fix: read enterprise modules from licenses.info

[diegolmello]

Proposed changes

The app loaded the workspace's enterprise modules through the DDP method license:getModules. The server has deprecated every license:* method (removal in 9.0.0) in favour of /v1/licenses.info. Servers that run with TEST_MODE=true or ROCKET_CHAT_DEPRECATION_THROW_ERRORS_FOR_VERSIONS_UNDER=9.0.0 already throw on those methods and answer with a 500. When that happens the modules list stays empty, so every licensed feature is hidden, including "Voice call" in the sidebar.

getEnterpriseModules now picks its source by server version:

• 6.5.0 and later: GET licenses.info, reading license.activeModules. The endpoint shipped in 6.5.0 and has returned activeModules since then.
• 3.1.0 up to 6.5.0: license:getModules, unchanged.
• Older than 3.1.0: the list is cleared, unchanged.

The PR also adds a REST type for licenses.info and drops the new Promise(async …) wrapper around the function.

Issue(s)

https://rocketchat.atlassian.net/browse/NATIVE-1698

How to test or reproduce

1. Use a server whose license includes teams-voip, running with TEST_MODE=true or ROCKET_CHAT_DEPRECATION_THROW_ERRORS_FOR_VERSIONS_UNDER=9.0.0.
2. Log in as a user with allow-internal-voice-calls or allow-external-voice-calls.
3. Open the sidebar.
4. "Voice call" is listed. Before this change it was missing.

Screenshots

Types of changes

• Bugfix (non-breaking change which fixes an issue)
• Improvement (non-breaking change which improves a current function)
• New feature (non-breaking change which adds functionality)
• Documentation update (if none of the other choices apply)

Checklist

• I have read the CONTRIBUTING doc
• I have signed the CLA
• Lint and unit tests pass locally with my changes
• I have added tests that prove my fix is effective or that my feature works (if applicable)
• I have added necessary documentation (if applicable)
• Any dependent changes have been merged and published in downstream modules

Further comments

The pre-6.5.0 path stays because the app still connects to older servers when a workspace has a supported-versions exception.

Summary by CodeRabbit

• New Features
  • Enterprise module information is now available from license details on newer servers, while older supported servers continue using their existing license method.
• Bug Fixes
  • Module status is cleared when a license response is unsuccessful or returns no modules, and on servers that do not support module reporting.
  • Existing module status is preserved if the license request throws an error.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a6e0e0c4-64a9-4648-ae04-53d8fab9daf9

📥 Commits

Reviewing files that changed from the base of the PR and between b3d2709 and 6eca01c.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 891db087-5485-495f-8ec2-eefc196342dc

📥 Commits

Reviewing files that changed from the base of the PR and between 372c2a4 and b3d2709.

📒 Files selected for processing (4)

• app/definitions/rest/v1/index.ts
• app/definitions/rest/v1/licenses.ts
• app/lib/methods/__tests__/getEnterpriseModules.test.ts
• app/lib/methods/enterpriseModules.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: ESLint and Test / run-eslint-and-test
• GitHub Check: E2E Shard Preflight

🔇 Additional comments (4)

app/definitions/rest/v1/licenses.ts (1)

1-9: LGTM!

app/definitions/rest/v1/index.ts (1)

24-24: LGTM!

Also applies to: 48-49

app/lib/methods/enterpriseModules.ts (1)

32-46: LGTM!

Also applies to: 48-48, 50-60

app/lib/methods/__tests__/getEnterpriseModules.test.ts (1)

1-109: LGTM!

---

Walkthrough

Enterprise module retrieval now uses a version-dependent SDK endpoint. The REST endpoint types include the licenses.info response, and returned modules are persisted and dispatched to Redux.

Changes

Enterprise module retrieval

Layer / File(s)	Summary
Licenses endpoint contract app/definitions/rest/v1/licenses.ts, app/definitions/rest/v1/index.ts	Adds the licenses.info response type, with license.activeModules as a string array, and includes it in Endpoints.
Versioned module retrieval app/lib/methods/enterpriseModules.ts, app/lib/methods/__tests__/getEnterpriseModules.test.ts	Uses licenses.info for server versions 6.5.0 and later, and license:getModules for versions from 3.1.0 to below 6.5.0. Lower versions clear Redux module state without an SDK request. Tests cover endpoint selection, persistence, state clearing, and rejected requests.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant getEnterpriseModules
  participant fetchEnterpriseModules
  participant SDK
  participant ServerRecord
  participant Redux
  getEnterpriseModules->>fetchEnterpriseModules: select retrieval by server version
  alt version 6.5.0 or later
    fetchEnterpriseModules->>SDK: call licenses.info
    SDK-->>fetchEnterpriseModules: return license.activeModules
  else version 3.1.0 to below 6.5.0
    fetchEnterpriseModules->>SDK: call license:getModules
    SDK-->>fetchEnterpriseModules: return modules
  end
  fetchEnterpriseModules-->>getEnterpriseModules: return modules or no modules
  getEnterpriseModules->>ServerRecord: save comma-separated modules when returned
  getEnterpriseModules->>Redux: dispatch modules or clear module state

Loading

Suggested labels: type: bug

Merge Risk: ⚪ Minimal · up to b3d27

No concrete merge-blocking issue is established. The change retains older-server retrieval while using licenses.info on newer servers; merge after normal checks pass.

Security Architecture Review

Security architecture risk: 🔵 Low · up to b3d27

The change replaces the license lookup used by newer servers while preserving the checked feature-permission gates. No new authorization bypass was established, but the newer endpoint’s access controls and full response remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• observed — The inspected client consumes and persists the module list, affecting feature availability in the app and cached per-server records. Its narrow response type does not establish whether the server’s wire response contains additional license information.

Trust Boundaries and Controls

• observed — The local wrapper binds the SDK to a server host and delegates login and GET to that client. It does not itself show GET credential attachment or server-side endpoint enforcement. The checked downstream permission gates provide counterevidence against module state alone granting voice-call authority, but do not prove server-side authorization.

Hardening Proposals

• proposed — Confirm the deployed licenses.info contract for ordinary authenticated users: credential propagation, workspace scoping, and returned license fields. This would close the boundary uncertainty without treating it as a demonstrated vulnerability.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: loading enterprise modules from the licenses.info endpoint.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Warning

Errors were encountered while retrieving linked issues.

Errors (1)

• JIRA integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Android Build Available

Rocket.Chat 4.77.0.109821

Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNQLNaCiL-ugmFOM3hlb-D0s91IFRIV4aRIl2VP6yN9POc9g2HTkfBIUiYm_647aBHwR1nosnAjvl29xJEh0

[github-actions]

Android Build Available

Rocket.Chat 4.78.0.109845

Internal App Sharing: https://play.google.com/apps/test/RQQ8k09hlnQ/ahAO29uNQSsG6vJUsyYlAWBrJSdmWs2leGoilCeK-YC0mZc74oNMi75y6i6MbXkKCtoPGlX1U32pmIvIJVMH2uOOCF

[github-actions]

iOS Build Available

Rocket.Chat 4.78.0.109849