From 0082e3e94d97b2de431b3eb5d4f7dbaa969ad5f9 Mon Sep 17 00:00:00 2001 From: Jesse Hallam Date: Fri, 13 Jun 2025 17:12:05 -0300 Subject: [PATCH] enforce License.IsSeatCountEnforced if set (#31354) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * enforce License.IsSeatCountEnforced if set If a license sets `IsSeatCountEnforced`, enforce the user limit therein as a hard cap. Fixes: https://mattermost.atlassian.net/browse/CLD-9260 * remove duplicate tests * Improve user limit error messages and display - Add separate error messages for licensed vs unlicensed servers - Licensed servers: "Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMITS" - Unlicensed servers: "Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED" - Remove redundant "Contact administrator" text from activation errors shown to admins - Fix system console to display actual server error messages instead of generic "Failed to activate user" 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude * Add license nil check and test coverage - Add license != nil check in GetServerLimits to prevent panic - Add test case to verify graceful handling of license being set to nil - Ensures fallback to hard-coded limits when license becomes nil Co-authored-by: lieut-data * Fix user limits tests to expect license-specific error IDs Update test expectations to use the new license-specific error IDs: - app.user.update_active.license_user_limit.exceeded for licensed server user activation - api.user.create_user.license_user_limits.exceeded for licensed server user creation Also update frontend to show actual server error messages instead of generic ones in system console. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude * Remove redundant license nil test The test couldn't meaningfully verify nil license behavior since it relied on hard-coded constants that can't be modified in the test. Co-authored-by: lieut-data * Fix whitespace issue in limits_test.go Remove unnecessary trailing newline to pass style checks. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude * updated i18n * s/ERROR_LICENSED_USERS_LIMITS/ERROR_LICENSED_USERS_LIMIT_EXCEEDED/, expand warning log * Add 5% grace period for licensed user limits - Add calculateGraceLimit() function with 5% or +1 minimum grace - Apply grace period only to licensed servers with seat count enforcement - Handle zero user licenses by returning zero grace limit - Add comprehensive test coverage for grace period scenarios - Unlicensed servers maintain existing hard-coded limits without grace 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude * Fix TestCreateUserOrGuestSeatCountEnforcement to account for 5% grace period The test was failing because it expected user creation to fail at exactly the license limit, but the implementation now includes a 5% grace period before enforcement kicks in. Changes: - Update test cases to create users up to the grace limit (6 for a 5-user license) - Add comments explaining the grace period calculation - Both regular user and guest user creation tests now properly validate enforcement at the grace limit rather than the base license limit 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude * Fix TestUpdateActiveWithUserLimits to account for 5% grace period Update test expectations to match the new grace period behavior: - At base limit (100) but below grace limit (105): should succeed - At grace limit (105): should fail - Above grace limit (106): should fail This aligns the tests with the license enforcement implementation that includes a 5% grace period above the licensed user count. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --------- Co-authored-by: Claude Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> Co-authored-by: lieut-data Co-authored-by: Mattermost Build --- server/channels/app/limits.go | 57 +- server/channels/app/limits_test.go | 399 +++++++++++++- server/channels/app/user.go | 30 +- server/channels/app/user_limits_test.go | 496 ++++++++++++++++++ server/channels/app/user_test.go | 159 ------ server/i18n/en.json | 10 +- server/public/model/license.go | 23 +- .../system_user_detail/system_user_detail.tsx | 8 +- 8 files changed, 978 insertions(+), 204 deletions(-) create mode 100644 server/channels/app/user_limits_test.go diff --git a/server/channels/app/limits.go b/server/channels/app/limits.go index 669715d647..29762e7c1b 100644 --- a/server/channels/app/limits.go +++ b/server/channels/app/limits.go @@ -6,8 +6,6 @@ package app import ( "net/http" - "github.com/mattermost/mattermost/server/public/shared/mlog" - "github.com/mattermost/mattermost/server/public/model" ) @@ -16,37 +14,54 @@ const ( maxUsersHardLimit = 5_000 ) +// calculateGraceLimit calculates a grace limit that is 5% above the base limit +// or at least 1 user above the base limit, whichever is higher. +// Special case: if baseLimit is 0, returns 0. +func calculateGraceLimit(baseLimit int64) int64 { + if baseLimit == 0 { + return 0 + } + graceFromPercentage := int64(float64(baseLimit) * 1.05) + graceFromFloor := baseLimit + 1 + if graceFromPercentage > graceFromFloor { + return graceFromPercentage + } + return graceFromFloor +} + func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) { - var limits = &model.ServerLimits{} + limits := &model.ServerLimits{} + license := a.License() - if a.shouldShowUserLimits() { - activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{}) - if appErr != nil { - mlog.Error("Failed to get active user count from database", mlog.String("error", appErr.Error())) - return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr) - } - - limits.ActiveUserCount = activeUserCount + if license == nil && maxUsersLimit > 0 { + // Enforce hard-coded limits for unlicensed servers (no grace period). limits.MaxUsersLimit = maxUsersLimit limits.MaxUsersHardLimit = maxUsersHardLimit + } else if license != nil && license.IsSeatCountEnforced && license.Features != nil && license.Features.Users != nil { + // Enforce license limits as required by the license with grace period. + licenseUserLimit := int64(*license.Features.Users) + limits.MaxUsersLimit = licenseUserLimit + limits.MaxUsersHardLimit = calculateGraceLimit(licenseUserLimit) } + activeUserCount, appErr := a.Srv().Store().User().Count(model.UserCountOptions{}) + if appErr != nil { + return nil, model.NewAppError("GetServerLimits", "app.limits.get_app_limits.user_count.store_error", nil, "", http.StatusInternalServerError).Wrap(appErr) + } + limits.ActiveUserCount = activeUserCount + return limits, nil } -func (a *App) shouldShowUserLimits() bool { - if maxUsersLimit == 0 { - return false - } - - return a.License() == nil -} - -func (a *App) isHardUserLimitExceeded() (bool, *model.AppError) { +func (a *App) isAtUserLimit() (bool, *model.AppError) { userLimits, appErr := a.GetServerLimits() if appErr != nil { return false, appErr } - return userLimits.ActiveUserCount > userLimits.MaxUsersHardLimit, appErr + if userLimits.MaxUsersHardLimit == 0 { + return false, nil + } + + return userLimits.ActiveUserCount >= userLimits.MaxUsersHardLimit, appErr } diff --git a/server/channels/app/limits_test.go b/server/channels/app/limits_test.go index 5d5183383d..653571f852 100644 --- a/server/channels/app/limits_test.go +++ b/server/channels/app/limits_test.go @@ -7,27 +7,35 @@ import ( "testing" "github.com/mattermost/mattermost/server/public/model" + storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks" + "github.com/stretchr/testify/mock" "github.com/stretchr/testify/require" ) func TestGetServerLimits(t *testing.T) { mainHelper.Parallel(t) - t.Run("base case", func(t *testing.T) { + + t.Run("unlicensed server shows hard-coded limits", func(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) // InitBasic creates 3 users by default require.Equal(t, int64(3), serverLimits.ActiveUserCount) require.Equal(t, int64(2500), serverLimits.MaxUsersLimit) + require.Equal(t, int64(5000), serverLimits.MaxUsersHardLimit) }) t.Run("user count should increase on creating new user and decrease on permanently deleting", func(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) require.Equal(t, int64(3), serverLimits.ActiveUserCount) @@ -50,6 +58,8 @@ func TestGetServerLimits(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) require.Equal(t, int64(3), serverLimits.ActiveUserCount) @@ -72,6 +82,8 @@ func TestGetServerLimits(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) require.Equal(t, int64(3), serverLimits.ActiveUserCount) @@ -95,6 +107,8 @@ func TestGetServerLimits(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) require.Equal(t, int64(3), serverLimits.ActiveUserCount) @@ -118,6 +132,8 @@ func TestGetServerLimits(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() + th.App.Srv().SetLicense(nil) + serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) require.Equal(t, int64(3), serverLimits.ActiveUserCount) @@ -136,16 +152,391 @@ func TestGetServerLimits(t *testing.T) { require.Equal(t, int64(3), serverLimits.ActiveUserCount) }) - t.Run("limits should be empty when there is a license", func(t *testing.T) { + t.Run("licensed server without seat count enforcement shows no limits", func(t *testing.T) { th := Setup(t).InitBasic() defer th.TearDown() - th.App.Srv().SetLicense(model.NewTestLicense()) + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + th.App.Srv().SetLicense(license) serverLimits, appErr := th.App.GetServerLimits() require.Nil(t, appErr) - require.Equal(t, int64(0), serverLimits.ActiveUserCount) + require.Greater(t, serverLimits.ActiveUserCount, int64(0)) require.Equal(t, int64(0), serverLimits.MaxUsersLimit) + require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit) + }) + + t.Run("licensed server with seat count enforcement shows license limits with grace period", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 100 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + serverLimits, appErr := th.App.GetServerLimits() + require.Nil(t, appErr) + + // InitBasic creates 3 users by default + require.Equal(t, int64(3), serverLimits.ActiveUserCount) + require.Equal(t, int64(100), serverLimits.MaxUsersLimit) + require.Equal(t, int64(105), serverLimits.MaxUsersHardLimit) // 100 + 5% = 105 + }) + + t.Run("licensed server with seat count enforcement but no Users feature shows no