Native build note: the upstream package.json lists node-gyp as a direct dependency, meaning at least one transitive native module requires compilation. Ensure your environment has Python 3, make, and a C++ compiler (e.g., build-essential on Debian/Ubuntu or Xcode CLI tools on macOS) before running npm install. No iOS pod install or Android linking is required; this is a pure Node.js/Meteor server package.

Project setup

1. Copy the source/ directory into your project root (e.g., my-project/rocketchat/).
2. Install Meteor globally if not present:

   curl https://install.meteor.com/ | sh
   

3. From inside source/ (the apps/meteor root), install dependencies:

   cd source && meteor npm install
   

4. Extend your tsconfig.json to include source/ paths:

   {
     "compilerOptions": {
       "baseUrl": ".",
       "paths": {
         "@rocket.chat/*": ["source/node_modules/@rocket.chat/*"]
       },
       "types": ["node"]
     },
     "include": ["source/**/*.ts", "source/**/*.tsx"]
   }
   

5. Set required environment variables before starting:

   export ROOT_URL=http://localhost:3000
   export MONGO_URL=mongodb://localhost:27017/rocketchat
   export PORT=3000
   

6. Start the application:

   cd source && meteor run
   

   Or for production builds, use meteor build and run the resulting Node bundle.

Public API

API and defaultRateLimiterOptions

import { API, defaultRateLimiterOptions } from 'source/app/api/server/api';

API is the central REST API router instance. Use it to register custom endpoints on top of the built-in Rocket.Chat routes. defaultRateLimiterOptions exposes the default rate-limiting configuration object so custom endpoints can inherit consistent throttling behavior.

getUserForCheck

import { getUserForCheck } from 'source/app/2fa/server/code/index';

async function getUserForCheck(userId: string): Promise<IUser | null>;

Fetches a minimal user projection from the database suitable for two-factor authentication checks. It returns only the fields needed for 2FA validation (emails, language, createdAt, services). Use this before calling any code-check method to avoid over-fetching user data.

ITwoFactorOptions

import type { ITwoFactorOptions } from 'source/app/2fa/server/code/index';

interface ITwoFactorOptions {
  disablePasswordFallback?: boolean;
  disableRememberMe?: boolean;
  requireSecondFactor?: boolean;
}

Configuration interface passed to two-factor enforcement functions. Set requireSecondFactor: true to force a second factor even when the user has not configured one, disablePasswordFallback: true to prevent password-based bypass, and disableRememberMe: true to disable the "remember this device" cookie flow.

emailCheck (EmailCheck instance)

import { emailCheck } from 'source/app/2fa/server/code/index';

Exported singleton instance of the EmailCheck two-factor method. Call emailCheck.isEnabled(user) to determine whether email-based 2FA is active for a given user, and emailCheck.verify(user, code, options) to validate a submitted code. Use this when you need to trigger or verify email-based OTP outside the default Meteor method pipeline.

Working examples

Scenario - Verify a user's two-factor code on a custom server endpoint

A backend route needs to confirm the caller's 2FA before executing a privileged action.

import { getUserForCheck, emailCheck } from 'source/app/2fa/server/code/index';
import type { ITwoFactorOptions } from 'source/app/2fa/server/code/index';

const twoFactorOptions: ITwoFactorOptions = {
  disablePasswordFallback: true,
  disableRememberMe: false,
  requireSecondFactor: true,
};

async function verifyUserTwoFactor(userId: string, submittedCode: string): Promise<boolean> {
  const user = await getUserForCheck(userId);
  if (!user) {
    throw new Error('User not found');
  }

  if (!emailCheck.isEnabled(user)) {
    // Email 2FA not configured; enforce via other methods or deny
    return false;
  }

  const result = await emailCheck.verify(user, submittedCode, twoFactorOptions);
  return result.verified;
}

Scenario - Register a custom REST API endpoint using the API instance

Extend Rocket.Chat's REST API with a project-specific endpoint that returns workspace metadata.

import { API } from 'source/app/api/server/api';

API.v1.addRoute(
  'custom/workspace-info',
  { authRequired: true },
  {
    async get() {
      return API.v1.success({
        workspaceName: 'My Custom Workspace',
        version: '8.5.0-develop',
        timestamp: new Date().toISOString(),
      });
    },
  },
);

This route becomes available at GET /api/v1/custom/workspace-info. The authRequired: true flag causes Rocket.Chat to reject unauthenticated requests automatically.

Scenario - Bootstrap Apple OAuth alongside the core server

Add Apple Sign-In support by importing the Apple OAuth module in the server startup file.

