a `test.step` asserting the room entry is `undefined`. ``` **Applied to files:** - `apps/meteor/client/views/room/providers/ComposerPopupProvider.spec.tsx`