validate creator for federated DMs

Author: sampaiodiego

apps/meteor/app/lib/server/functions/createDirectRoom.ts

@@ -155,19 +155,22 @@ export async function createDirectRoom(
 			{ projection: { 'username': 1, 'settings.preferences': 1 } },
 		).toArray();
 
-		const creatorUser = options?.creator ? roomMembers.find((member) => member._id === options?.creator) : undefined;
-
-		// TODO wtf creatorUser can be undefined here?
+		const creatorUser = roomMembers.find((member) => member._id === options?.creator);
+		if (roomExtraData.federated && !creatorUser) {
+			throw new Meteor.Error('error-creator-not-in-room', 'The creator user must be part of the direct room');
+		}
 
 		for await (const member of membersWithPreferences) {
 			const otherMembers = sortedMembers.filter(({ _id }) => _id !== member._id);
 
 			const subscriptionStatus: Partial<ISubscription> =
-				roomExtraData.federated && options?.creator !== member._id
+				roomExtraData.federated && options.creator !== member._id && creatorUser
 					? {
 							status: 'INVITED',
 							inviter: {
-								_id: creatorUser?._id,
+								_id: creatorUser._id,
+								username: creatorUser.username,
+								name: creatorUser.name,
 							},
 							open: true,
 							unread: 1,

apps/meteor/app/lib/server/functions/createRoom.ts

@@ -7,7 +7,6 @@ import { isRoomNativeFederated } from '@rocket.chat/core-typings';
 import { Rooms, Subscriptions, Users } from '@rocket.chat/models';
 import { Meteor } from 'meteor/meteor';
 
-import { performAddUserToRoom } from './addUserToRoom';
 import { createDirectRoom } from './createDirectRoom';
 import { callbacks } from '../../../../lib/callbacks';
 import { beforeAddUserToRoom } from '../../../../lib/callbacks/beforeAddUserToRoom';
@@ -203,7 +202,7 @@ export const createRoom = async <T extends RoomType>(
 	}
 
 	if (type === 'd') {
-		return createDirectRoom(members as IUser[], extraData, { ...options, creator: options?.creator || owner?.username });
+		return createDirectRoom(members as IUser[], extraData, { ...options, creator: options?.creator || owner?._id });
 	}
 
 	if (!onlyUsernames(members)) {