fix: privacy leak in getRoomInfo and UI crash safety

[deepak0x]

This PR fixes a critical privacy issue in EmbeddedChatApi.getRoomInfo() and improves UI stability when room information cannot be fetched.

---

Closes #1127

Problem

1. Privacy Leak in getRoomInfo

Previously, getRoomInfo() called the Meteor method rooms/get with empty parameters. By default, this method returns all rooms (public channels, private groups, and DMs) that the authenticated user is a member of.

As a result, the Embedded Chat API exposed room data outside the scope of the configured embedded room (this.rid), violating the principle of least privilege and leaking private user data to the embedding context.

2. UI Crash on Failed Room Fetch

When room information could not be retrieved (for example due to a network error or archived room access), getRoomInfo() returned null. This caused ChatHeader to crash when attempting to access properties on the missing data, resulting in a white screen.

---

Solution

Privacy Fix

• Updated getRoomInfo() in EmbeddedChatApi.ts to use the rooms.info REST endpoint.
• The request is now explicitly scoped to the embedded room ID (this.rid), ensuring only the current room’s data is returned.

Error Handling

• Updated getRoomInfo() to return a safe fallback object ({ result: [] }) when the request fails or no room is found.

UI Safety

• Updated ChatHeader.js to safely handle empty or missing room data using a defensive fallback (roomData || {}), preventing runtime crashes.

---

Changes

• packages/api/src/EmbeddedChatApi.ts

  • Switched from rooms/get to rooms.info
  • Added scoped room lookup and safe error handling

• packages/react/src/views/ChatHeader/ChatHeader.js

  • Added null-check safeguards to prevent UI crashes