MM-15162: Changes for LDAP groups removals. (#10701)
* MM-15162: Changes for LDAP groups removals phase. * MM-15162: Adds missing translation. * MM-15162: Fixes tests. * MM-15162: Removes some confusing branching. * MM-15162: Make permission less restrictive. * MM-15162: Moves counting to the DB tier. * MM-15162: Moves CountGroupsByTeam into own store method. * MM-15162: Adds count to tests. * MM-15162: Fix for wrong cast type. * MM-15162: Fix for possible null SchemeGuest column. * MM-15162: Fixes bug whereby permissions error didn't return. * MM-15162: Changes for LDAP groups removals phase. * MM-15162: Adds missing translation. * MM-15162: Fixes tests. * MM-15162: Removes some confusing branching. * MM-15162: Make permission less restrictive. * MM-15162: Moves counting to the DB tier. * MM-15162: Moves CountGroupsByTeam into own store method. * MM-15162: Adds count to tests. * MM-15162: Fix for wrong cast type. * MM-15162: Fix for possible null SchemeGuest column. * MM-15162: Fixes bug whereby permissions error didn't return. * MM-15162: Adds missing translation blocking enterprise build. * MM-15162: Update to group commands.
Этот коммит содержится в:
Martin Kraft
коммит произвёл
GitHub
GitHub
родитель
74c7c46a7d
Коммит
480fffd3cc
100
api4/group.go
100
api4/group.go
@@ -19,6 +19,9 @@ const (
|
||||
)
|
||||
|
||||
func (api *API) InitGroup() {
|
||||
// GET /api/v4/groups
|
||||
api.BaseRoutes.Groups.Handle("", api.ApiSessionRequired(getGroups)).Methods("GET")
|
||||
|
||||
// GET /api/v4/groups/:group_id
|
||||
api.BaseRoutes.Groups.Handle("/{group_id:[A-Za-z0-9]+}",
|
||||
api.ApiSessionRequired(getGroup)).Methods("GET")
|
||||
@@ -177,8 +180,9 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
|
||||
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
|
||||
appErr := verifyLinkUnlinkPermission(c, syncableType, syncableID)
|
||||
if appErr != nil {
|
||||
c.Err = appErr
|
||||
return
|
||||
}
|
||||
|
||||
@@ -389,12 +393,13 @@ func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
|
||||
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
|
||||
err := verifyLinkUnlinkPermission(c, syncableType, syncableID)
|
||||
if err != nil {
|
||||
c.Err = err
|
||||
return
|
||||
}
|
||||
|
||||
_, err := c.App.DeleteGroupSyncable(c.Params.GroupId, syncableID, syncableType)
|
||||
_, err = c.App.DeleteGroupSyncable(c.Params.GroupId, syncableID, syncableType)
|
||||
if err != nil {
|
||||
c.Err = err
|
||||
return
|
||||
@@ -403,6 +408,33 @@ func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
ReturnStatusOK(w)
|
||||
}
|
||||
|
||||
func verifyLinkUnlinkPermission(c *Context, syncableType model.GroupSyncableType, syncableID string) *model.AppError {
|
||||
switch syncableType {
|
||||
case model.GroupSyncableTypeTeam:
|
||||
if !c.App.SessionHasPermissionToTeam(c.App.Session, syncableID, model.PERMISSION_MANAGE_TEAM) {
|
||||
return c.App.MakePermissionError(model.PERMISSION_MANAGE_TEAM)
|
||||
}
|
||||
case model.GroupSyncableTypeChannel:
|
||||
channel, err := c.App.GetChannel(syncableID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
var permission *model.Permission
|
||||
if channel.Type == model.CHANNEL_PRIVATE {
|
||||
permission = model.PERMISSION_MANAGE_PRIVATE_CHANNEL_MEMBERS
|
||||
} else {
|
||||
permission = model.PERMISSION_MANAGE_PUBLIC_CHANNEL_MEMBERS
