Missing email notification when an admin resets your E2E key (#18673)

app/api/server/v1/users.js

@@ -793,7 +793,7 @@ API.v1.addRoute('users.resetE2EKey', { authRequired: true, twoFactorRequired: tr
 	post() {
 		// reset own keys
 		if (this.isUserFromParams()) {
-			resetUserE2EEncriptionKey(this.userId);
+			resetUserE2EEncriptionKey(this.userId, false);
 			return API.v1.success();
 		}
 
@@ -811,7 +811,7 @@ API.v1.addRoute('users.resetE2EKey', { authRequired: true, twoFactorRequired: tr
 			throw new Meteor.Error('error-not-allowed', 'Not allowed');
 		}
 
-		if (!resetUserE2EEncriptionKey(user._id)) {
+		if (!resetUserE2EEncriptionKey(user._id, true)) {
 			return API.v1.failure();
 		}
 

app/e2e/server/methods/resetOwnE2EKey.js

@@ -13,7 +13,7 @@ Meteor.methods({
 			});
 		}
 
-		if (!resetUserE2EEncriptionKey(userId)) {
+		if (!resetUserE2EEncriptionKey(userId, false)) {
 			return false;
 		}
 		return true;

packages/rocketchat-i18n/i18n/en.i18n.json

@@ -1315,10 +1315,12 @@
   "E2E_Enabled_Default_PrivateRooms": "Enable encryption for Private Rooms by default",
   "E2E_Encryption_Password_Change": "Change Encryption Password",
   "E2E_Encryption_Password_Explanation": "You can now create encrypted private groups and direct messages. You may also change existing private groups or DMs to encrypted.<br/><br/>This is end to end encryption so the key to encode/decode your messages will not be saved on the server. For that reason you need to store your password somewhere safe. You will be required to enter it on other devices you wish to use e2e encryption on.",
+  "E2E_key_reset_email": "E2E Key Reset Notification",
   "E2E_password_reveal_text": "You can now create encrypted private groups and direct messages. You may also change existing private groups or DMs to encrypted.<br/><br/>This is end to end encryption so the key to encode/decode your messages will not be saved on the server. For that reason you need to store this password somewhere safe.  You will be required to enter it on other devices you wish to use e2e encryption on. <a href=\"https://rocket.chat/docs/user-guides/end-to-end-encryption/\" target=\"_blank\">Learn more here!</a><br/><br/>Your password is: <span style=\"font-weight: bold;\">%s</span><br/><br/>This is an auto generated password, you can setup a new password for your encryption key any time from any browser you have entered the existing password.<br/>This password is only stored on this browser until you store the password and dismiss this message.",
   "E2E_password_request_text": "To access your encrypted private groups and direct messages, enter your encryption password. <br/>You need to enter this password to encode/decode your messages on every client you use, since the key is not stored on the server.",
   "E2E_Reset_Key_Explanation": "This option will remove your current E2E key and log you out. <BR/>When you login again, Rocket.Chat will generate you a new key and restore your access to any encrypted room that has one or more members online.<BR/>Due to the nature of the E2E encryption, Rocket.Chat will not be able to restore access to any encrypted room that has no member online.",
   "E2E_Reset_Other_Key_Warning": "Reset the current E2E key will log out the user. When the user login again, Rocket.Chat will generate a new key and restore the user access to any encrypted room that has one or more members online. Due to the nature of the E2E encryption, Rocket.Chat will not be able to restore access to any encrypted room that has no member online.",
+  "E2E_Reset_Email_Content": "You've been automatically logged out. When you login again, Rocket.Chat will generate a new key and restore your access to any encrypted room that has one or more members online. Due to the nature of the E2E encryption, Rocket.Chat will not be able to restore access to any encrypted room that has no member online.",
   "Edit": "Edit",
   "Edit_User": "Edit User",
   "Edit_Invite": "Edit Invite",
@@ -3979,6 +3981,7 @@
   "You_will_not_be_able_to_recover": "You will not be able to recover this message!",
   "You_will_not_be_able_to_recover_file": "You will not be able to recover this file!",
   "You_wont_receive_email_notifications_because_you_have_not_verified_your_email": "You won't receive email notifications because you have not verified your email.",
+  "Your_e2e_key_has_been_reset": "Your e2e key has been reset.",
   "Your_email_address_has_changed": "Your email address has been changed.",
   "Your_email_has_been_queued_for_sending": "Your email has been queued for sending",
   "Your_entry_has_been_deleted": "Your entry has been deleted.",

server/lib/resetUserE2EKey.ts

@@ -1,6 +1,62 @@
+import { Meteor } from 'meteor/meteor';
+import { TAPi18n } from 'meteor/rocketchat:tap-i18n';
+
 import { Users, Subscriptions } from '../../app/models/server';
+import { settings } from '../../app/settings/server';
+import * as Mailer from '../../app/mailer';
+import { IUser } from '../../definition/IUser';
+
+const sendResetNotitification = function(uid: string): void {
+	const user: IUser = Users.findOneById(uid, {});
+	if (!user) {
+		throw new Meteor.Error('invalid-user');
+	}
+
+	const language = user.language || settings.get('Language') || 'en';
+	const addresses = user.emails?.filter(({ verified }: { verified: boolean}) => verified).map((e) => e.address);
+	if (!addresses?.length) {
+		return;
+	}
+
+	const t = (s: string): string => TAPi18n.__(s, { lng: language });
+	const text = `
+	${ t('Your_e2e_key_has_been_reset') }
+
+	${ t('E2E_Reset_Email_Content') }
+	`;
+	const html = `
+		<p>${ t('Your_e2e_key_has_been_reset') }</p>
+		<p>${ t('E2E_Reset_Email_Content') }</p>
+	`;
+
+	const from = settings.get('From_Email');
+	const subject = t('E2E_key_reset_email');
+
+	for (const address of addresses) {
+		Meteor.defer(() => {
+			try {
+				Mailer.send({
+					to: address,
+					from,
+					subject,
+					text,
+					html,
+				} as any);
+			} catch (error) {
+				throw new Meteor.Error('error-email-send-failed', `Error trying to send email: ${ error.message }`, {
+					function: 'resetUserE2EEncriptionKey',
+					message: error.message,
+				});
+			}
+		});
+	}
+};
+
+export function resetUserE2EEncriptionKey(uid: string, notifyUser: boolean): boolean {
+	if (notifyUser) {
+		sendResetNotitification(uid);
+	}
 
-export function resetUserE2EEncriptionKey(uid: string): boolean {
 	Users.resetE2EKey(uid);
 	Subscriptions.resetUserE2EKey(uid);