[MM-12958] Support running two Mattermost instances on the same domain using subpaths (#10493)

api4/user.go

@@ -14,6 +14,7 @@ import (
 	"github.com/mattermost/mattermost-server/app"
 	"github.com/mattermost/mattermost-server/mlog"
 	"github.com/mattermost/mattermost-server/model"
+	"github.com/mattermost/mattermost-server/utils"
 )
 
 func (api *API) InitUser() {
@@ -1430,11 +1431,13 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
 		secure = true
 	}
 
+	subpath, _ := utils.GetSubpathFromConfig(c.App.Config())
+
 	expiresAt := time.Unix(model.GetMillis()/1000+int64(maxAge), 0)
 	sessionCookie := &http.Cookie{
 		Name:     model.SESSION_COOKIE_TOKEN,
 		Value:    c.App.Session.Token,
-		Path:     "/",
+		Path:     subpath,
 		MaxAge:   maxAge,
 		Expires:  expiresAt,
 		HttpOnly: true,

api4/user_test.go

@@ -2427,28 +2427,49 @@ func TestAttachDeviceId(t *testing.T) {
 	defer th.TearDown()
 
 	deviceId := model.PUSH_NOTIFY_APPLE + ":1234567890"
-	pass, resp := th.Client.AttachDeviceId(deviceId)
-	CheckNoError(t, resp)
 
-	if !pass {
-		t.Fatal("should have passed")
-	}
-
-	if sessions, err := th.App.GetSessions(th.BasicUser.Id); err != nil {
-		t.Fatal(err)
-	} else {
-		if sessions[0].DeviceId != deviceId {
-			t.Fatal("Missing device Id")
+	t.Run("success", func(t *testing.T) {
+		testCases := []struct {
+			Description                   string
+			SiteURL                       string
+			ExpectedSetCookieHeaderRegexp string
+		}{
+			{"no subpath", "http://localhost:8065", "^MMAUTHTOKEN=[a-z0-9]+; Path=/"},
+			{"subpath", "http://localhost:8065/subpath", "^MMAUTHTOKEN=[a-z0-9]+; Path=/subpath"},
 		}
-	}
 
-	_, resp = th.Client.AttachDeviceId("")
-	CheckBadRequestStatus(t, resp)
+		for _, tc := range testCases {
+			t.Run(tc.Description, func(t *testing.T) {
 
-	th.Client.Logout()
+				th.App.UpdateConfig(func(cfg *model.Config) {
+					*cfg.ServiceSettings.SiteURL = tc.SiteURL
+				})
 
-	_, resp = th.Client.AttachDeviceId("")
-	CheckUnauthorizedStatus(t, resp)
+				pass, resp := th.Client.AttachDeviceId(deviceId)
+				CheckNoError(t, resp)
+
+				cookies := resp.Header.Get("Set-Cookie")
+				assert.Regexp(t, tc.ExpectedSetCookieHeaderRegexp, cookies)
+				assert.True(t, pass)
+
+				sessions, err := th.App.GetSessions(th.BasicUser.Id)
+				require.Nil(t, err)
+				assert.Equal(t, deviceId, sessions[0].DeviceId, "Missing device Id")
+			})
+		}
+	})
+
+	t.Run("invalid device id", func(t *testing.T) {
+		_, resp := th.Client.AttachDeviceId("")
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("not logged in", func(t *testing.T) {
+		th.Client.Logout()
+
+		_, resp := th.Client.AttachDeviceId("")
+		CheckUnauthorizedStatus(t, resp)
+	})
 }
 
 func TestGetUserAudits(t *testing.T) {
@@ -2673,6 +2694,36 @@ func TestLogin(t *testing.T) {
 	})
 }
 
+func TestLoginCookies(t *testing.T) {
+	th := Setup().InitBasic()
+	defer th.TearDown()
+	th.Client.Logout()
+
+	testCases := []struct {
+		Description                   string
+		SiteURL                       string
+		ExpectedSetCookieHeaderRegexp string
+	}{
+		{"no subpath", "http://localhost:8065", "^MMAUTHTOKEN=[a-z0-9]+; Path=/"},
+		{"subpath", "http://localhost:8065/subpath", "^MMAUTHTOKEN=[a-z0-9]+; Path=/subpath"},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.Description, func(t *testing.T) {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				*cfg.ServiceSettings.SiteURL = tc.SiteURL
+			})
+
+			user, resp := th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
+			CheckNoError(t, resp)
+			assert.Equal(t, user.Id, th.BasicUser.Id)
+
+			cookies := resp.Header.Get("Set-Cookie")
+			assert.Regexp(t, tc.ExpectedSetCookieHeaderRegexp, cookies)
+		})
+	}
+}
+
 func TestCBALogin(t *testing.T) {
 	t.Run("primary", func(t *testing.T) {
 		th := Setup().InitBasic()