fix: remove permissive any overloads from model find typings

IBaseModel exposed the class implementation signatures (options?: any) as
public overloads for findOneById, findOne and findPaginated, so invalid
FindOptions compiled silently and were ignored by the MongoDB driver.

Removing them surfaced and fixes:
- rooms.bannedUsers passed { offset, count } to findPaginated: pagination
  never applied, every banned subscription returned with full documents
- omnichannel department listings used offset instead of skip: every page
  returned the first page
- projections typo (rooms.hide, private group lookup) and bare projection
  objects (direct email reply, auto-transfer scheduler) fetched full
  documents; group lookup keeps roles for the room access validators
- omnichannel pagination helpers typed sort as Record<string, number>,
  which is not a valid mongo Sort

Author: KevLehman

.changeset/strict-find-options.md

@@ -0,0 +1,6 @@
+---
+'@rocket.chat/meteor': patch
+'@rocket.chat/model-typings': patch
+---
+
+Fixes broken pagination on `rooms.bannedUsers` and on omnichannel department listing endpoints, which ignored the `offset` parameter and always returned results from the first page. Also reduces payload over-fetching on several endpoints that unintentionally loaded full documents (`rooms.hide`, private group lookups, direct email replies, omnichannel auto-transfer), and removes the permissive model query typings that allowed these invalid find options to compile unnoticed.

apps/meteor/ee/server/lib/omnichannel/AutoTransferChatScheduler.ts

@@ -78,13 +78,7 @@ export class AutoTransferChatSchedulerClass {
 
 	private async transferRoom(roomId: string): Promise<void> {
 		this.logger.debug({ msg: 'Transferring room', roomId });
-		const room = await LivechatRooms.findOneById(roomId, {
-			_id: 1,
-			v: 1,
-			servedBy: 1,
-			open: 1,
-			departmentId: 1,
-		});
+		const room = await LivechatRooms.findOneById(roomId);
 		if (!room?.open || !room?.servedBy?._id) {
 			throw new Error('Room is not open or is not being served by an agent');
 		}

apps/meteor/ee/server/lib/omnichannel/Department.ts

@@ -24,7 +24,7 @@ export const findAllDepartmentsAvailable = async (
 		query = await applyDepartmentRestrictions(query, uid);
 	}
 
-	const { cursor, totalCount } = LivechatDepartment.findPaginated(query, { limit: count, offset, sort: { name: 1 } });
+	const { cursor, totalCount } = LivechatDepartment.findPaginated(query, { limit: count, skip: offset, sort: { name: 1 } });
 
 	const [departments, total] = await Promise.all([cursor.toArray(), totalCount]);
 
@@ -40,7 +40,7 @@ export const findAllDepartmentsByUnit = async (
 		{
 			ancestors: { $in: [unitId] },
 		},
-		{ limit: count, offset },
+		{ limit: count, skip: offset },
 	);
 
 	const [departments, total] = await Promise.all([cursor.toArray(), totalCount]);

apps/meteor/server/api/v1/groups.ts

@@ -106,7 +106,8 @@ async function findPrivateGroupByIdOrName({
 }> {
 	const room = await getRoomFromParams(params);
 
-	const user = await Users.findOneById(userId, { projections: { username: 1 } });
+	// `roles` is required by the room access validators, which read it straight from the user object
+	const user = await Users.findOneById(userId, { projection: { username: 1, roles: 1 } });
 
 	if (!room || !user || !(await canAccessRoomAsync(room, user))) {
 		throw new Meteor.Error('error-room-not-found', 'The required "roomId" or "roomName" param provided does not match any group');

apps/meteor/server/api/v1/omnichannel/lib/customFields.ts

@@ -9,7 +9,7 @@ export async function findLivechatCustomFields({
 	pagination: { offset, count, sort },
 }: {
 	text?: string;
-	pagination: { offset: number; count: number; sort: Record<string, number> };
+	pagination: { offset: number; count: number; sort: Record<string, 1 | -1> };
 }): Promise<PaginatedResult<{ customFields: Array<ILivechatCustomField> }>> {
 	const query = {
 		...(text && {

