[MM-24863] Migrate update/patch/search/delete team endpoints for local mode (#14581)

* [MM-24146] Add unix socket listener for mmctl local mode (#14296)

* add unix socket listener for mmctl local mode

* add a constant for local-mode socket path

* reflect review comments

* [MM-24401] Base approach for Local Mode (#14333)

* add unix socket listener for mmctl local mode

* First working PoC

* Adds the channel list endpoint

* Add team list endpoint

* Add a LocalClient to the api test helper and start local mode

* Add helper to test with both SystemAdmin and Local clients

* Add some docs

* Adds TestForAllClients test helper

* Incorporating @ashishbhate's proposal for adding test names to the helpers

* Fix init errors after merge

* Adds create channel tests

* Always init local mode to allow for enabling-disabling it via config

* Check the RemoteAddr of the request before marking session as local

* Mark the request as errored if it's local and the origin is remote

* Set the socket permissions to read/write when initialising

* Fix linter

* Replace RemoteAddr check to ditch connections with the IP:PORT shape

Co-authored-by: Ibrahim Serdar Acikgoz <serdaracikgoz86@gmail.com>

* Fix translations order

* [MM-24832] Migrate plugin endpoints to local mode (#14543)

* [MM-24832] Migrate plugin endpoints to local mode

* Fix client reference in helper

* api4/team: add local endpoints

* [MM-24776] Migrate config endpoints to local mode (#14544)

* [MM-24776] Migrate get config endpoint to local mode

* [MM-24777] Migrate update config endpoint to local mode

* Fix update config to bypass RestrictSystemAdmin flag

* Add patchConfig endpoint

* MM-24774/MM-24755: local mode for addLicense and removeLicense (#14491)

Automatic Merge

* api4/team: reflect review comments

* api4/team: add to permissions

* fix post conflict issues

* fix formatting

Co-authored-by: Miguel de la Cruz <miguel@mcrx.me>
Co-authored-by: Ashish Bhate <bhate.ashish@gmail.com>
Этот коммит содержится в:
Ibrahim Serdar Acikgoz
2020-06-03 14:14:21 +03:00
коммит произвёл GitHub
родитель 0965e8485a
Коммит 19e5afd607
5 изменённых файлов: 270 добавлений и 210 удалений

Просмотреть файл

@@ -304,10 +304,10 @@ func InitLocal(configservice configservice.ConfigService, globalOptionsFunc app.
api.InitUserLocal()
api.InitTeamLocal()
api.InitChannelLocal()
api.InitLicenseLocal()
api.InitConfigLocal()
api.InitCommandLocal()
api.InitPluginLocal()
api.InitCommandLocal()
api.InitLicenseLocal()
api.InitGroupLocal()
root.Handle("/api/v4/{anything:.*}", http.HandlerFunc(api.Handle404))

Просмотреть файл

@@ -15,9 +15,9 @@ func (api *API) InitChannelLocal() {
api.BaseRoutes.Channels.Handle("", api.ApiLocal(localCreateChannel)).Methods("POST")
api.BaseRoutes.Channel.Handle("", api.ApiLocal(deleteChannel)).Methods("DELETE")
api.BaseRoutes.ChannelMembers.Handle("", api.ApiLocal(localAddChannelMember)).Methods("POST")
api.BaseRoutes.ChannelMember.Handle("", api.ApiLocal(localRemoveChannelMember)).Methods("DELETE")
api.BaseRoutes.ChannelMember.Handle("", api.ApiLocal(getChannelMember)).Methods("GET")
api.BaseRoutes.ChannelMembers.Handle("", api.ApiLocal(localAddChannelMember)).Methods("POST")
api.BaseRoutes.ChannelMembers.Handle("", api.ApiLocal(getChannelMembers)).Methods("GET")
api.BaseRoutes.ChannelsForTeam.Handle("", api.ApiLocal(getPublicChannelsForTeam)).Methods("GET")

