MM-10516: Added support for PostActions in ephemeral posts (#10258)

* Added support for PostActions in ephemeral posts

The general approach is that we take all the metadata that DoPostAction
needs to process client DoPostActionRequests, and store it in a
serialized, encrypted Cookie field, in the PostAction struct.

The client then must send it back, and it is then used to process
PostActions as a fallback top the metadata in the database.

This PR adds a new config setting, `ServiceSettings.ActionCookieSecret`.
In a cluster environment it must be the same for all instances.

- Added type PostActionCookie, and a Cookie string to PostAction.
- Added App.AddActionCookiesToPost.
- Use App.AddActionCookiesToPost in api4.createEphemeralPost,
  App.SendEphemeralPost, App.UpdateEphemeralPost.
- Added App.DoPostActionWithCookie to process incoming requests with
  cookies. For backward compatibility, it prefers the metadata in the
  database; falls back to cookie.
- Added plugin.API.UpdateEphemeralPost and plugin.API.DeleteEphemeralPost.
- Added App.encryptActionCookie/App.decryptActionCookie.

* Style

* Fixed an unfortunate typo, tested with matterpoll

* minor PR feedback

* Fixed uninitialized Context

* Fixed another test failure

* Fixed permission check

* Added api test for DoPostActionWithCookie

* Replaced config.ActionCookieSecret with Server.PostActionCookieSecret

Modeled after AsymetricSigningKey

* style

* Set DeleteAt in DeleteEphemeralPost

* PR feedback

* Removed deadwood comment

* Added EXPERIMENTAL comment to the 2 APIs in question

api4/integration_action.go

@@ -23,26 +23,46 @@ func doPostAction(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if !c.App.SessionHasPermissionToChannelByPost(c.App.Session, c.Params.PostId, model.PERMISSION_READ_CHANNEL) {
-		c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
-		return
-	}
-
 	actionRequest := model.DoPostActionRequestFromJson(r.Body)
 	if actionRequest == nil {
 		actionRequest = &model.DoPostActionRequest{}
 	}
 
-	var err *model.AppError
+	var cookie *model.PostActionCookie
+	if actionRequest.Cookie != "" {
+		cookie = &model.PostActionCookie{}
+		cookieStr, err := model.DecryptPostActionCookie(actionRequest.Cookie, c.App.PostActionCookieSecret())
+		if err != nil {
+			c.Err = model.NewAppError("DoPostAction", "api.post.do_action.action_integration.app_error", nil, "err="+err.Error(), http.StatusBadRequest)
+			return
+		}
+		err = json.Unmarshal([]byte(cookieStr), &cookie)
+		if err != nil {
+			c.Err = model.NewAppError("DoPostAction", "api.post.do_action.action_integration.app_error", nil, "err="+err.Error(), http.StatusBadRequest)
+			return
+		}
+		if !c.App.SessionHasPermissionToChannel(c.App.Session, cookie.ChannelId, model.PERMISSION_READ_CHANNEL) {
+			c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
+			return
+		}
+	} else {
+		if !c.App.SessionHasPermissionToChannelByPost(c.App.Session, c.Params.PostId, model.PERMISSION_READ_CHANNEL) {
+			c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
+			return
+		}
+	}
+
+	var appErr *model.AppError
 	resp := &model.PostActionAPIResponse{Status: "OK"}
 
