fix: anonymous spotlight search crashing when anonymous read is enabled

[KevLehman]

Proposed changes (including videos or screenshots)

Since 8.7.0, an unauthenticated room search (GET /api/v1/spotlight and the DDP spotlight method) fails with Cannot read properties of undefined (reading '_id') whenever Accounts_AllowAnonymousRead is enabled — anonymous visitors can't find public channels via the navbar search.

Root cause: ae72939 / #41413 (refactor(authorization): forward only { _id, roles } from hasPermission wrappers). It introduced toSubject in server/lib/authorization/hasPermission.ts, which does user._id on any non-string argument. Before that the wrappers passed the user straight through and Authorization.hasPermission returned false for a falsy user. Only untyped .js callers (server/lib/spotlight.js fetchRooms/searchRooms) pass undefined, so TypeScript never flagged it.

Fix: toSubject forwards falsy users untouched; the authorization service already answers false for them. One-line guard, covers all wrapper callers.

Tests

• unit: hasPermission.spec.ts — id passthrough, { _id, roles } projection, undefined user forwarded without throwing (fails on develop, passes here)
• api [/spotlight]: anonymous request returns no rooms/users with the setting off, and finds public rooms (no users) with it on — this is the case that surfaced the crash
• api [@loadHistory]: anonymous caller gets public channel messages with the setting on, false for a private group, error-invalid-user with the setting off
• api [@getRoomByTypeAndName]: the existing "anonymous read enabled" case was sending admin credentials — now goes through method.callAnon

Issue(s)

Steps to test or reproduce

1. Enable Accounts_AllowAnonymousRead.
2. GET /api/v1/spotlight?query=%23general with no auth headers.
3. develop: 400 with the TypeError above. This branch: 200 with the public room in rooms, empty users.

Further comments

Affects 8.7.0+, candidate for backport. Patch changeset included.

[changeset-bot]

🦋 Changeset detected

Latest commit: 62056af

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@rocket.chat/meteor	Patch
@rocket.chat/core-typings	Patch
@rocket.chat/rest-typings	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label
• This PR is missing the required milestone or project

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ebf780f-e41b-411e-8f84-d1c82b127be6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.24%. Comparing base (ea163f5) to head (62056af).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41843      +/-   ##
===========================================
- Coverage    69.25%   69.24%   -0.01%     
===========================================
  Files         4234     4234              
  Lines       167278   167288      +10     
  Branches     29806    29795      -11     
===========================================
- Hits        115841   115840       -1     
- Misses       46279    46295      +16     
+ Partials      5158     5153       -5     

Flag	Coverage Δ
e2e	58.91% <ø> (-0.02%)	⬇️
e2e-api	45.90% <100.00%> (+0.03%)	⬆️
unit	71.20% <100.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.