limits", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = nil + th.App.Srv().SetLicense(license) + + serverLimits, appErr := th.App.GetServerLimits() + require.Nil(t, appErr) + + require.Greater(t, serverLimits.ActiveUserCount, int64(0)) + require.Equal(t, int64(0), serverLimits.MaxUsersLimit) + require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit) + }) + + t.Run("licensed server with seat count enforcement and zero Users shows zero limits", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 0 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + serverLimits, appErr := th.App.GetServerLimits() + require.Nil(t, appErr) + + require.Greater(t, serverLimits.ActiveUserCount, int64(0)) + require.Equal(t, int64(0), serverLimits.MaxUsersLimit) + require.Equal(t, int64(0), serverLimits.MaxUsersHardLimit) // No grace for 0 users }) } + +func TestIsAtUserLimit(t *testing.T) { + mainHelper.Parallel(t) + + t.Run("unlicensed server", func(t *testing.T) { + t.Run("below hard limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(4000), nil) // Under hard limit of 5000 + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) + }) + + t.Run("at hard limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(5000), nil) // At hard limit of 5000 + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.True(t, atLimit) + }) + + t.Run("above hard limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(6000), nil) // Over hard limit of 5000 + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.True(t, atLimit) + }) + }) + + t.Run("licensed server with seat count enforcement", func(t *testing.T) { + t.Run("below base limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // InitBasic creates 3 users, so we're below the base limit of 5 and grace limit of 6 + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) + }) + + t.Run("at base limit but below grace limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 2 additional users to have 5 total (at base limit of 5, but below grace limit of 6) + th.CreateUser() + th.CreateUser() + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) // Should be false due to grace period + }) + + t.Run("at grace limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(6), nil) // At grace limit of 6 (5 + 1) + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.True(t, atLimit) + }) + + t.Run("above grace limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(7), nil) // Above grace limit of 6 + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.True(t, atLimit) + }) + }) + + t.Run("licensed server without seat count enforcement", func(t *testing.T) { + t.Run("below unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 2 additional users to have 3 total (below limit of 5) + th.CreateUser() + th.CreateUser() + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) + }) + + t.Run("at unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 4 additional users to have 5 total (at limit of 5) + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) + }) + + t.Run("above unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 5 additional users to have 6 total (above limit of 5) + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + + atLimit, appErr := th.App.isAtUserLimit() + require.Nil(t, appErr) + require.False(t, atLimit) + }) + }) +} + +func TestGracePeriodBehavior(t *testing.T) { + mainHelper.Parallel(t) + + t.Run("grace period examples", func(t *testing.T) { + tests := []struct { + name string + licenseUserLimit int + expectedBaseLimit int64 + expectedGraceLimit int64 + }{ + { + name: "zero license users gets zero grace", + licenseUserLimit: 0, + expectedBaseLimit: 0, + expectedGraceLimit: 0, // Special case: 0 users = 0 grace limit + }, + { + name: "small license uses floor (10 users)", + licenseUserLimit: 10, + expectedBaseLimit: 10, + expectedGraceLimit: 11, // 10 + max(5%, 1) = 10 + 1 + }, + { + name: "medium license uses percentage (100 users)", + licenseUserLimit: 100, + expectedBaseLimit: 100, + expectedGraceLimit: 105, // 100 + max(5%, 1) = 100 + 5 + }, + { + name: "large license uses percentage (1000 users)", + licenseUserLimit: 1000, + expectedBaseLimit: 1000, + expectedGraceLimit: 1050, // 1000 + max(5%, 1) = 1000 + 50 + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &tt.licenseUserLimit + th.App.Srv().SetLicense(license) + + serverLimits, appErr := th.App.GetServerLimits() + require.Nil(t, appErr) + + require.Equal(t, tt.expectedBaseLimit, serverLimits.MaxUsersLimit) + require.Equal(t, tt.expectedGraceLimit, serverLimits.MaxUsersHardLimit) + }) + } + }) + + t.Run("unlicensed server has no grace period", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + serverLimits, appErr := th.App.GetServerLimits() + require.Nil(t, appErr) + + // Unlicensed servers should not get grace period + require.Equal(t, int64(2500), serverLimits.MaxUsersLimit) + require.Equal(t, int64(5000), serverLimits.MaxUsersHardLimit) // No grace, stays at 5000 + }) +} + +func TestCalculateGraceLimit(t *testing.T) { + mainHelper.Parallel(t) + + tests := []struct { + name string + baseLimit int64 + expected int64 + }{ + { + name: "zero base limit", + baseLimit: 