From ed2175c0806d6f2e419c81ec7e5b53ce83e94f04 Mon Sep 17 00:00:00 2001
From: alma <alma@governance-labs.org>
Date: Tue, 13 Jan 2026 22:17:19 +0100
Subject: [PATCH] rc Upgrade

---
 app/api/rocket-chat/messages/route.ts         | 22 +++++++++++++++++--
 docs/DEPLOYMENT.md                            |  1 +
 lib/env.ts                                    |  1 +
 .../notifications/rocketchat-adapter.ts       | 10 ++++++++-
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/app/api/rocket-chat/messages/route.ts b/app/api/rocket-chat/messages/route.ts
index eea2906..ad0136b 100644
--- a/app/api/rocket-chat/messages/route.ts
+++ b/app/api/rocket-chat/messages/route.ts
@@ -15,9 +15,19 @@ async function getUserToken(baseUrl: string) {
     };
 
     // Step 2: Create user token using admin credentials
+    // RocketChat 8.0.2+ requires a 'secret' parameter
+    const secret = process.env.ROCKET_CHAT_CREATE_TOKEN_SECRET;
+    if (!secret) {
+      console.error('ROCKET_CHAT_CREATE_TOKEN_SECRET is not configured');
+      return null;
+    }
+
     const createTokenResponse = await fetch(`${baseUrl}/api/v1/users.createToken`, {
       method: 'POST',
-      headers: adminHeaders
+      headers: adminHeaders,
+      body: JSON.stringify({
+        secret: secret
+      })
     });
 
     if (!createTokenResponse.ok) {
@@ -124,11 +134,19 @@ export async function GET(request: Request) {
     });
 
     // Step 3: Create a token for the current user
+    // RocketChat 8.0.2+ requires a 'secret' parameter
+    const secret = process.env.ROCKET_CHAT_CREATE_TOKEN_SECRET;
+    if (!secret) {
+      logger.error('[ROCKET_CHAT] ROCKET_CHAT_CREATE_TOKEN_SECRET is not configured');
+      return NextResponse.json({ messages: [] }, { status: 200 });
+    }
+
     const createTokenResponse = await fetch(`${baseUrl}/api/v1/users.createToken`, {
       method: 'POST',
       headers: adminHeaders,
       body: JSON.stringify({
-        userId: currentUser._id
+        userId: currentUser._id,
+        secret: secret
       })
     });
 
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 0ff4998..20edf8c 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -160,6 +160,7 @@ LEANTIME_TOKEN=<token>
 # RocketChat
 ROCKET_CHAT_TOKEN=<token>
 ROCKET_CHAT_USER_ID=<user-id>
+ROCKET_CHAT_CREATE_TOKEN_SECRET=<secret> # Required for RocketChat 8.0.2+ (must match CREATE_TOKENS_FOR_USERS_SECRET on RocketChat server)
 NEXT_PUBLIC_IFRAME_PAROLE_URL=https://rocketchat.example.com/channel/general
 
 # N8N
diff --git a/lib/env.ts b/lib/env.ts
index 3bb6d8e..b460743 100644
--- a/lib/env.ts
+++ b/lib/env.ts
@@ -13,6 +13,7 @@ const envSchema = z.object({
   LEANTIME_API_URL: z.string().url(),
   ROCKET_CHAT_TOKEN: z.string(),
   ROCKET_CHAT_USER_ID: z.string(),
+  ROCKET_CHAT_CREATE_TOKEN_SECRET: z.string().optional(),
 });
 
 export const env = envSchema.parse(process.env); 
\ No newline at end of file
diff --git a/lib/services/notifications/rocketchat-adapter.ts b/lib/services/notifications/rocketchat-adapter.ts
index b8a5c1d..4447c03 100644
--- a/lib/services/notifications/rocketchat-adapter.ts
+++ b/lib/services/notifications/rocketchat-adapter.ts
@@ -129,11 +129,19 @@ export class RocketChatAdapter implements NotificationAdapter {
       };
 
       // Create token for the specific user
+      // RocketChat 8.0.2+ requires a 'secret' parameter
+      const secret = process.env.ROCKET_CHAT_CREATE_TOKEN_SECRET;
+      if (!secret) {
+        logger.error('[ROCKETCHAT_ADAPTER] ROCKET_CHAT_CREATE_TOKEN_SECRET is not configured');
+        return null;
+      }
+
       const createTokenResponse = await fetch(`${this.baseUrl}/api/v1/users.createToken`, {
         method: 'POST',
         headers: adminHeaders,
         body: JSON.stringify({
-          userId: rocketChatUserId
+          userId: rocketChatUserId,
+          secret: secret
         })
       });