MM-19250 - new endpoint to retrieve command by id (#13598)

* MM-19250 add endpoint to retrieve command by id

* endpoint
* client
* unit tests

* MM-19250 update comment; remove redundant unit test

* MM-19250 rename GetCommand to GetCommandById

* MM-19250 don't filter on autocomplete flag

* MM-19250: require team_id when using GetCommandById

* team_id added to endpoint query string for GET
* unit test to check for mismatch teamid param and command teamid

* Revert "MM-19250: require team_id when using GetCommandById"

This reverts commit ed78e2796426f75bc23d0f16064be95fa37305fd.

* MM-19250 don't leak existence of id when user doesn't have perms

* return 404 not_found when id not found
* return 404 not_found when id exists but user missing perms to view team
* return 404 not_found when id exists but user missing perms to manage commands

* MM-19250 fix typos in comments

Co-authored-by: mattermod <mattermod@users.noreply.github.com>

api4/command_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -348,6 +349,65 @@ func TestListAutocompleteCommands(t *testing.T) {
 	})
 }
 
+func TestGetCommand(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	Client := th.Client
+
+	enableCommands := *th.App.Config().ServiceSettings.EnableCommands
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableCommands = &enableCommands })
+	}()
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableCommands = true })
+
+	newCmd := &model.Command{
+		CreatorId: th.BasicUser.Id,
+		TeamId:    th.BasicTeam.Id,
+		URL:       "http://nowhere.com",
+		Method:    model.COMMAND_METHOD_POST,
+		Trigger:   "roger"}
+
+	newCmd, resp := th.SystemAdminClient.CreateCommand(newCmd)
+	CheckNoError(t, resp)
+
+	t.Run("ValidId", func(t *testing.T) {
+		cmd, resp := th.SystemAdminClient.GetCommandById(newCmd.Id)
+		CheckNoError(t, resp)
+
+		require.Equal(t, newCmd.Id, cmd.Id)
+		require.Equal(t, newCmd.CreatorId, cmd.CreatorId)
+		require.Equal(t, newCmd.TeamId, cmd.TeamId)
+		require.Equal(t, newCmd.URL, cmd.URL)
+		require.Equal(t, newCmd.Method, cmd.Method)
+		require.Equal(t, newCmd.Trigger, cmd.Trigger)
+	})
+
+	t.Run("InvalidId", func(t *testing.T) {
+		_, resp := th.SystemAdminClient.GetCommandById(strings.Repeat("z", len(newCmd.Id)))
+		require.Error(t, resp.Error)
+	})
+
+	t.Run("UserWithNoPermissionForCustomCommands", func(t *testing.T) {
+		_, resp := Client.GetCommandById(newCmd.Id)
+		CheckNotFoundStatus(t, resp)
+	})
+
+	t.Run("NoMember", func(t *testing.T) {
+		Client.Logout()
+		user := th.CreateUser()
+		th.SystemAdminClient.RemoveTeamMember(th.BasicTeam.Id, user.Id)
+		Client.Login(user.Email, user.Password)
+		_, resp := Client.GetCommandById(newCmd.Id)
+		CheckNotFoundStatus(t, resp)
+	})
+
+	t.Run("NotLoggedIn", func(t *testing.T) {
+		Client.Logout()
+		_, resp := Client.GetCommandById(newCmd.Id)
+		CheckUnauthorizedStatus(t, resp)
+	})
+}
+
 func TestRegenToken(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()