0, + expected: 0, // Special case: 0 users = 0 grace limit + }, + { + name: "one user base limit", + baseLimit: 1, + expected: 2, // max(1 * 1.05, 1 + 1) = max(1.05 -> 1, 2) = 2 + }, + { + name: "small base limit where floor applies", + baseLimit: 10, + expected: 11, // max(10 * 1.05, 10 + 1) = max(10.5 -> 10, 11) = 11 + }, + { + name: "small base limit where percentage applies", + baseLimit: 20, + expected: 21, // max(20 * 1.05, 20 + 1) = max(21, 21) = 21 + }, + { + name: "medium base limit where percentage applies", + baseLimit: 100, + expected: 105, // max(100 * 1.05, 100 + 1) = max(105, 101) = 105 + }, + { + name: "large base limit where percentage applies", + baseLimit: 1000, + expected: 1050, // max(1000 * 1.05, 1000 + 1) = max(1050, 1001) = 1050 + }, + { + name: "very large base limit", + baseLimit: 5000, + expected: 5250, // max(5000 * 1.05, 5000 + 1) = max(5250, 5001) = 5250 + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + result := calculateGraceLimit(tt.baseLimit) + require.Equal(t, tt.expected, result, "calculateGraceLimit(%d) = %d, expected %d", tt.baseLimit, result, tt.expected) + }) + } +} diff --git a/server/channels/app/user.go b/server/channels/app/user.go index 914f827655..0b795662f5 100644 --- a/server/channels/app/user.go +++ b/server/channels/app/user.go @@ -236,12 +236,16 @@ func (a *App) CreateGuest(c request.CTX, user *model.User) (*model.User, *model. } func (a *App) createUserOrGuest(c request.CTX, user *model.User, guest bool) (*model.User, *model.AppError) { - exceeded, limitErr := a.isHardUserLimitExceeded() + atUserLimit, limitErr := a.isAtUserLimit() if limitErr != nil { return nil, limitErr } - if exceeded { + if atUserLimit { + // Use different error messages based on whether server is licensed + if a.License() != nil { + return nil, model.NewAppError("createUserOrGuest", "api.user.create_user.license_user_limits.exceeded", nil, "", http.StatusBadRequest) + } return nil, model.NewAppError("createUserOrGuest", "api.user.create_user.user_limits.exceeded", nil, "", http.StatusBadRequest) } @@ -332,7 +336,12 @@ func (a *App) createUserOrGuest(c request.CTX, user *model.User, guest bool) (*m c.Logger().Error("Error fetching user limits in createUserOrGuest", mlog.Err(limitErr)) } else { if userLimits.ActiveUserCount > userLimits.MaxUsersLimit { - c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Created user exceeds the total activated users limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + // Use different warning messages based on whether server is licensed + if a.License() != nil { + c.Logger().Warn("ERROR_LICENSED_USERS_LIMIT_EXCEEDED: Created user exceeds the maximum licensed users.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + } else { + c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Created user exceeds the total activated users limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + } } } @@ -1013,12 +1022,16 @@ func (a *App) invalidateUserChannelMembersCaches(c request.CTX, userID string) * func (a *App) UpdateActive(c request.CTX, user *model.User, active bool) (*model.User, *model.AppError) { if active { - exceeded, appErr := a.isHardUserLimitExceeded() + atUserLimit, appErr := a.isAtUserLimit() if appErr != nil { return nil, appErr } - if exceeded { + if atUserLimit { + // Use different error messages based on whether server is licensed + if a.License() != nil { + return nil, model.NewAppError("UpdateActive", "app.user.update_active.license_user_limit.exceeded", nil, "", http.StatusBadRequest) + } return nil, model.NewAppError("UpdateActive", "app.user.update_active.user_limit.exceeded", nil, "", http.StatusBadRequest) } } @@ -1076,7 +1089,12 @@ func (a *App) UpdateActive(c request.CTX, user *model.User, active bool) (*model c.Logger().Error("Error fetching user limits in UpdateActive", mlog.Err(appErr)) } else { if userLimits.ActiveUserCount > userLimits.MaxUsersLimit { - c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Activated user exceeds the total active user limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + // Use different warning messages based on whether server is licensed + if a.License() != nil { + c.Logger().Warn("ERROR_LICENSED_USERS_LIMIT_EXCEEDED: Activated user exceeds the maximum licensed users.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + } else { + c.Logger().Warn("ERROR_SAFETY_LIMITS_EXCEEDED: Activated user exceeds the total active user limit.", mlog.Int("user_limit", userLimits.MaxUsersLimit)) + } } } } diff --git a/server/channels/app/user_limits_test.go b/server/channels/app/user_limits_test.go new file mode 100644 index 0000000000..fc08cc4d6e --- /dev/null +++ b/server/channels/app/user_limits_test.go @@ -0,0 +1,496 @@ +// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved. +// See LICENSE.txt for license information. + +package app + +import ( + "testing" + + "github.com/mattermost/mattermost/server/public/model" + storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks" + "github.com/stretchr/testify/mock" + "github.com/stretchr/testify/require" +) + +func TestUpdateActiveWithUserLimits(t *testing.T) { + mainHelper.Parallel(t) + + t.Run("unlicensed