apps/meteor/server/api/v1/omnichannel/lib/transfer.ts

@@ -11,7 +11,7 @@ export async function findLivechatTransferHistory({
 	pagination: { offset, count, sort },
 }: {
 	rid: string;
-	pagination: { offset: number; count: number; sort: Record<string, number> };
+	pagination: { offset: number; count: number; sort: Record<string, 1 | -1> };
 }): Promise<PaginatedResult<{ history: IOmnichannelSystemMessage['transferData'][] }>> {
 	const { cursor, totalCount } = Messages.findPaginated(
 		{ rid, t: 'livechat_transfer_history' },

apps/meteor/server/api/v1/omnichannel/lib/triggers.ts

@@ -5,7 +5,7 @@ import type { PaginatedResult } from '@rocket.chat/rest-typings';
 export async function findTriggers({
 	pagination: { offset, count, sort },
 }: {
-	pagination: { offset: number; count: number; sort: Record<string, number> };
+	pagination: { offset: number; count: number; sort: Record<string, 1 | -1> };
 }): Promise<PaginatedResult<{ triggers: Array<ILivechatTrigger> }>> {
 	const { cursor, totalCount } = LivechatTrigger.findPaginated(
 		{},

apps/meteor/server/api/v1/rooms.ts

@@ -1301,7 +1301,7 @@ API.v1.post(
 			return API.v1.unauthorized();
 		}
 
-		const user = await Users.findOneById(this.userId, { projections: { _id: 1 } });
+		const user = await Users.findOneById(this.userId, { projection: { _id: 1 } });
 
 		if (!user) {
 			return API.v1.failure('error-invalid-user');
@@ -1706,7 +1706,10 @@ export const roomEndpoints = API.v1
 
 			const { offset, count } = await getPaginationItems(this.queryParams);
 
-			const { cursor, totalCount } = Subscriptions.findPaginated({ rid: roomId, status: 'BANNED' as const }, { offset, count });
+			const { cursor, totalCount } = Subscriptions.findPaginated(
+				{ rid: roomId, status: 'BANNED' as const },
+				{ sort: { ts: 1 }, skip: offset, limit: count, projection: { 'u._id': 1 } },
+			);
 
 			const [bannedSubs, total] = await Promise.all([cursor.toArray(), totalCount]);
 

apps/meteor/server/lib/notifications/processDirectEmail.ts

@@ -50,8 +50,10 @@ export const processDirectEmail = async function (email: ParsedMail): Promise<vo
 	}
 
 	const prevMessage = await Messages.findOneById(mid, {
-		rid: 1,
-		u: 1,
+		projection: {
+			rid: 1,
+			u: 1,
+		},
 	});
 
 	if (!prevMessage) {

packages/model-typings/src/models/IBaseModel.ts

@@ -60,11 +60,9 @@ export interface IBaseModel<
 
 	findOneById(_id: T['_id'], options?: FindOptions<T> | undefined): Promise<T | null>;
 	findOneById<P extends Document = T>(_id: T['_id'], options?: FindOptions<P>): Promise<P | null>;
-	findOneById(_id: T['_id'], options?: any): Promise<T | null>;
 
 	findOne(query?: Filter<T> | T['_id'], options?: undefined): Promise<T | null>;
-	findOne<P extends Document = T>(query: Filter<T> | T['_id'], options: FindOptions<P extends T ? T : P>): Promise<P | null>;
-	findOne<P>(query: Filter<T> | T['_id'], options?: any): Promise<WithId<T> | WithId<P> | null>;
+	findOne<P extends Document = T>(query: Filter<T> | T['_id'], options?: FindOptions<P extends T ? T : P>): Promise<P | null>;
 
 	find(query?: Filter<T>): FindCursor<ResultFields<T, C>>;
 	find<P extends Document = T>(query: Filter<T>, options: FindOptions<P extends T ? T : P>): FindCursor<P>;
@@ -74,7 +72,6 @@ export interface IBaseModel<
 	): FindCursor<WithId<P>> | FindCursor<WithId<T>>;
 
 	findPaginated<P extends Document = T>(query: Filter<T>, options?: FindOptions<P extends T ? T : P>): FindPaginated<FindCursor<WithId<P>>>;
-	findPaginated(query: Filter<T>, options?: any): FindPaginated<FindCursor<WithId<T>>>;
 
 	update(
 		filter: Filter<T>,