What? :boat:

@lolimay following the conversation from here (#204 #249)

The following is the list of secure built-in modules

• assert,
• async_hooks, // The async_hooks module exposes functions to track asynchronous resources.
• buffer,
• crypto,
• dns, // dns resolver
• timers,
• util,
• stream, // for working with streaming data in Node.js
• readline, // reading data from file
• querystring,
• string_decoder,
• url,

The following is a list of un-secure built-in modules which I haven't added support of

• child_process,
• cluster // Cluster is an extensible multi-core server manager
• console // replacement for console
• constants // deprecated
• fs, // file system
• os,
• process,
• worker_threads,
• v8,
• vm,
• inspector,
• module,
• perf_hooks,
• punycode, // deprecated
• repl,
• trace_events,
• tty,
• http,
• http,
• https,
• path,
• net,
• zlib, // compress/extract from buffer

For the below 4 modules I'm not sure whether to include them or not. Currently, I've not included them

• domain,
• events,
• globals,
• tls, // its secure but this requires openssl installed

Why? :thinking:

Links :earth_americas:

PS :eyes:

Codecov Report

Merging #256 (4f58884) into master (e9ca98a) will increase coverage by 0.16%. The diff coverage is 100.00%.

@@            Coverage Diff             @@
##           master     #256      +/-   ##
==========================================
+ Coverage   53.81%   53.97%   +0.16%     
==========================================
  Files          70       70              
  Lines        2568     2577       +9     
  Branches      380      380              
==========================================
+ Hits         1382     1391       +9     
  Misses       1186     1186              

Impacted Files	Coverage Δ
src/server/misc/Utilities.ts	57.69% <100.00%> (+8.85%)	:arrow_up:

---

Continue to review full report at Codecov.

Legend - Click here to learn more Δ = absolute <relative> (impact), ø = not affected, ? = missing data Powered by Codecov. Last update e9ca98a...4f58884. Read the comment docs.

Not sure we should provide modules such as net, http, https etc. Since we actually don't want use other ways to access network excect existing APIs provided.

As for zlib, since we don't provide filesystem r/w access, it not a good idea introduce it into the project.

@lolimay thanks for the suggestion, removed support for those libraries

Is there a chance, that this will be merged?

@jschirrmacher I don't think its required now since node-modules are already supported with rocket.chat apps. More info here -> https://developer.rocket.chat/apps-engine/adding-features/npm-package-support-experimental

Note about using node modules in your app and publishing them to our marketplace: you must contact us ahead of time so we can enable it on your publisher. As it is still experimental, we are gatekeeping just to ensure everything works right. Once we are out of the experimental phase then we will enable it for all publishers.

How about using the builtin console package of node.js?

As of a current (1.36.0) api version of rc-apps, I get this messages:

packaging your app... !
[info] using TypeScript v4.9.4
2023-01-11 15:51:27.606 WARN  App has external module(s) as dependency
2023-01-11 15:51:27.745 WARN  App has native module(s) as dependency
 ›   Error: Failed to resolve module: console

Can you show me an example of this module being used? Also do share the package.json, tslint and tsconfig file

Is it something like the native console logs that we have in node like console.log('Some text')? I hope its not like this because I've been using this a ton of time

The funny thing is, there is no actual usage in my repository. An npm ls console doesn't show anything, and even a full text search only reveals @jest/console in package-lock.json.