-	if resp.TriggerId, err = c.App.DoPostAction(c.Params.PostId, c.Params.ActionId, c.App.Session.UserId, actionRequest.SelectedOption); err != nil {
-		c.Err = err
+	resp.TriggerId, appErr = c.App.DoPostActionWithCookie(c.Params.PostId, c.Params.ActionId, c.App.Session.UserId,
+		actionRequest.SelectedOption, cookie)
+	if appErr != nil {
+		c.Err = appErr
 		return
 	}
 
 	b, _ := json.Marshal(resp)
-
 	w.Write(b)
 }
 

api4/integration_action_test.go

@@ -4,7 +4,9 @@
 package api4
 
 import (
+	"bytes"
 	"encoding/json"
+	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@@ -15,6 +17,82 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type testHandler struct {
+	t *testing.T
+}
+
+func (th *testHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	bb, err := ioutil.ReadAll(r.Body)
+	assert.Nil(th.t, err)
+	assert.NotEmpty(th.t, string(bb))
+	poir := model.PostActionIntegrationRequestFromJson(bytes.NewReader(bb))
+	assert.NotEmpty(th.t, poir.UserId)
+	assert.NotEmpty(th.t, poir.ChannelId)
+	assert.Empty(th.t, poir.TeamId)
+	assert.NotEmpty(th.t, poir.PostId)
+	assert.NotEmpty(th.t, poir.TriggerId)
+	assert.Equal(th.t, "button", poir.Type)
+	assert.Equal(th.t, "test-value", poir.Context["test-key"])
+	w.Write([]byte("{}"))
+	w.WriteHeader(200)
+}
+
+func TestPostActionCookies(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	Client := th.Client
+
+	th.App.UpdateConfig(func(cfg *model.Config) {
+		*cfg.ServiceSettings.AllowedUntrustedInternalConnections = "localhost 127.0.0.1"
+	})
+
+	handler := &testHandler{t}
+	server := httptest.NewServer(handler)
+	action := model.PostAction{
+		Id:   model.NewId(),
+		Name: "Test-action",
+		Type: model.POST_ACTION_TYPE_BUTTON,
+		Integration: &model.PostActionIntegration{
+			URL: server.URL,
+			Context: map[string]interface{}{
+				"test-key": "test-value",
+			},
+		},
+	}
+
+	post := &model.Post{
+		Id:        model.NewId(),
+		Type:      model.POST_EPHEMERAL,
+		UserId:    th.BasicUser.Id,
+		ChannelId: th.BasicChannel.Id,
+		CreateAt:  model.GetMillis(),
+		UpdateAt:  model.GetMillis(),
+		Props: map[string]interface{}{
+			"attachments": []*model.SlackAttachment{
+				{
+					Title:     "some-title",
+					TitleLink: "https://some-url.com",
+					Text:      "some-text",
+					ImageURL:  "https://some-other-url.com",
+					Actions:   []*model.PostAction{&action},
+				},
+			},
+		},
+	}
+
+	post.GenerateActionIds()
+	assert.Equal(t, 32, len(th.App.PostActionCookieSecret()))
+	post = model.AddPostActionCookies(post, th.App.PostActionCookieSecret())
+
+	ok, resp := Client.DoPostActionWithCookie(post.Id, action.Id, "", action.Cookie)
+	assert.True(t, ok)
+	assert.NotNil(t, resp)
+	assert.Equal(t, 200, resp.StatusCode)
+	assert.Nil(t, resp.Error)
+	assert.NotNil(t, resp.RequestId)
+	assert.NotNil(t, resp.ServerVersion)
+}
+
 func TestOpenDialog(t *testing.T) {
 	th := Setup().InitBasic()
 	defer th.TearDown()

api4/post.go

@@ -97,7 +97,9 @@ func createEphemeralPost(c *Context, w http.ResponseWriter, r *http.Request) {
 	rp := c.App.SendEphemeralPost(ephRequest.UserID, c.App.PostWithProxyRemovedFromImageURLs(ephRequest.Post))
 
 	w.WriteHeader(http.StatusCreated)
-	w.Write([]byte(c.App.PreparePostForClient(rp, true).ToJson()))
+	rp = model.AddPostActionCookies(rp, c.App.PostActionCookieSecret())
+	rp = c.App.PreparePostForClient(rp, true)
+	w.Write([]byte(rp.ToJson()))
 }
 
 func getPostsForChannel(c *Context, w http.ResponseWriter, r *http.Request) {