apps/meteor/app/lib/server/functions/saveUser/validateUserEditing.ts (1)

1-1: Optional refactor: Consider breaking down validation complexity.

The eslint-disable complexity directive suggests this function may benefit from decomposition. While the current implementation is acceptable, consider extracting validation groups into helper functions if complexity increases further.

apps/meteor/tests/end-to-end/api/users.ts (6)

581-589: Consolidate test hooks to avoid linter errors and reduce redundancy

Biome flags duplicate setup/teardown hooks. You can drop this after() entirely; beforeEach already enforces the desired baseline per test. Alternatively, convert both to beforeEach/afterEach if you want symmetry.

Suggested minimal change: remove the after() here.

-			after(async () => {
-				await updateSetting('VoIP_TeamCollab_Enabled', true);
-				await updatePermission('manage-voip-extensions', ['admin']);
-			});

---

592-614: Make identifiers unique to avoid test pollution across runs

Hardcoding email/username can collide on retries or parallelization. Generate unique values per run.

-						email: 'success_extension_user@rocket.chat',
-						name: 'success_extension_user',
-						username: 'success_extension_user',
+						email: `success_extension_user_${Date.now()}@rocket.chat`,
+						name: `success_extension_user_${Date.now()}`,
+						username: `success_extension_user_${Date.now()}`,

---

616-619: Minor: prefer idiomatic null-check

user! is unnecessary; just check truthiness.

-				if (user!) {
+				if (user) {
 					await deleteUser(user);
 				}

---

621-646: Add a regex-negative test to cover invalid extensions

The issue requires validating extensions against a RegEx. Please add a failing case (e.g., non‑digits or wrong length) to assert 400 with the expected errorType.

I can draft an additional it(...) that posts freeSwitchExtension: '12ab' and expects errorType like 'invalid-params' or 'error-extension-invalid' (confirm the exact error key).

---

2417-2434: Avoid duplicate hooks and tighten isolation

This describe has before, beforeEach, and after. The linter complains about duplicate hooks across the suite. Also, using beforeEach to set settings/permissions is enough; consider removing the after() here, and if you need a fresh user per test, switch to beforeEach to create/delete it per test for isolation.

-			let user: TestUser<IUser>;
-
-			before(async () => {
-				user = await createUser();
-			});
-
-			after(async () => {
-				await Promise.all([
-					deleteUser(user),
-					updateSetting('VoIP_TeamCollab_Enabled', true),
-					updatePermission('manage-voip-extensions', ['admin']),
-				]);
-			});
+			let user: TestUser<IUser>;
+			beforeEach(async () => {
+				user = await createUser();
+			});
+			afterEach(async () => {
+				await deleteUser(user);
+			});

Then keep the existing beforeEach that sets permissions/settings.

---

2484-2500: Assert the exact error payload for permission and setting checks

Add explicit expectations for errorType to strengthen assertions and maintain consistency with the create‑flow tests.

-					.expect(400)
+					.expect(400)
 					.expect((res) => {
-						expect(res.body).to.have.property('success', false);
+						expect(res.body).to.have.property('success', false);
+						expect(res.body).to.have.property('errorType', 'error-action-not-allowed');
 					});

Similarly for the permission case above, assert errorType 'error-action-not-allowed'.

apps/meteor/client/views/admin/users/AdminUserForm.tsx (2)

58-61: Remove duplicated type field; rely on REST typings

freeSwitchExtension is already in UserCreateParamsPOST. Duplicating it in the intersection risks drift.

-export type UserFormProps = Omit<
-	UserCreateParamsPOST & { avatar: AvatarObject; passwordConfirmation: string; freeSwitchExtension?: string },
-	'fields'
->;
+export type UserFormProps = Omit<UserCreateParamsPOST & { avatar: AvatarObject; passwordConfirmation: string }, 'fields'>;

---

345-356: Client-side input hints for better UX (numeric only, optional pattern)

Add inputMode='numeric' and optionally a basic pattern to guide users. Keep server as source of truth.

-									render={({ field }) => <TextInput {...field} id={voiceExtensionId} flexGrow={1} />}
+									render={({ field }) => (
+										<TextInput
+											{...field}
+											id={voiceExtensionId}
+											flexGrow={1}
+											inputMode='numeric'
+											autoComplete='off'
+										/>
+									)}

If there is a configurable regex in settings, consider rendering a FieldHint with that pattern.

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Disabled knowledge base sources:

• Jira integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.