// In your custom server entry point, after importing the core server:
import 'source/server'; // core Rocket.Chat server startup
import 'source/app/apple/server/index'; // registers Apple OAuth service and login handler

// The Apple OAuth service and its Meteor login handler are now active.
// Configure APPLE_SERVICE_ID, APPLE_TEAM_ID, and APPLE_KEY_ID env vars:
process.env.APPLE_SERVICE_ID = 'com.example.myapp';
process.env.APPLE_TEAM_ID = 'ABCDE12345';

File walkthrough

• .docker/ - Contains the Dockerfile layer scripts and a licenses/ subdirectory with the Docker image's bundled LICENSE file.
• .openshift/ - JSON templates for OpenShift deployment: one ephemeral (no persistent storage) and one persistent-volume variant.
• .scripts/ - Internal tooling: make-migration.ts scaffolds DB migrations, run-ha.ts starts a multi-instance HA test setup, version.js automates version bumps.
• .storybook/ - Storybook main config, preview setup, decorators for Rocket.Chat UI components, and mocks for meteor and empty modules used in stories.
• app/ - The largest directory; each subdirectory is a self-contained Rocket.Chat feature module (e.g., 2fa/, api/, apple/, apps/, authorization/, file-upload/).
• client/ - Client-side Meteor templates, subscriptions, and UI logic not tied to any single feature module.
• definition/ - Global TypeScript ambient declarations and interface files shared across the monorepo.
• ee/ - Enterprise Edition modules gated behind a license check; mirrors the app/ structure.
• imports/ - Isomorphic helpers imported on both client and server without Meteor's lazy-loading boundary.
• lib/ - Pure utility functions: string helpers, date formatters, server-side HTTP utilities.
• packages/ - Local Meteor package overrides and additions not published to Atmosphere.
• private/ - Server-only assets (email templates, i18n files) bundled into the Meteor build but never served to clients.
• public/ - Statically served files (favicons, default avatars, robots.txt).
• reporters/ - Custom Mocha/Jest reporter implementations used in CI pipelines.
• server/ - Meteor server startup modules, service initializers, and the DDP server configuration.
• startRocketChat.ts - Full-edition entry point; imports EE modules in addition to FOSS features.
• startRocketChatFOSS.ts - FOSS entry point; excludes Enterprise Edition modules.
• jest.config.ts - Jest configuration (module name mapper, transform rules, test environment).
• tsconfig.json - Root TypeScript config; extended by tsconfig.webpack.json for the client bundle.

Common pitfalls and fixes

• Meteor not found at runtime: All meteor/* imports (e.g., meteor/accounts-base) require the Meteor toolchain. Running the bundle outside meteor run or meteor build will fail. Fix: always build with meteor build and execute the output via node main.js inside the generated bundle's bundle/programs/server/ directory.
• node-gyp compilation errors on install: Native modules require build tools. Fix: apt-get install -y build-essential python3 (Linux) or install Xcode CLI tools (macOS) before npm install.
• @rocket.chat/models resolution fails: This package is a workspace package in the monorepo. Fix: run meteor npm install from within source/ rather than from your project root, or add the path to your tsconfig.json paths mapping.
• ESM/CJS interop with import of Meteor packages: Meteor packages use its own module system. Fix: do not import them via Node's native ESM loader; only use them inside files processed by the Meteor bundler.
• Environment variables not set before Meteor startup: ROOT_URL and MONGO_URL must be present before the process starts or Meteor will throw immediately. Fix: export them in your shell or use a .env loader like dotenv before invoking meteor run.
• TypeScript strict mode errors in definition/: The upstream tsconfig.json enables strict: true. Fix: ensure your host project's tsconfig.json also sets "strict": true or cherry-pick only the ambient type files you need.

Vibe-coding prompt template

I have the Rocket.Chat Meteor app source (version 8.5.0-develop) copied into
the `source/` directory of my project. I also have `USAGE.md` in the same
directory describing all real exports and integration steps.

My project is a Node.js/TypeScript backend using Express. I need you to:

1. Read `USAGE.md` and `source/app/api/server/api.ts` to understand how the
   `API` export works.
2. Add a custom REST endpoint at `/api/v1/custom/health` that returns
   `{ status: "ok", uptime: process.uptime() }` using the real `API.v1.addRoute`
   method shown in `USAGE.md`.
3. Wire two-factor authentication into my existing `/login` route using
   `getUserForCheck` and `emailCheck` from
   `source/app/2fa/server/code/index.ts`.
4. Show me the exact `tsconfig.json` path aliases I need so TypeScript resolves
   `@rocket.chat/*` packages from `source/node_modules/`.
5. List any environment variables I must set, referencing the upstream package
   `user@example.com` and the `USAGE.md` "Project setup" section.

Work step-by-step, use only exports documented in `USAGE.md`, and produce
runnable TypeScript snippets for each step.

License and credit

Rocket.Chat is released under the MIT License. Enterprise Edition modules under source/ee/ may carry additional commercial terms; review source/ee/LICENSE and source/licenses/ for the full texts. Upstream source: user@example.com by RocketChat Technologies Corp.

This product’s unique contribution is clean room implementation of valuable code block into AVCP compatible standard.

The full install guide and integration prompts unlock after purchase.