Adds a groupID filter to the property service methods (#30420)

* Adds a groupID filter to the property service methods

This allows the property service caller to directly ensure that a
given call is only going to affect a field or value that belongs to a
given group, instead of (for example) retrieving a property value
before deleting it by id to ensure that the value belongs to a
specific property group. The groupID filter is optional and has no
effect if called with the empty string value.

The changes also remove references to input sanitization on trimming
the whitespace for the CPA field names and validate at the API level
the input for the field patch endpoint.

* Fix linter

---------

Co-authored-by: Miguel de la Cruz <miguel@ctrlz.es>
Co-authored-by: Mattermost Build <build@mattermost.com>

server/public/model/property_field.go

@@ -8,7 +8,6 @@ import (
 	"errors"
 	"fmt"
 	"net/http"
-	"strings"
 )
 
 type PropertyFieldType string
@@ -94,10 +93,6 @@ func (pf *PropertyField) IsValid() error {
 	return nil
 }
 
-func (pf *PropertyField) SanitizeInput() {
-	pf.Name = strings.TrimSpace(pf.Name)
-}
-
 type PropertyFieldPatch struct {
 	Name       *string            `json:"name"`
 	Type       *PropertyFieldType `json:"type"`
@@ -116,10 +111,22 @@ func (pfp *PropertyFieldPatch) Auditable() map[string]any {
 	}
 }
 
-func (pfp *PropertyFieldPatch) SanitizeInput() {
-	if pfp.Name != nil {
-		pfp.Name = NewPointer(strings.TrimSpace(*pfp.Name))
+func (pfp *PropertyFieldPatch) IsValid() error {
+	if pfp.Name != nil && *pfp.Name == "" {
+		return NewAppError("PropertyFieldPatch.IsValid", "model.property_field.is_valid.app_error", map[string]any{"FieldName": "name", "Reason": "value cannot be empty"}, "", http.StatusBadRequest)
 	}
+
+	if pfp.Type != nil &&
+		*pfp.Type != PropertyFieldTypeText &&
+		*pfp.Type != PropertyFieldTypeSelect &&
+		*pfp.Type != PropertyFieldTypeMultiselect &&
+		*pfp.Type != PropertyFieldTypeDate &&
+		*pfp.Type != PropertyFieldTypeUser &&
+		*pfp.Type != PropertyFieldTypeMultiuser {
+		return NewAppError("PropertyFieldPatch.IsValid", "model.property_field.is_valid.app_error", map[string]any{"FieldName": "type", "Reason": "unknown value"}, "", http.StatusBadRequest)
+	}
+
+	return nil
 }
 
 func (pf *PropertyField) Patch(patch *PropertyFieldPatch) {

server/public/model/property_field_test.go

@@ -123,11 +123,38 @@ func TestPropertyField_IsValid(t *testing.T) {
 	})
 }
 
-func TestPropertyField_SanitizeInput(t *testing.T) {
-	t.Run("trims spaces from name", func(t *testing.T) {
-		pf := &PropertyField{Name: "  test field  "}
-		pf.SanitizeInput()
-		assert.Equal(t, "test field", pf.Name)
+func TestPropertyFieldPatch_IsValid(t *testing.T) {
+	t.Run("valid patch", func(t *testing.T) {
+		patch := &PropertyFieldPatch{
+			Name: NewPointer("test field"),
+			Type: NewPointer(PropertyFieldTypeText),
+		}
+		require.NoError(t, patch.IsValid())
+	})
+
+	t.Run("empty name", func(t *testing.T) {
+		patch := &PropertyFieldPatch{
+			Name: NewPointer(""),
+			Type: NewPointer(PropertyFieldTypeText),
+		}
+		require.Error(t, patch.IsValid())
+	})
+
+	t.Run("invalid type", func(t *testing.T) {
+		invalidType := PropertyFieldType("invalid")
+		patch := &PropertyFieldPatch{
+			Name: NewPointer("test field"),
+			Type: &invalidType,
+		}
+		require.Error(t, patch.IsValid())
+	})
+
+	t.Run("nil values are valid", func(t *testing.T) {
+		patch := &PropertyFieldPatch{
+			Name: nil,
+			Type: nil,
+		}
+		require.NoError(t, patch.IsValid())
 	})
 }