fix: fix wrong marketplaceInfo value being stored in the database

Author: Gustrb

apps/meteor/ee/server/apps/communication/rest.ts

@@ -357,7 +357,18 @@ export class AppsRestApi {
 							}
 
 							buff = Buffer.from(await downloadResponse.arrayBuffer());
-							marketplaceInfo = (await marketplaceResponse.json()) as any;
+							const parsedMarketplaceResponse = await marketplaceResponse.json();
+
+							// Note: marketplace responds with an array of the marketplace info on the app, but it is expected
+							//       to always have one element since we are fetching a specific app version.
+							if (parsedMarketplaceResponse.length !== 1) {
+								orchestrator
+									.getRocketChatLogger()
+									.error('Error getting the App information from the Marketplace:', parsedMarketplaceResponse);
+								throw new Error('Invalid response from the Marketplace');
+							}
+
+							marketplaceInfo = parsedMarketplaceResponse[0];
 							permissionsGranted = this.bodyParams.permissionsGranted;
 						} catch (err: any) {
 							return API.v1.failure(err.message);

apps/meteor/server/startup/appsMigration.ts

@@ -0,0 +1,27 @@
+import { Apps } from '@rocket.chat/models';
+import { Meteor } from 'meteor/meteor';
+
+/**
+ * This migration is to fix the marketplaceInfo field in the Apps collection.
+ * This is being done, since our whole codebase expects marketplaceInfo to be an object and not an array.
+ * This bug can make so that apps that need a subscription were not correctly validated and could be enabled
+ * even after the subscription was expired.
+ *
+ * Also, apps that were enterprise-only could be enabled even if the server didn't have a subscription.
+ */
+Meteor.startup(async () => {
+	// Find all the apps where marketplaceInfo is an array
+	const apps = await Apps.find(
+		{ marketplaceInfo: { $type: 'array' } },
+		{
+			projection: {
+				marketplaceInfo: 1,
+			},
+		},
+	).toArray();
+
+	// For each app set the marketplaceInfo to be the first element of the array
+	for await (const app of apps) {
+		await Apps.update({ _id: app._id }, { $set: { marketplaceInfo: app.marketplaceInfo[0] } });
+	}
+});

apps/meteor/server/startup/index.ts

@@ -8,6 +8,7 @@ import './presenceTroubleshoot';
 import '../hooks';
 import '../lib/rooms/roomTypes';
 import '../lib/settingsRegenerator';
+import './appsMigration';
 import { performMigrationProcedure } from './migrations';
 import { isRunningMs } from '../lib/isRunningMs';