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionToChannel(c.App.Session, syncableID, permission) {
|
||||
return c.App.MakePermissionError(permission)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func getGroupMembers(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
c.RequireGroupId()
|
||||
if c.Err != nil {
|
||||
@@ -482,18 +514,33 @@ func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionTo(c.App.Session, model.PERMISSION_MANAGE_SYSTEM) {
|
||||
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
|
||||
if !c.App.SessionHasPermissionToTeam(c.App.Session, c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
|
||||
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
|
||||
return
|
||||
}
|
||||
|
||||
groups, err := c.App.GetGroupsByTeam(c.Params.TeamId, c.Params.Page, c.Params.PerPage)
|
||||
opts := model.GroupSearchOpts{
|
||||
Q: c.Params.Q,
|
||||
IncludeMemberCount: c.Params.IncludeMemberCount,
|
||||
}
|
||||
if c.Params.Paginate == nil || *c.Params.Paginate {
|
||||
opts.PageOpts = &model.PageOpts{Page: c.Params.Page, PerPage: c.Params.PerPage}
|
||||
}
|
||||
|
||||
groups, totalCount, err := c.App.GetGroupsByTeam(c.Params.TeamId, opts)
|
||||
if err != nil {
|
||||
c.Err = err
|
||||
return
|
||||
}
|
||||
|
||||
b, marshalErr := json.Marshal(groups)
|
||||
b, marshalErr := json.Marshal(struct {
|
||||
Groups []*model.Group `json:"groups"`
|
||||
Count int `json:"total_group_count"`
|
||||
}{
|
||||
Groups: groups,
|
||||
Count: totalCount,
|
||||
})
|
||||
|
||||
if marshalErr != nil {
|
||||
c.Err = model.NewAppError("Api4.getGroupsByTeam", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
@@ -501,3 +548,38 @@ func getGroupsByTeam(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
w.Write(b)
|
||||
}
|
||||
|
||||
func getGroups(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
if c.App.License() == nil || !*c.App.License().Features.LDAPGroups {
|
||||
c.Err = model.NewAppError("Api4.getGroups", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
|
||||
return
|
||||
}
|
||||
|
||||
opts := model.GroupSearchOpts{
|
||||
Q: c.Params.Q,
|
||||
IncludeMemberCount: c.Params.IncludeMemberCount,
|
||||
}
|
||||
|
||||
teamID := c.Params.NotAssociatedToTeam
|
||||
if len(teamID) == 26 {
|
||||
if !c.App.SessionHasPermissionToTeam(c.App.Session, teamID, model.PERMISSION_VIEW_TEAM) {
|
||||
c.SetPermissionError(model.PERMISSION_VIEW_TEAM)
|
||||
return
|
||||
}
|
||||
opts.NotAssociatedToTeam = teamID
|
||||
}
|
||||
|
||||
groups, err := c.App.GetGroups(c.Params.Page, c.Params.PerPage, opts)
|
||||
if err != nil {
|
||||
c.Err = err
|
||||
return
|
||||
}
|
||||
|
||||
b, marshalErr := json.Marshal(groups)
|
||||
if marshalErr != nil {
|
||||
c.Err = model.NewAppError("Api4.getGroups", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
w.Write(b)
|
||||
}
|
||||
|
||||
@@ -9,6 +9,7 @@ import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/mattermost/mattermost-server/model"
|
||||
)
|
||||
@@ -150,7 +151,14 @@ func TestLinkGroupTeam(t *testing.T) {
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
groupTeam, response := th.SystemAdminClient.LinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam, patch)
|
||||
_, response = th.Client.LinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam, patch)
