Modernize rate limiting of sendMessage

- use permissions instead of roles
  (new permission is introduced)
- port to RateLimiter facade

The latter is necessary to keep tests passing.

packages/rocketchat-authorization/server/startup.js

@@ -46,6 +46,7 @@ Meteor.startup(function() {
 		{ _id: 'run-migration',                 roles : ['admin'] },
 		{ _id: 'set-moderator',                 roles : ['admin', 'owner'] },
 		{ _id: 'set-owner',                     roles : ['admin', 'owner'] },
+		{ _id: 'send-many-messages',            roles : ['admin', 'bot'] },
 		{ _id: 'unarchive-room',                roles : ['admin'] },
 		{ _id: 'view-c-room',                   roles : ['admin', 'user', 'bot', 'anonymous'] },
 		{ _id: 'user-generate-access-token',    roles : ['admin'] },

packages/rocketchat-lib/server/methods/sendMessage.js

@@ -68,14 +68,8 @@ Meteor.methods({
 	}
 });
 // Limit a user, who does not have the "bot" role, to sending 5 msgs/second
-DDPRateLimiter.addRule({
-	type: 'method',
-	name: 'sendMessage',
+RocketChat.RateLimiter.limitMethod('sendMessage', 5, 1000, {
 	userId(userId) {
-		const user = RocketChat.models.Users.findOneById(userId);
-		if (user == null || !user.roles) {
-			return true;
-		}
-		return user.roles.includes('bot');
+		return !RocketChat.authz.hasPermission(userId, 'send-many-messages');
 	}
-}, 5, 1000);
+});