feat: expose video call APIs through RocketChatDesktop

[vianmangal]

feat: expose video call APIs through RocketChatDesktop

Closes #3506

What changed

• Expose the video call window preload API under window.RocketChatDesktop instead of a separate window.videoCallWindow global.
• Add a regression assertion that the video call preload does not expose the legacy bridge name.
• Update the Pexip authentication credentials documentation to use the unified bridge.

Why

The main window and video call window currently require the web app to look for different top-level Electron bridges. Using RocketChatDesktop in both window contexts gives the web app one bridge name and lets the shared desktop API contract describe these methods in one interface.

This removes the old videoCallWindow global, so the matching Rocket.Chat web client contract and caller update should be coordinated with this change.

Validation

• yarn test --runTestsByPath src/servers/main/preloadCoverage.main.spec.ts (14 tests passed)
• yarn lint (passed with 37 existing warnings)

Summary by CodeRabbit

• Updates
  • The desktop API exposed to video-call pages is now named RocketChatDesktop instead of videoCallWindow. The Pexip documentation reflects the updated API name; the documented method and credential response remain unchanged.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 0f7bfcb0-420f-40a9-a1e3-224072359018

📥 Commits

Reviewing files that changed from the base of the PR and between 5cc1885 and 35aae7c.

📒 Files selected for processing (3)

• docs/pexip-auth-credentials.md
• src/servers/main/preloadCoverage.main.spec.ts
• src/videoCallWindow/preload/index.ts

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📜 Recent review details

🧰 Additional context used

📓 Path-based instructions (2)

Source excerpt: Main-process specs use `*.main.spec.ts`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• src/servers/main/preloadCoverage.main.spec.ts

Source excerpt: Renderer specs use `*.spec.ts` / `*.spec.tsx`.

📄 CodeRabbit inference engine (AGENTS.md)

Files:

• src/servers/main/preloadCoverage.main.spec.ts

🔇 Additional comments (3)

src/servers/main/preloadCoverage.main.spec.ts (1)

672-672: LGTM!

Also applies to: 675-678

docs/pexip-auth-credentials.md (1)

18-18: LGTM!

Also applies to: 26-26

src/videoCallWindow/preload/index.ts (1)

14-14: 🗄️ Data Integrity & Integration

The repository documents the Pexip caller with window.RocketChatDesktop.getAuthCredentials() and removes the old bridge name from the preload. The actual Pexip page and its deployment state are not in this repository, so the comment does not establish that an outdated external caller remains.

---

Walkthrough

The video-call preload exposes its API as RocketChatDesktop instead of videoCallWindow. The coverage test and Pexip documentation now use the new name. The API methods and documented credentials remain unchanged.

Changes

Video call bridge

Layer / File(s)	Summary
Expose and document the shared API name src/videoCallWindow/preload/index.ts, src/servers/main/preloadCoverage.main.spec.ts, docs/pexip-auth-credentials.md	The preload exposes the API as RocketChatDesktop. The coverage test checks for that name, and the Pexip documentation uses it in the flow diagram and API heading.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Feature

Suggested labels: type: feature

Suggested reviewers: jeanfbrito

Merge Risk: ⚪ Minimal · up to 35aae

The video-call API now uses the shared bridge name. No concrete issue in this change remains that would prevent merging.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 35aae

The credential request still uses the existing authorization check, and no new credential disclosure was established. The main risk is that an older video-call page may not find the renamed API during a staggered rollout.

Retained concerns

• Low · architecture · inferred: Removing the legacy global without an alias may leave an older Pexip web-client caller unable to request credentials until its caller is updated. A deployed mismatch was not verified.

Security review details

Security Blast Radius

• inferred — The renamed JavaScript global does not itself extend the main-process credential authorization boundary to the separate main window: credential return remains tied to the video-call window or its hosted WebContents.

Security Findings and Attack Paths

• inferred — No PR-introduced credential-disclosure path was established: the bridge method and IPC authorization are unchanged apart from the exposed global’s name. Production page-origin reachability is not fully established by the handler evidence.

Trust Boundaries and Controls

• observed — The credential handler checks Electron WebContents identity and host relationship, not the bridge name or a URL-origin string. An unauthorized caller, or a request without stored credentials, receives null.

Hardening Proposals

• proposed — Coordinate the desktop bridge rename with the web-client caller and verify credential retrieval across the supported version combinations before removing compatibility for the old name.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: exposing video call APIs through the unified RocketChatDesktop bridge.
Linked Issues check	✅ Passed	PR #3527 satisfies issue #3506. src/videoCallWindow/preload/index.ts exposes the existing video-call methods as window.RocketChatDesktop instead of window.videoCallWindow. The preload coverage t…
Out of Scope Changes check	✅ Passed	The changes stay within issue #3506. The preload change implements the bridge migration. The test change verifies the migration. The Pexip documentation change updates the documented API name. No unre…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…

Warning

Errors were encountered while retrieving linked issues.

Errors (1)

• JIRA integration encountered authorization issues. Please disconnect and reconnect the integration in the CodeRabbit UI.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vianmangal]

Closing as superseded by #3510, which implemented the bridge consolidation under RocketChatDesktop.videoCall. Thanks!