Просмотреть файл

@@ -3,8 +3,49 @@
package api4
import (
"net/http"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
func (api *API) InitTeamLocal() {
api.BaseRoutes.Teams.Handle("", api.ApiLocal(localCreateTeam)).Methods("POST")
api.BaseRoutes.Teams.Handle("", api.ApiLocal(getAllTeams)).Methods("GET")
api.BaseRoutes.Teams.Handle("/search", api.ApiLocal(searchTeams)).Methods("POST")
api.BaseRoutes.Team.Handle("", api.ApiLocal(getTeam)).Methods("GET")
api.BaseRoutes.Team.Handle("", api.ApiLocal(updateTeam)).Methods("PUT")
api.BaseRoutes.Team.Handle("", api.ApiLocal(deleteTeam)).Methods("DELETE")
api.BaseRoutes.Team.Handle("/patch", api.ApiLocal(patchTeam)).Methods("PUT")
api.BaseRoutes.TeamByName.Handle("", api.ApiLocal(getTeamByName)).Methods("GET")
api.BaseRoutes.TeamMembers.Handle("", api.ApiLocal(addTeamMember)).Methods("POST")
api.BaseRoutes.TeamMember.Handle("", api.ApiLocal(removeTeamMember)).Methods("DELETE")
}
func localCreateTeam(c *Context, w http.ResponseWriter, r *http.Request) {
team := model.TeamFromJson(r.Body)
if team == nil {
c.SetInvalidParam("team")
return
}
team.Email = strings.ToLower(team.Email)
auditRec := c.MakeAuditRecord("localCreateTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team", team)
rteam, err := c.App.CreateTeam(team)
if err != nil {
c.Err = err
return
}
// Don't sanitize the team here since the user will be a team admin and their session won't reflect that yet
auditRec.Success()
auditRec.AddMeta("team", team) // overwrite meta
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rteam.ToJson()))
}

