chore: reorganize backend folder structure — Phase 3 (REST API)

[sampaiodiego]

Proposed changes

Phase 3 of the backend folder-structure migration: move the REST API framework and all REST endpoints into the responsibility-based server/api/ structure. Files move as-is — only import paths change, no refactoring.

Folder structure

Community — before

apps/meteor/
├── app/
│   ├── api/server/                    REST API framework + endpoints
│   │   ├── ApiClass.ts  api.ts  api.helpers.ts  router.ts  definition.ts  ajv.ts  index.ts
│   │   ├── helpers/   (10)
│   │   ├── lib/       (21)
│   │   ├── middlewares/ (11)
│   │   ├── default/   (2)
│   │   └── v1/        (40 endpoint files)
│   └── livechat/
│       ├── server/api.ts              ← imports/rest aggregator
│       ├── server/api/
│       │   ├── rest.ts                ← v1 aggregator
│       │   ├── v1/    (14 omnichannel endpoints)
│       │   └── lib/   (14 helpers)
│       └── imports/server/rest/ (14 omnichannel endpoints)
└── server/                            (no api/)

Community — after

apps/meteor/server/api/
├── ApiClass.ts  api.ts  api.helpers.ts  router.ts  definition.ts  index.ts
├── validation/
│   └── ajv.ts
├── lib/        (31 — helpers + lib merged)
├── default/    (info.ts  openApi.ts)
└── v1/
    ├── (40 endpoint files)
    ├── middlewares/ (11)
    └── omnichannel/                   livechat REST, flattened
        ├── index.ts                   ← aggregator (was livechat api.ts + api/rest.ts)
        ├── (28 endpoints; the imports/rest agent.ts → agentDepartments.ts)
        └── lib/ (14 helpers)

→ app/api/server/  and  app/livechat/server/api*  removed

EE mirror — before / after (stays inside ee/)

Before

apps/meteor/ee/
├── app/
│   ├── api-enterprise/server/
│   │   ├── canned-responses.ts  index.ts
│   │   ├── lib/canned-responses.js
│   │   └── middlewares/license.ts
│   └── livechat-enterprise/server/api/
│       ├── index.ts  (+ 15 endpoint files)
│       └── lib/ (12 helpers)
└── server/api/                        (already existed: audit.ts, chat.ts, …)

After

apps/meteor/ee/server/api/
├── (existing: audit.ts, chat.ts, federation.ts, …)
├── lib/
│   └── canned-responses.js
└── v1/
    ├── canned-responses.ts
    ├── middlewares/license.ts
    └── omnichannel/
        ├── index.ts  (+ 15 endpoint files)
        └── lib/ (12 helpers)

→ ee/app/api-enterprise/  removed (index folded into ee/server/index.ts)
→ ee/app/livechat-enterprise/server/api/  moved out

Two commits for reviewability:

1. Community (app/api/server/ → server/api/)

• Framework files → server/api/ (ApiClass, api, router, definition, …)
• ajv.ts → server/api/validation/
• helpers/ + lib/ merged → server/api/lib/
• v1/ → server/api/v1/, middlewares/ → server/api/v1/middlewares/
• All livechat community REST → server/api/v1/omnichannel/ (flat). Both former source dirs (livechat/server/api/v1/ and the older livechat/imports/server/rest/) land here. The single filename collision (agent.ts) is resolved by renaming the imports/rest one to agentDepartments.ts (it only registers livechat/agents/:agentId/departments). The two registration aggregators are folded into server/api/v1/omnichannel/index.ts, and the app/livechat/server API files are removed entirely.