server", func(t *testing.T) { + t.Run("reactivation allowed below hard limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + // Deactivate user + deactivatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false) + require.Nil(t, appErr) + require.NotEqual(t, 0, deactivatedUser.DeleteAt) + + // Reactivate user (should succeed - below hard limit) + updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + + t.Run("reactivation blocked at hard limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + // Mock user count at hard limit + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(5000), nil) // At 5000 hard limit + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + user := &model.User{ + Id: model.NewId(), + Email: "test@example.com", + Username: "testuser", + DeleteAt: model.GetMillis(), + } + + // Try to reactivate user (should fail) + updatedUser, appErr := th.App.UpdateActive(th.Context, user, true) + require.NotNil(t, appErr) + require.Nil(t, updatedUser) + require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id) + }) + + t.Run("reactivation blocked above hard limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + // Mock user count to exceed hard limit + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(6000), nil) // Over 5000 hard limit + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + user := &model.User{ + Id: model.NewId(), + Email: "test@example.com", + Username: "testuser", + DeleteAt: model.GetMillis(), + } + + // Try to reactivate user (should fail) + updatedUser, appErr := th.App.UpdateActive(th.Context, user, true) + require.NotNil(t, appErr) + require.Nil(t, updatedUser) + require.Equal(t, "app.user.update_active.user_limit.exceeded", appErr.Id) + }) + }) + + t.Run("licensed server with seat count enforcement", func(t *testing.T) { + t.Run("reactivation allowed below limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 100 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Deactivate user + _, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false) + require.Nil(t, appErr) + + // Reactivate user (should succeed - below limit) + updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + + t.Run("reactivation blocked at grace limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + userLimit := 100 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Mock user count at grace limit (105 = 100 + 5% grace period) + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(105), nil) // At grace limit + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + user := &model.User{ + Id: model.NewId(), + Email: "test@example.com", + Username: "testuser", + DeleteAt: model.GetMillis(), + } + + // Try to reactivate user (should fail) + updatedUser, appErr := th.App.UpdateActive(th.Context, user, true) + require.NotNil(t, appErr) + require.Nil(t, updatedUser) + require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id) + }) + + t.Run("reactivation allowed at base limit but below grace limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 // Grace limit will be 6 (5 + 1 minimum) + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // InitBasic creates 3 users, create 2 more to reach base limit of 5 + th.CreateUser() + th.CreateUser() + + // Deactivate a user + _, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false) + require.Nil(t, appErr) + + // Reactivate user (should succeed - we're at base limit 5 but below grace limit 6) + updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + + t.Run("reactivation blocked above grace limit", func(t *testing.T) { + th := SetupWithStoreMock(t) + defer th.TearDown() + + userLimit := 100 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Mock user count above grace limit (106 > 105 grace limit) + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(int64(106), nil) // Above grace limit + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + + user := &model.User{ + Id: model.NewId(), + Email: "test@example.com", + Username: "testuser", + DeleteAt: model.GetMillis(), + } + + // Try to reactivate user (should fail) + updatedUser, appErr := th.App.UpdateActive(th.Context, user, true) + require.NotNil(t, appErr) + require.Nil(t, updatedUser) + require.Equal(t, "app.user.update_active.license_user_limit.exceeded", appErr.Id) + }) + }) + + t.Run("licensed server without seat count enforcement", func(t *testing.T) { + t.Run("reactivation allowed below unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 2 additional users to have 3 total (below limit of 5) + th.CreateUser() + th.CreateUser() + + // Deactivate user + _, appErr := th.App.UpdateActive(th.Context, th.BasicUser, false) + require.Nil(t, appErr) + + // Reactivate user (should succeed - enforcement disabled and below limit) + updatedUser, appErr := th.App.UpdateActive(th.Context, th.BasicUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + + t.Run("reactivation allowed at unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 4 additional users to have 5 total (at limit of 5) + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + + // Create a user and then deactivate them + testUser := th.CreateUser() + _, appErr := th.App.UpdateActive(th.Context, testUser, false) + require.Nil(t, appErr) + + // Reactivate user (should succeed - enforcement disabled) + updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + + t.Run("reactivation allowed above unenforced limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 5 additional users to have 6 total (above limit of 5) + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + th.CreateUser() + + // Create a user and then deactivate them + testUser := th.CreateUser() + _, appErr := th.App.UpdateActive(th.Context, testUser, false) + require.Nil(t, appErr) + + // Reactivate user (should succeed - enforcement disabled) + updatedUser, appErr := th.App.UpdateActive(th.Context, testUser, true) + require.Nil(t, appErr) + require.Equal(t, int64(0), updatedUser.DeleteAt) + }) + }) +} + +func TestCreateUserOrGuestSeatCountEnforcement(t *testing.T) { + mainHelper.Parallel(t) + + t.Run("seat count enforced - allows user creation when under limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // InitBasic creates 3 users, so we're under the limit of 5 + user := &model.User{ + Email: "TestCreateUserOrGuest@example.com", + Username: "username_123", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.Nil(t, appErr) + require.NotNil(t, createdUser) + require.Equal(t, "username_123", createdUser.Username) + }) + + t.Run("seat count enforced - blocks user creation when at limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 3 additional users to reach the grace limit of 6 (3 from InitBasic + 3) + // Grace limit for 5 users is 6 (5% grace period) + th.CreateUser() + th.CreateUser() + th.CreateUser() + + // Now at grace limit - attempting to create another user should fail + user := &model.User{ + Email: "TestSeatCount@example.com", + Username: "seat_test_user", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.NotNil(t, appErr) + require.Nil(t, createdUser) + require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id) + }) + + t.Run("seat count enforced - blocks user creation when over limit", func(t *testing.T) { + // Use mocks for this test since we can't actually create users beyond the safety limit + th := SetupWithStoreMock(t) + defer th.TearDown() + + userLimit := 5 + currentUserCount := int64(6) // Over limit + + mockUserStore := storemocks.UserStore{} + mockUserStore.On("Count", mock.Anything).Return(currentUserCount, nil) + mockUserStore.On("IsEmpty", true).Return(false, nil) + + mockGroupStore := storemocks.GroupStore{} + mockGroupStore.On("GetByName", "seat_test_user", mock.Anything).Return(nil, nil) + + mockStore := th.App.Srv().Store().(*storemocks.Store) + mockStore.On("User").Return(&mockUserStore) + mockStore.On("Group").Return(&mockGroupStore) + + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + user := &model.User{ + Email: "TestSeatCount@example.com", + Username: "seat_test_user", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.NotNil(t, appErr) + require.Nil(t, createdUser) + require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id) + }) + + t.Run("seat count not enforced - allows user creation even when over limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = false + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create additional users to exceed the limit (3 from InitBasic + 3 = 6, over limit of 5) + th.CreateUser() + th.CreateUser() + th.CreateUser() + + // Should still allow creation since enforcement is disabled + user := &model.User{ + Email: "TestSeatCount@example.com", + Username: "seat_test_user", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.Nil(t, appErr) + require.NotNil(t, createdUser) + require.Equal(t, "seat_test_user", createdUser.Username) + }) + + t.Run("no license - uses existing hard limit logic", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + th.App.Srv().SetLicense(nil) + + // Should allow creation under hard limit + user := &model.User{ + Email: "TestSeatCount@example.com", + Username: "seat_test_user", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.Nil(t, appErr) + require.NotNil(t, createdUser) + require.Equal(t, "seat_test_user", createdUser.Username) + }) + + t.Run("license without Users feature - no seat count enforcement", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = nil + th.App.Srv().SetLicense(license) + + // Should allow creation since Users feature is nil + user := &model.User{ + Email: "TestSeatCount@example.com", + Username: "seat_test_user", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) + require.Nil(t, appErr) + require.NotNil(t, createdUser) + require.Equal(t, "seat_test_user", createdUser.Username) + }) + + t.Run("guest creation with seat count enforcement - blocks when at limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // Create 3 additional users to reach the grace limit of 6 (3 from InitBasic + 3) + // Grace limit for 5 users is 6 (5% grace period) + th.CreateUser() + th.CreateUser() + th.CreateUser() + + // Now at grace limit - attempting to create a guest should fail + user := &model.User{ + Email: "TestSeatCountGuest@example.com", + Username: "seat_test_guest", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true) + require.NotNil(t, appErr) + require.Nil(t, createdUser) + require.Equal(t, "api.user.create_user.license_user_limits.exceeded", appErr.Id) + }) + + t.Run("guest creation with seat count enforcement - allows when under limit", func(t *testing.T) { + th := Setup(t).InitBasic() + defer th.TearDown() + + userLimit := 5 + license := model.NewTestLicense("") + license.IsSeatCountEnforced = true + license.Features.Users = &userLimit + th.App.Srv().SetLicense(license) + + // InitBasic creates 3 users, so we're under the limit of 5 + user := &model.User{ + Email: "TestSeatCountGuest@example.com", + Username: "seat_test_guest", + Password: "Password1", + EmailVerified: true, + } + + createdUser, appErr := th.App.createUserOrGuest(th.Context, user, true) + require.Nil(t, appErr) + require.NotNil(t, createdUser) + require.Equal(t, "seat_test_guest", createdUser.Username) + }) +} diff --git a/server/channels/app/user_test.go b/server/channels/app/user_test.go index 9238e1bf73..806d46e6c8 100644 --- a/server/channels/app/user_test.go +++ b/server/channels/app/user_test.go @@ -21,7 +21,6 @@ import ( "github.com/mattermost/mattermost/server/public/model" "github.com/mattermost/mattermost/server/public/shared/request" oauthgitlab "github.com/mattermost/mattermost/server/v8/channels/app/oauthproviders/gitlab" - "github.com/mattermost/mattermost/server/v8/channels/app/users" "github.com/mattermost/mattermost/server/v8/channels/store" storemocks "github.com/mattermost/mattermost/server/v8/channels/store/storetest/mocks" "github.com/mattermost/mattermost/server/v8/channels/utils/testutils" @@ -2292,161 +2291,3 @@ func TestGetUsersForReporting(t *testing.T) { require.NotNil(t, userReports) }) } - -func TestCreateUserOrGuest(t *testing.T) { - mainHelper.Parallel(t) - t.Run("base case - you can create a user", func(t *testing.T) { - th := Setup(t) - defer th.TearDown() - - user := &model.User{ - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - } - createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) - require.Nil(t, appErr) - require.Equal(t, "username_123", createdUser.Username) - }) - - t.Run("cannot create user when user count has exceeded the permissible limit", func(t *testing.T) { - th := SetupWithStoreMock(t) - defer th.TearDown() - - mockUserStore := storemocks.UserStore{} - mockUserStore.On("Count", mock.Anything).Return(int64(12000), nil) - - mockStore := th.App.Srv().Store().(*storemocks.Store) - mockStore.On("User").Return(&mockUserStore) - - user := &model.User{ - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - } - createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) - require.NotNil(t, appErr) - require.Nil(t, createdUser) - }) - - t.Run("can create user when server is exactly on limit", func(t *testing.T) { - th := SetupWithStoreMock(t) - defer th.TearDown() - - id := NewTestId() - userCreationMocks(t, th, id, 5000) - - user := &model.User{ - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - } - createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) - require.Nil(t, appErr) - require.Equal(t, "username_123", createdUser.Username) - }) - - t.Run("licensed server can create user when server is OVER limit", func(t *testing.T) { - th := SetupWithStoreMock(t) - defer th.TearDown() - - id := NewTestId() - userCreationMocks(t, th, id, 20000) - - user := &model.User{ - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - } - - th.App.Srv().SetLicense(model.NewTestLicense("")) - createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) - require.Nil(t, appErr) - require.Equal(t, "username_123", createdUser.Username) - }) - - t.Run("licensed server can create user when server is UNDER limit", func(t *testing.T) { - th := SetupWithStoreMock(t) - defer th.TearDown() - - id := NewTestId() - userCreationMocks(t, th, id, 10) - - user := &model.User{ - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - } - - th.App.Srv().SetLicense(model.NewTestLicense("")) - createdUser, appErr := th.App.createUserOrGuest(th.Context, user, false) - require.Nil(t, appErr) - require.Equal(t, "username_123", createdUser.Username) - }) -} - -func userCreationMocks(t *testing.T, th *TestHelper, userID string, activeUserCount int64) { - mockUserStore := storemocks.UserStore{} - mockUserStore.On("Count", mock.Anything).Return(activeUserCount, nil) - mockUserStore.On("IsEmpty", mock.Anything).Return(false, nil) - mockUserStore.On("VerifyEmail", mock.Anything, "TestCreateUserOrGuest@example.com").Return("", nil) - mockUserStore.On("InvalidateProfilesInChannelCacheByUser", mock.Anything).Return() - mockUserStore.On("InvalidateProfileCacheForUser", mock.Anything).Return() - mockUserStore.On("Save", mock.Anything, mock.Anything).Return(&model.User{ - Id: userID, - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - }, nil) - - mockUserStore.On("Get", mock.Anything, userID).Return(&model.User{ - Id: userID, - Email: "TestCreateUserOrGuest@example.com", - Username: "username_123", - Nickname: "nn_username_123", - Password: "Password1", - EmailVerified: true, - }, nil) - - mockGroupStore := storemocks.GroupStore{} - mockGroupStore.On("GetByName", "username_123", mock.Anything).Return(nil, nil) - - mockChannelStore := storemocks.ChannelStore{} - mockChannelStore.On("InvalidateAllChannelMembersForUser", mock.Anything).Return() - - mockPreferencesStore := storemocks.PreferenceStore{} - mockPreferencesStore.On("Save", mock.Anything).Return(nil) - - mockProductNoticeStore := storemocks.ProductNoticesStore{} - mockProductNoticeStore.On("View", userID, mock.Anything).Return(nil) - - mockStore := th.App.Srv().Store().