🔴 CRITICAL: Replace 'any' types with proper TypeScript types #1265#1268
Closed
Harshit2405-2004 wants to merge 2 commits intoRocketChat:developfrom
Closed
🔴 CRITICAL: Replace 'any' types with proper TypeScript types #1265#1268Harshit2405-2004 wants to merge 2 commits intoRocketChat:developfrom
Harshit2405-2004 wants to merge 2 commits intoRocketChat:developfrom
Conversation
SECURITY FIX - CWE-312: Cleartext Storage of Sensitive Information Issue: RocketChat#1263 Changes: - Removed password field from userStore (React + React Native) - Created ephemeral totpCredentialsStore for TOTP flow - Credentials stored temporarily (seconds) during 2FA, cleared immediately - Updated useRCAuth hook to use ephemeral credentials - Updated TotpModal to retrieve from ephemeral store - Added automatic cleanup on success/error/modal close Security Impact: ✅ Passwords no longer exposed in React DevTools ✅ No persistent client-side password storage ✅ Automatic credential cleanup prevents exposure ✅ Ephemeral storage pattern for sensitive data Modified Files: - packages/react/src/store/userStore.js - packages/react-native/src/store/userStore.js - packages/react/src/hooks/useRCAuth.js - packages/react/src/views/TotpModal/TwoFactorTotpModal.js - packages/react/src/store/index.js New Files: - packages/react/src/store/totpCredentialsStore.js Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…at#1265) TYPE SAFETY FIX - Phase 1: Critical Paths Issue: RocketChat#1265 Problem: Widespread use of 'any' type across codebase (30+ occurrences) causing: - No IDE autocomplete or type checking - Runtime errors not caught at compile time - Refactoring breaks silently - Difficult to trace data flow - Production runtime errors Phase 1 Changes (Critical Paths): This commit addresses the most critical type safety issues in core authentication and API packages. New Type Definitions: - packages/api/src/types.ts - Message, User, ActionData, UiInteractionData - packages/auth/src/types.ts - CurrentUser, AuthToken Fixed Files: - packages/api/src/cloneArray.ts • Use generic type <T extends Record<string, unknown>> • Properly typed cloning function - packages/api/src/EmbeddedChatApi.ts • onMessageCallbacks: Message type instead of any • onActionTriggeredCallbacks: ActionData instead of any • onUiInteractionCallbacks: UiInteractionData instead of any - packages/auth/src/RocketChatAuth.ts • currentUser: CurrentUser | null instead of any • authListeners: Properly typed callbacks - packages/auth/src/Api.ts • request() data parameter: unknown instead of any • ApiError constructor: unknown[] instead of any[] - packages/rc-app/lib/getCallbackContent.ts • config: CallbackConfig interface instead of any • error parameter: optional string type Exported Types: - packages/api/src/index.ts - Export all types - packages/auth/src/index.ts - Export all types Impact: ✅ Type safety in critical authentication paths ✅ IDE autocomplete for message callbacks ✅ Compile-time error detection ✅ Better refactoring support ✅ Clearer data flow Next Phase: - Remaining packages (24+ files) - Additional interfaces for complex types - Stricter tsconfig settings Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type Safety Fix - Phase 1
Fixes #1265 - Widespread 'any' Type Usage
Critical type safety improvements in core authentication and API packages.
Changes:
Impact:
Files: 9 changed (7 modified, 2 created)
Phase: 1 of 2 (critical paths complete)