fix: Bypass trash when removing OTR system messages and read receipts (…

…#32269)

.changeset/weak-turkeys-sit.md

@@ -0,0 +1,8 @@
+---
+"@rocket.chat/meteor": patch
+---
+
+Fixed a bad behavior with the interaction between OTR system messages & trash collection. We use trash collection as a temporary storage that holds recently deleted items from some collections. Messages is one of those. This was causing "User joined OTR" messages to be viewable when querying the trash collection.
+Since OTR messages are by definition private, code was updated to bypass trash collection when removing these special messages.
+
+Note: this only applies to these system messages. OTR user's messages are not stored on the database.

apps/meteor/ee/server/models/raw/ReadReceipts.ts

@@ -51,7 +51,7 @@ export class ReadReceiptsRaw extends BaseRaw<ReadReceipt> implements IReadReceip
 			},
 			ts: { $lte: until },
 		};
-		return this.deleteMany(query);
+		return this.col.deleteMany(query);
 	}
 
 	async removeByIdPinnedTimestampLimitAndUsers(

apps/meteor/server/models/raw/Messages.ts

@@ -673,7 +673,7 @@ export class MessagesRaw extends BaseRaw<IMessage> implements IMessagesModel {
 			},
 			ts: { $lte: ts },
 		};
-		return this.deleteMany(query);
+		return this.col.deleteMany(query);
 	}
 
 	addTranslations(messageId: string, translations: Record<string, string>, providerName: string): Promise<UpdateResult> {