|
||||
assert.NotNil(t, response.Error)
|
||||
|
||||
th.UpdateUserToTeamAdmin(th.BasicUser, th.BasicTeam)
|
||||
th.Client.Logout()
|
||||
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
|
||||
|
||||
groupTeam, response := th.Client.LinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam, patch)
|
||||
assert.Equal(t, http.StatusCreated, response.StatusCode)
|
||||
assert.NotNil(t, groupTeam)
|
||||
}
|
||||
@@ -181,8 +189,17 @@ func TestLinkGroupChannel(t *testing.T) {
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
_, response = th.SystemAdminClient.LinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel, patch)
|
||||
groupTeam, response := th.Client.LinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel, patch)
|
||||
assert.Equal(t, http.StatusCreated, response.StatusCode)
|
||||
assert.NotNil(t, groupTeam)
|
||||
|
||||
_, response = th.SystemAdminClient.UpdateChannelRoles(th.BasicChannel.Id, th.BasicUser.Id, "")
|
||||
require.Nil(t, response.Error)
|
||||
th.Client.Logout()
|
||||
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
|
||||
|
||||
_, response = th.Client.LinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel, patch)
|
||||
assert.NotNil(t, response.Error)
|
||||
}
|
||||
|
||||
func TestUnlinkGroupTeam(t *testing.T) {
|
||||
@@ -218,7 +235,14 @@ func TestUnlinkGroupTeam(t *testing.T) {
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
response = th.SystemAdminClient.UnlinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam)
|
||||
response = th.Client.UnlinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam)
|
||||
assert.NotNil(t, response.Error)
|
||||
|
||||
th.UpdateUserToTeamAdmin(th.BasicUser, th.BasicTeam)
|
||||
th.Client.Logout()
|
||||
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
|
||||
|
||||
response = th.Client.UnlinkGroupSyncable(g.Id, th.BasicTeam.Id, model.GroupSyncableTypeTeam)
|
||||
CheckOKStatus(t, response)
|
||||
}
|
||||
|
||||
@@ -255,8 +279,21 @@ func TestUnlinkGroupChannel(t *testing.T) {
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
response = th.SystemAdminClient.UnlinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel)
|
||||
CheckOKStatus(t, response)
|
||||
_, response = th.SystemAdminClient.UpdateChannelRoles(th.BasicChannel.Id, th.BasicUser.Id, "")
|
||||
require.Nil(t, response.Error)
|
||||
th.Client.Logout()
|
||||
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
|
||||
|
||||
response = th.Client.UnlinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel)
|
||||
assert.NotNil(t, response.Error)
|
||||
|
||||
_, response = th.SystemAdminClient.UpdateChannelRoles(th.BasicChannel.Id, th.BasicUser.Id, "channel_admin channel_user")
|
||||
require.Nil(t, response.Error)
|
||||
th.Client.Logout()
|
||||
th.Client.Login(th.BasicUser.Email, th.BasicUser.Password)
|
||||
|
||||
response = th.Client.UnlinkGroupSyncable(g.Id, th.BasicChannel.Id, model.GroupSyncableTypeChannel)
|
||||
assert.Nil(t, response.Error)
|
||||
}
|
||||
|
||||
func TestGetGroupTeam(t *testing.T) {
|
||||
@@ -661,24 +698,88 @@ func TestGetGroupsByTeam(t *testing.T) {
|
||||
})
|
||||
assert.Nil(t, err)
|
||||
|
||||
_, response := th.SystemAdminClient.GetGroupsByTeam("asdfasdf", 0, 60)
|
||||
opts := model.GroupSearchOpts{
|
||||
PageOpts: &model.PageOpts{
|
||||
Page: 0,
|
||||