Просмотреть файл

@@ -255,26 +255,28 @@ func TestGetTeamUnread(t *testing.T) {
func TestUpdateTeam(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
Client := th.Client
th.TestForAllClients(t, func(t *testing.T, client *model.Client4) {
team := &model.Team{DisplayName: "Name", Description: "Some description", AllowOpenInvite: false, InviteId: "inviteid0", Name: "z-z-" + model.NewRandomTeamName() + "a", Email: "success+" + model.NewId() + "@simulator.amazonses.com", Type: model.TEAM_OPEN}
team, _ = Client.CreateTeam(team)
var resp *model.Response
team, resp = th.Client.CreateTeam(team)
CheckNoError(t, resp)
team.Description = "updated description"
uteam, resp := Client.UpdateTeam(team)
uteam, resp := client.UpdateTeam(team)
CheckNoError(t, resp)
require.Equal(t, uteam.Description, "updated description", "Update failed")
team.DisplayName = "Updated Name"
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.Equal(t, uteam.DisplayName, "Updated Name", "Update failed")
// Test GroupConstrained flag
team.GroupConstrained = model.NewBool(true)
rteam, resp := Client.UpdateTeam(team)
rteam, resp := client.UpdateTeam(team)
CheckNoError(t, resp)
CheckOKStatus(t, resp)
@@ -283,37 +285,37 @@ func TestUpdateTeam(t *testing.T) {
team.GroupConstrained = nil
team.AllowOpenInvite = true
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.True(t, uteam.AllowOpenInvite, "Update failed")
team.InviteId = "inviteid1"
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.NotEqual(t, uteam.InviteId, "inviteid1", "InviteID should not be updated")
team.AllowedDomains = "domain"
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.Equal(t, uteam.AllowedDomains, "domain", "Update failed")
team.Name = "Updated name"
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.NotEqual(t, uteam.Name, "Updated name", "Should not update name")
team.Email = "test@domain.com"
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.NotEqual(t, uteam.Email, "test@domain.com", "Should not update email")
team.Type = model.TEAM_INVITE
uteam, resp = Client.UpdateTeam(team)
uteam, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
require.NotEqual(t, uteam.Type, model.TEAM_INVITE, "Should not update type")
@@ -321,22 +323,31 @@ func TestUpdateTeam(t *testing.T) {
originalTeamId := team.Id
team.Id = model.NewId()
r, _ := Client.DoApiPut(Client.GetTeamRoute(originalTeamId), team.ToJson())
r, _ := client.DoApiPut(client.GetTeamRoute(originalTeamId), team.ToJson())
assert.Equal(t, http.StatusBadRequest, r.StatusCode)
require.Equal(t, uteam.Id, originalTeamId, "wrong team id")
team.Id = "fake"
_, resp = Client.UpdateTeam(team)
_, resp = client.UpdateTeam(team)
CheckBadRequestStatus(t, resp)
Client.Logout()
_, resp = Client.UpdateTeam(team)
th.Client.Logout() // for non-local clients
_, resp = th.Client.UpdateTeam(team)
CheckUnauthorizedStatus(t, resp)
th.LoginBasic()
})
team.Id = originalTeamId
_, resp = th.SystemAdminClient.UpdateTeam(team)
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
team := &model.Team{DisplayName: "New", Description: "Some description", AllowOpenInvite: false, InviteId: "inviteid0", Name: "z-z-" + model.NewRandomTeamName() + "a", Email: "success+" + model.NewId() + "@simulator.amazonses.com", Type: model.TEAM_OPEN}
var resp *model.Response
team, resp = client.CreateTeam(team)
CheckNoError(t, resp)
team.Name = "new-name"
_, resp = client.UpdateTeam(team)
CheckNoError(t, resp)
})
}
func TestUpdateTeamSanitization(t *testing.T) {
@@ -374,19 +385,30 @@ func TestUpdateTeamSanitization(t *testing.T) {
func TestPatchTeam(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
Client := th.Client
team := &model.Team{DisplayName: "Name", Description: "Some description", CompanyName: "Some company name", AllowOpenInvite: false, InviteId: "inviteid0", Name: "z-z-" + model.NewRandomTeamName() + "a", Email: "success+" + model.NewId() + "@simulator.amazonses.com", Type: model.TEAM_OPEN}
team, _ = Client.CreateTeam(team)
team, _ = th.Client.CreateTeam(team)
patch := &model.TeamPatch{}
patch.DisplayName = model.NewString("Other name")
patch.Description = model.NewString("Other description")
patch.CompanyName = model.NewString("Other company name")
patch.AllowOpenInvite = model.NewBool(true)
rteam, resp := Client.PatchTeam(team.Id, patch)
_, resp := th.Client.PatchTeam(GenerateTestId(), patch)
CheckForbiddenStatus(t, resp)
th.Client.Logout()
_, resp = th.Client.PatchTeam(team.Id, patch)
CheckUnauthorizedStatus(t, resp)
th.LoginBasic2()
_, resp = th.Client.PatchTeam(team.Id, patch)
CheckForbiddenStatus(t, resp)
th.LoginBasic()
th.TestForAllClients(t, func(t *testing.T, client *model.Client4) {
rteam, resp := client.PatchTeam(team.Id, patch)
CheckNoError(t, resp)