2. EE mirror (within ee/, license boundary preserved — no file leaves ee/)

• ee/app/livechat-enterprise/server/api/ → ee/server/api/v1/omnichannel/
• ee/app/api-enterprise/server/ → ee/server/api/ (endpoint → v1/, lib/ → api/lib/, middlewares/ → v1/middlewares/)
• api-enterprise index aggregator folded into ee/server/index.ts and deleted

Migration-script hardening (mandatory per plan)

• License-boundary guard in move-module.mjs + move-batch.mjs (refuses any move crossing the ee/ boundary)
• Single-file and index-directory aware external-import rewriting (fixed two real bugs that broke post-git mv import updates)
• Added tests/ to the import-scan dirs (caught by tsc, missed by lint)

Verification

• yarn lint --quiet — clean (0 unresolved imports)
• tsc --noEmit --skipLibCheck — 0 errors
• verify-no-old-imports.mjs — 0 stragglers for every Phase 3 path

Note

Not run here (need a running server/DB): the REST API integration suite and manual endpoint smoke tests.
Commit-split caveat: the community move repoints the EE files it later relocates, so those import edits ride in commit 2 — the branch tip is fully green, but commit 1 alone isn't independently buildable for a few leaf EE API files.

🤖 Generated with Claude Code

[dionisio-bot]

Looks like this PR is not ready to merge, because of the following issues:

• This PR is missing the 'stat: QA assured' label

Please fix the issues and try again

If you have any trouble, please check the PR guidelines

[changeset-bot]

⚠️ No Changeset found

Latest commit: 66e2489

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 85e81698-a64f-4ccc-80e2-2a0ae22704ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hacktron-app]

⏭️ Hacktron Security Check — Skipped

Reason: This PR exceeds Hacktron's 200-file review cap and will not be scanned. Split the PR into smaller changes for review coverage.

Split the PR into smaller commits or open separate PRs for unrelated changes.

[cubic-dev-ai]

2 issues found across 220 files

<sub>Note: This PR contains a large number of files. cubic only reviews up to 200 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
Tip: cubic used a learning from your PR history. Let your coding agent read cubic learnings directly with the cubic MCP.

Re-trigger cubic</sub>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.16%. Comparing base (b6e0d3b) to head (66e2489).

Additional details and impacted files

@@             Coverage Diff             @@
##           develop   #41126      +/-   ##
===========================================
+ Coverage    69.14%   69.16%   +0.02%     
===========================================
  Files         3433     3535     +102     
  Lines       132323   138107    +5784     
  Branches     23091    24542    +1451     
===========================================
+ Hits         91489    95527    +4038     
- Misses       37472    38558    +1086     
- Partials      3362     4022     +660     

Flag	Coverage Δ
e2e	59.35% <ø> (-0.01%)	⬇️
e2e-api	49.81% <100.00%> (+9.41%)	⬆️
unit	69.98% <100.00%> (-0.02%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rc-layne]

Caution

These are security findings reported by the security scanners configured in Layne. Findings may contain false positives - review them and fix what makes sense. If you believe a finding is not valid, contact the security team.

Layne found 4 high issues in this PR.

View 4 finding(s)

Severity	Scanner	File	Rule	Description
🟠 High	semgrep	apps/meteor/ee/server/api/v1/omnichannel/lib/triggers.ts:23	app.config.semgrep.rules.rocketchat.ssrf-validation-bypass-without-justification	SSRF validation is disabled. Ensure the URL is not user-controlled or is restricted to a known-safe allowlist.
🟠 High	semgrep	apps/meteor/server/api/v1/misc.ts:649	app.config.semgrep.rules.nodejs.fips-non-compliant-crypto	Non-FIPS-compliant cryptographic algorithm detected. FIPS 140-2/140-3 requires approved algorithms only. Use AES, SHA-256/384/512, HMAC-SHA256+, or RSA-2048+ instead. See: https://csrc.nist.gov/publications/detail/fips/140/3/final
🟠 High	semgrep	apps/meteor/server/api/v1/misc.ts:710	app.config.semgrep.rules.nodejs.fips-non-compliant-crypto	Non-FIPS-compliant cryptographic algorithm detected. FIPS 140-2/140-3 requires approved algorithms only. Use AES, SHA-256/384/512, HMAC-SHA256+, or RSA-2048+ instead. See: https://csrc.nist.gov/publications/detail/fips/140/3/final
🟠 High	semgrep	apps/meteor/server/api/v1/omnichannel/webhooks.ts:68	app.config.semgrep.rules.rocketchat.ssrf-validation-bypass-without-justification	SSRF validation is disabled. Ensure the URL is not user-controlled or is restricted to a known-safe allowlist.