PerPage: 60,
|
||||
},
|
||||
}
|
||||
|
||||
_, _, response := th.SystemAdminClient.GetGroupsByTeam("asdfasdf", opts)
|
||||
CheckBadRequestStatus(t, response)
|
||||
|
||||
th.App.SetLicense(nil)
|
||||
|
||||
_, response = th.SystemAdminClient.GetGroupsByTeam(th.BasicTeam.Id, 0, 60)
|
||||
_, _, response = th.SystemAdminClient.GetGroupsByTeam(th.BasicTeam.Id, opts)
|
||||
CheckNotImplementedStatus(t, response)
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
_, response = th.Client.GetGroupsByTeam(th.BasicTeam.Id, 0, 60)
|
||||
_, _, response = th.Client.GetGroupsByTeam(th.BasicTeam.Id, opts)
|
||||
CheckForbiddenStatus(t, response)
|
||||
|
||||
groups, response := th.SystemAdminClient.GetGroupsByTeam(th.BasicTeam.Id, 0, 60)
|
||||
groups, _, response := th.SystemAdminClient.GetGroupsByTeam(th.BasicTeam.Id, opts)
|
||||
assert.Nil(t, response.Error)
|
||||
assert.ElementsMatch(t, []*model.Group{group}, groups)
|
||||
|
||||
groups, response = th.SystemAdminClient.GetGroupsByTeam(model.NewId(), 0, 60)
|
||||
groups, _, response = th.SystemAdminClient.GetGroupsByTeam(model.NewId(), opts)
|
||||
assert.Nil(t, response.Error)
|
||||
assert.Empty(t, groups)
|
||||
}
|
||||
|
||||
func TestGetGroups(t *testing.T) {
|
||||
th := Setup().InitBasic()
|
||||
defer th.TearDown()
|
||||
|
||||
id := model.NewId()
|
||||
group, err := th.App.CreateGroup(&model.Group{
|
||||
DisplayName: "dn-foo_" + id,
|
||||
Name: "name" + id,
|
||||
Source: model.GroupSourceLdap,
|
||||
Description: "description_" + id,
|
||||
RemoteId: model.NewId(),
|
||||
})
|
||||
assert.Nil(t, err)
|
||||
|
||||
opts := model.GroupSearchOpts{
|
||||
PageOpts: &model.PageOpts{
|
||||
Page: 0,
|
||||
PerPage: 60,
|
||||
},
|
||||
}
|
||||
|
||||
th.App.SetLicense(nil)
|
||||
|
||||
_, response := th.SystemAdminClient.GetGroups(opts)
|
||||
CheckNotImplementedStatus(t, response)
|
||||
|
||||
th.App.SetLicense(model.NewTestLicense("ldap"))
|
||||
|
||||
groups, response := th.SystemAdminClient.GetGroups(opts)
|
||||
assert.Nil(t, response.Error)
|
||||
assert.ElementsMatch(t, []*model.Group{group, th.Group}, groups)
|
||||
assert.Nil(t, groups[0].MemberCount)
|
||||
|
||||
opts.IncludeMemberCount = true
|
||||
groups, _ = th.SystemAdminClient.GetGroups(opts)
|
||||
assert.NotNil(t, groups[0].MemberCount)
|
||||
opts.IncludeMemberCount = false
|
||||
|
||||
opts.Q = "-fOo"
|
||||
groups, _ = th.SystemAdminClient.GetGroups(opts)
|
||||
assert.Len(t, groups, 1)
|
||||
opts.Q = ""
|
||||
|
||||
_, response = th.SystemAdminClient.UpdateTeamMemberRoles(th.BasicTeam.Id, th.BasicUser.Id, "")
|
||||
require.Nil(t, response.Error)
|
||||
|
||||
opts.NotAssociatedToTeam = th.BasicTeam.Id
|
||||
_, response = th.Client.GetGroups(opts)
|
||||
CheckForbiddenStatus(t, response)
|
||||
|
||||
_, response = th.SystemAdminClient.UpdateTeamMemberRoles(th.BasicTeam.Id, th.BasicUser.Id, "team_user")
|
||||
require.Nil(t, response.Error)
|
||||
|
||||
_, response = th.Client.GetGroups(opts)
|
||||
assert.Nil(t, response.Error)
|
||||
}
|
||||
|
||||
@@ -78,7 +78,7 @@ func getLdapGroups(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
opts := model.GroupSearchOpts{
|
||||
opts := model.LdapGroupSearchOpts{
|
||||
Q: c.Params.Q,
|
||||
}
|
||||
if c.Params.IsLinked != nil {
|
||||
|
||||
Ссылка в новой задаче
Block a user