require.Equal(t, rteam.DisplayName, "Other name", "DisplayName did not update properly")
@@ -397,13 +419,13 @@ func TestPatchTeam(t *testing.T) {
t.Run("Changing AllowOpenInvite to false regenerates InviteID", func(t *testing.T) {
team2 := &model.Team{DisplayName: "Name2", Description: "Some description", CompanyName: "Some company name", AllowOpenInvite: true, InviteId: model.NewId(), Name: "z-z-" + model.NewRandomTeamName() + "a", Email: "success+" + model.NewId() + "@simulator.amazonses.com", Type: model.TEAM_OPEN}
team2, _ = Client.CreateTeam(team2)
team2, _ = client.CreateTeam(team2)
patch2 := &model.TeamPatch{
AllowOpenInvite: model.NewBool(false),
}
rteam2, resp2 := Client.PatchTeam(team2.Id, patch2)
rteam2, resp2 := client.PatchTeam(team2.Id, patch2)
CheckNoError(t, resp2)
require.Equal(t, team2.Id, rteam2.Id)
require.False(t, rteam2.AllowOpenInvite)
@@ -412,13 +434,13 @@ func TestPatchTeam(t *testing.T) {
t.Run("Changing AllowOpenInvite to true doesn't regenerate InviteID", func(t *testing.T) {
team2 := &model.Team{DisplayName: "Name3", Description: "Some description", CompanyName: "Some company name", AllowOpenInvite: false, InviteId: model.NewId(), Name: "z-z-" + model.NewRandomTeamName() + "a", Email: "success+" + model.NewId() + "@simulator.amazonses.com", Type: model.TEAM_OPEN}
team2, _ = Client.CreateTeam(team2)
team2, _ = client.CreateTeam(team2)
patch2 := &model.TeamPatch{
AllowOpenInvite: model.NewBool(true),
}
rteam2, resp2 := Client.PatchTeam(team2.Id, patch2)
rteam2, resp2 := client.PatchTeam(team2.Id, patch2)
CheckNoError(t, resp2)
require.Equal(t, team2.Id, rteam2.Id)
require.True(t, rteam2.AllowOpenInvite)
@@ -427,34 +449,24 @@ func TestPatchTeam(t *testing.T) {
// Test GroupConstrained flag
patch.GroupConstrained = model.NewBool(true)
rteam, resp = Client.PatchTeam(team.Id, patch)
rteam, resp = client.PatchTeam(team.Id, patch)
CheckNoError(t, resp)
CheckOKStatus(t, resp)
require.Equal(t, *rteam.GroupConstrained, *patch.GroupConstrained, "GroupConstrained flags do not match")
patch.GroupConstrained = nil
_, resp = Client.PatchTeam("junk", patch)
patch.GroupConstrained = nil
_, resp = client.PatchTeam("junk", patch)
CheckBadRequestStatus(t, resp)
_, resp = Client.PatchTeam(GenerateTestId(), patch)
CheckForbiddenStatus(t, resp)
r, err := Client.DoApiPut("/teams/"+team.Id+"/patch", "garbage")
r, err := client.DoApiPut("/teams/"+team.Id+"/patch", "garbage")
require.NotNil(t, err, "should have errored")
require.Equalf(t, r.StatusCode, http.StatusBadRequest, "wrong status code, actual: %s, expected: %s", strconv.Itoa(r.StatusCode), strconv.Itoa(http.StatusBadRequest))
})
Client.Logout()
_, resp = Client.PatchTeam(team.Id, patch)
CheckUnauthorizedStatus(t, resp)
th.LoginBasic2()
_, resp = Client.PatchTeam(team.Id, patch)
CheckForbiddenStatus(t, resp)
_, resp = th.SystemAdminClient.PatchTeam(team.Id, patch)
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
_, resp := client.PatchTeam(th.BasicTeam.Id, patch)
CheckNoError(t, resp)
})
}
func TestRestoreTeam(t *testing.T) {
@@ -723,12 +735,20 @@ func TestRegenerateTeamInviteId(t *testing.T) {
func TestSoftDeleteTeam(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
Client := th.Client
_, resp := th.Client.SoftDeleteTeam(th.BasicTeam.Id)
CheckForbiddenStatus(t, resp)
th.Client.Logout()
_, resp = th.Client.SoftDeleteTeam(th.BasicTeam.Id)
CheckUnauthorizedStatus(t, resp)
th.LoginBasic()
team := &model.Team{DisplayName: "DisplayName", Name: GenerateTestTeamName(), Email: th.GenerateTestEmail(), Type: model.TEAM_OPEN}
team, _ = Client.CreateTeam(team)
team, _ = th.Client.CreateTeam(team)
ok, resp := Client.SoftDeleteTeam(team.Id)
th.TestForAllClients(t, func(t *testing.T, client *model.Client4) {
ok, resp := client.SoftDeleteTeam(team.Id)
CheckNoError(t, resp)
require.True(t, ok, "should have returned true")
@@ -737,30 +757,25 @@ func TestSoftDeleteTeam(t *testing.T) {
require.Nil(t, err, "should have returned archived team")
require.NotEqual(t, rteam.DeleteAt, 0, "should have not set to zero")
ok, resp = Client.SoftDeleteTeam("junk")
ok, resp = client.SoftDeleteTeam("junk")
CheckBadRequestStatus(t, resp)
require.False(t, ok, "should have returned false")
})
otherTeam := th.BasicTeam
_, resp = Client.SoftDeleteTeam(otherTeam.Id)
CheckForbiddenStatus(t, resp)
Client.Logout()
_, resp = Client.SoftDeleteTeam(otherTeam.Id)
CheckUnauthorizedStatus(t, resp)
_, resp = th.SystemAdminClient.SoftDeleteTeam(otherTeam.Id)
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
_, resp := client.SoftDeleteTeam(th.BasicTeam.Id)
CheckNoError(t, resp)
})
}
func TestPermanentDeleteTeam(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
Client := th.Client
th.TestForAllClients(t, func(t *testing.T, client *model.Client4) {