(*storemocks.Store) - mockStore.On("User").Return(&mockUserStore) - mockStore.On("Group").Return(&mockGroupStore) - mockStore.On("Channel").Return(&mockChannelStore) - mockStore.On("Preference").Return(&mockPreferencesStore) - mockStore.On("ProductNotices").Return(&mockProductNoticeStore) - - var err error - th.App.ch.srv.userService, err = users.New(users.ServiceConfig{ - UserStore: &mockUserStore, - SessionStore: &storemocks.SessionStore{}, - OAuthStore: &storemocks.OAuthStore{}, - ConfigFn: th.App.ch.srv.platform.Config, - LicenseFn: th.App.ch.srv.License, - }) - - require.NoError(t, err) -} diff --git a/server/i18n/en.json b/server/i18n/en.json index 6a7fe0b787..f2343e4929 100644 --- a/server/i18n/en.json +++ b/server/i18n/en.json @@ -4042,6 +4042,10 @@ "id": "api.user.create_user.invalid_invitation_type.app_error", "translation": "Unable to create the user, invalid invitation." }, + { + "id": "api.user.create_user.license_user_limits.exceeded", + "translation": "Can't create user. Server exceeds maximum licensed users. Contact your administrator with: ERROR_LICENSED_USERS_LIMIT_EXCEEDED." + }, { "id": "api.user.create_user.no_open_server", "translation": "This server does not allow open signups. Please speak with your Administrator to receive an invitation." @@ -7540,9 +7544,13 @@ "id": "app.user.update.lastAdmin.app_error", "translation": "Cannot demote last System Admin." }, + { + "id": "app.user.update_active.license_user_limit.exceeded", + "translation": "Can't activate user. Server exceeds maximum licensed users. ERROR_LICENSED_USERS_LIMIT_EXCEEDED." + }, { "id": "app.user.update_active.user_limit.exceeded", - "translation": "Can't activate user. Server exceeds safe user limit. Contact your administrator with: ERROR_SAFETY_LIMITS_EXCEEDED." + "translation": "Can't activate user. Server exceeds safe user limit. ERROR_SAFETY_LIMITS_EXCEEDED." }, { "id": "app.user.update_active_for_multiple_users.updating.app_error", diff --git a/server/public/model/license.go b/server/public/model/license.go index 2d88c10385..52fa3294b3 100644 --- a/server/public/model/license.go +++ b/server/public/model/license.go @@ -57,17 +57,18 @@ type LicenseRecord struct { } type License struct { - Id string `json:"id"` - IssuedAt int64 `json:"issued_at"` - StartsAt int64 `json:"starts_at"` - ExpiresAt int64 `json:"expires_at"` - Customer *Customer `json:"customer"` - Features *Features `json:"features"` - SkuName string `json:"sku_name"` - SkuShortName string `json:"sku_short_name"` - IsTrial bool `json:"is_trial"` - IsGovSku bool `json:"is_gov_sku"` - SignupJWT *string `json:"signup_jwt"` + Id string `json:"id"` + IssuedAt int64 `json:"issued_at"` + StartsAt int64 `json:"starts_at"` + ExpiresAt int64 `json:"expires_at"` + Customer *Customer `json:"customer"` + Features *Features `json:"features"` + SkuName string `json:"sku_name"` + SkuShortName string `json:"sku_short_name"` + IsTrial bool `json:"is_trial"` + IsGovSku bool `json:"is_gov_sku"` + IsSeatCountEnforced bool `json:"is_seat_count_enforced"` + SignupJWT *string `json:"signup_jwt"` } type Customer struct { diff --git a/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx b/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx index 295acf2558..8d927db586 100644 --- a/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx +++ b/webapp/channels/src/components/admin_console/system_user_detail/system_user_detail.tsx @@ -147,7 +147,9 @@ export class SystemUserDetail extends PureComponent { } catch (err) { console.error('SystemUserDetails-handleActivateUser', err); // eslint-disable-line no-console - this.setState({error: this.props.intl.formatMessage({id: 'admin.user_item.userActivateFailed', defaultMessage: 'Failed to activate user'})}); + // Show the actual server error message instead of generic message + const errorMessage = (err as Error).message || this.props.intl.formatMessage({id: 'admin.user_item.userActivateFailed', defaultMessage: 'Failed to activate user'}); + this.setState({error: errorMessage}); } }; @@ -166,7 +168,9 @@ export class SystemUserDetail extends PureComponent { } catch (err) { console.error('SystemUserDetails-handleDeactivateMember', err); // eslint-disable-line no-console - this.setState({error: this.props.intl.formatMessage({id: 'admin.user_item.userDeactivateFailed', defaultMessage: 'Failed to deactivate user'})}); + // Show the actual server error message instead of generic message + const errorMessage = (err as Error).message || this.props.intl.formatMessage({id: 'admin.user_item.userDeactivateFailed', defaultMessage: 'Failed to deactivate user'}); + this.setState({error: errorMessage}); } this.toggleCloseModalDeactivateMember();