team := &model.Team{DisplayName: "DisplayName", Name: GenerateTestTeamName(), Email: th.GenerateTestEmail(), Type: model.TEAM_OPEN}
team, _ = Client.CreateTeam(team)
team, _ = client.CreateTeam(team)
enableAPITeamDeletion := *th.App.Config().ServiceSettings.EnableAPITeamDeletion
defer func() {
@@ -770,7 +785,7 @@ func TestPermanentDeleteTeam(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPITeamDeletion = false })
// Does not error when deletion is disabled, just soft deletes
ok, resp := Client.PermanentDeleteTeam(team.Id)
ok, resp := client.PermanentDeleteTeam(team.Id)
CheckNoError(t, resp)
assert.True(t, ok)
@@ -780,17 +795,23 @@ func TestPermanentDeleteTeam(t *testing.T) {
th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPITeamDeletion = true })
ok, resp = Client.PermanentDeleteTeam(team.Id)
ok, resp = client.PermanentDeleteTeam(team.Id)
CheckNoError(t, resp)
assert.True(t, ok)
_, err = th.App.GetTeam(team.Id)
assert.NotNil(t, err)
ok, resp = Client.PermanentDeleteTeam("junk")
ok, resp = client.PermanentDeleteTeam("junk")
CheckBadRequestStatus(t, resp)
require.False(t, ok, "should have returned false")
})
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
_, resp := client.PermanentDeleteTeam(th.BasicTeam.Id)
CheckNoError(t, resp)
})
}
func TestGetAllTeams(t *testing.T) {
@@ -1125,7 +1146,7 @@ func TestGetTeamByNameSanitization(t *testing.T) {
func TestSearchAllTeams(t *testing.T) {
th := Setup(t).InitBasic()
defer th.TearDown()
Client := th.Client
oTeam := th.BasicTeam
oTeam.AllowOpenInvite = true
@@ -1134,54 +1155,51 @@ func TestSearchAllTeams(t *testing.T) {
oTeam.UpdateAt = updatedTeam.UpdateAt
pTeam := &model.Team{DisplayName: "PName", Name: GenerateTestTeamName(), Email: th.GenerateTestEmail(), Type: model.TEAM_INVITE}
Client.CreateTeam(pTeam)
th.Client.CreateTeam(pTeam)
rteams, resp := Client.SearchTeams(&model.TeamSearch{Term: oTeam.Name})
rteams, resp := th.Client.SearchTeams(&model.TeamSearch{Term: pTeam.Name})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
require.Equal(t, oTeam.Id, rteams[0].Id, "invalid team")
rteams, resp = Client.SearchTeams(&model.TeamSearch{Term: oTeam.DisplayName})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
require.Equal(t, oTeam.Id, rteams[0].Id, "invalid team")
rteams, resp = Client.SearchTeams(&model.TeamSearch{Term: pTeam.Name})
CheckNoError(t, resp)
require.Empty(t, rteams, "should have not returned team")
rteams, resp = Client.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
rteams, resp = th.Client.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
CheckNoError(t, resp)
require.Empty(t, rteams, "should have not returned team")
rteams, resp = th.SystemAdminClient.SearchTeams(&model.TeamSearch{Term: oTeam.Name})
CheckNoError(t, resp)
th.Client.Logout()
require.Len(t, rteams, 1, "should have returned 1 team")
rteams, resp = th.SystemAdminClient.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
rteams, resp = Client.SearchTeams(&model.TeamSearch{Term: "junk"})
CheckNoError(t, resp)
require.Empty(t, rteams, "should have not returned team")
Client.Logout()
_, resp = Client.SearchTeams(&model.TeamSearch{Term: pTeam.Name})
_, resp = th.Client.SearchTeams(&model.TeamSearch{Term: pTeam.Name})
CheckUnauthorizedStatus(t, resp)
_, resp = Client.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
_, resp = th.Client.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
CheckUnauthorizedStatus(t, resp)
th.LoginBasic()
th.TestForAllClients(t, func(t *testing.T, client *model.Client4) {
rteams, resp := client.SearchTeams(&model.TeamSearch{Term: oTeam.Name})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
require.Equal(t, oTeam.Id, rteams[0].Id, "invalid team")
rteams, resp = client.SearchTeams(&model.TeamSearch{Term: oTeam.DisplayName})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
require.Equal(t, oTeam.Id, rteams[0].Id, "invalid team")
rteams, resp = client.SearchTeams(&model.TeamSearch{Term: "junk"})
CheckNoError(t, resp)
require.Empty(t, rteams, "should have not returned team")
})
th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) {
rteams, resp := client.SearchTeams(&model.TeamSearch{Term: oTeam.Name})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
rteams, resp = client.SearchTeams(&model.TeamSearch{Term: pTeam.DisplayName})
CheckNoError(t, resp)
require.Len(t, rteams, 1, "should have returned 1 team")
})
}
func TestSearchAllTeamsPaged(t *testing.T) {

Просмотреть файл

@@ -29,6 +29,7 @@ func (a *App) SessionHasPermissionToTeam(session model.Session, teamId string, p
if session.IsUnrestricted() {
return true
}
teamMember := session.GetTeamByTeamId(teamId)
if teamMember != nil {
if a.RolesGrantPermission(teamMember.GetRoles(), permission.Id) {