diff --git a/api4/team_local.go b/api4/team_local.go index a1b0404602..d069b85981 100644 --- a/api4/team_local.go +++ b/api4/team_local.go @@ -22,6 +22,115 @@ func (api *API) InitTeamLocal() { api.BaseRoutes.TeamByName.Handle("", api.ApiLocal(getTeamByName)).Methods("GET") api.BaseRoutes.TeamMembers.Handle("", api.ApiLocal(addTeamMember)).Methods("POST") api.BaseRoutes.TeamMember.Handle("", api.ApiLocal(removeTeamMember)).Methods("DELETE") + + api.BaseRoutes.Teams.Handle("", api.ApiLocal(getAllTeams)).Methods("GET") + api.BaseRoutes.Team.Handle("/invite/email", api.ApiLocal(localInviteUsersToTeam)).Methods("POST") +} + +func localInviteUsersToTeam(c *Context, w http.ResponseWriter, r *http.Request) { + c.RequireTeamId() + if c.Err != nil { + return + } + + if !*c.App.Config().ServiceSettings.EnableEmailInvitations { + c.Err = model.NewAppError("localInviteUsersToTeam", "api.team.invite_members.disabled.app_error", nil, "", http.StatusNotImplemented) + return + } + + emailList := model.ArrayFromJson(r.Body) + if len(emailList) == 0 { + c.SetInvalidParam("user_email") + return + } + for i := range emailList { + email := strings.ToLower(emailList[i]) + if !model.IsValidEmail(email) { + c.Err = model.NewAppError("localInviteUsersToTeam", "api.team.invite_members.invalid_email.app_error", map[string]interface{}{"Address": email}, "", http.StatusBadRequest) + return + } + emailList[i] = email + } + + auditRec := c.MakeAuditRecord("localInviteUsersToTeam", audit.Fail) + defer c.LogAuditRec(auditRec) + auditRec.AddMeta("team_id", c.Params.TeamId) + auditRec.AddMeta("count", len(emailList)) + auditRec.AddMeta("emails", emailList) + + team, err := c.App.Srv().Store.Team().Get(c.Params.TeamId) + if err != nil { + c.Err = err + return + } + + allowedDomains := []string{team.AllowedDomains, *c.App.Config().TeamSettings.RestrictCreationToDomains} + + if r.URL.Query().Get("graceful") != "" { + var invitesWithErrors []*model.EmailInviteWithError + var goodEmails, errList []string + for _, email := range emailList { + invite := &model.EmailInviteWithError{ + Email: email, + Error: nil, + } + if !isEmailAddressAllowed(email, allowedDomains) { + invite.Error = model.NewAppError("localInviteUsersToTeam", "api.team.invite_members.invalid_email.app_error", map[string]interface{}{"Addresses": email}, "", http.StatusBadRequest) + errList = append(errList, model.EmailInviteWithErrorToString(invite)) + } else { + goodEmails = append(goodEmails, email) + } + invitesWithErrors = append(invitesWithErrors, invite) + } + auditRec.AddMeta("errors", errList) + if len(goodEmails) > 0 { + c.App.SendInviteEmails(team, "Administrator", "mmctl "+model.NewId(), goodEmails, *c.App.Config().ServiceSettings.SiteURL) + } + // in graceful mode we return both the successful ones and the failed ones + w.Write([]byte(model.EmailInviteWithErrorToJson(invitesWithErrors))) + } else { + var invalidEmailList []string + + for _, email := range emailList { + if !isEmailAddressAllowed(email, allowedDomains) { + invalidEmailList = append(invalidEmailList, email) + } + } + if len(invalidEmailList) > 0 { + s := strings.Join(invalidEmailList, ", ") + c.Err = model.NewAppError("localInviteUsersToTeam", "api.team.invite_members.invalid_email.app_error", map[string]interface{}{"Addresses": s}, "", http.StatusBadRequest) + return + } + c.App.SendInviteEmails(team, "Administrator", "mmctl "+model.NewId(), emailList, *c.App.Config().ServiceSettings.SiteURL) + ReturnStatusOK(w) + } + auditRec.Success() +} + +func isEmailAddressAllowed(email string, allowedDomains []string) bool { + for _, restriction := range allowedDomains { + domains := normalizeDomains(restriction) + if len(domains) <= 0 { + continue + } + matched := false + for _, d := range domains { + if strings.HasSuffix(email, "@"+d) { + matched = true + break + } + } + if !matched { + return false + } + } + return true +} + +func normalizeDomains(domains string) []string { + // commas and @ signs are optional + // can be in the form of "@corp.mattermost.com, mattermost.com mattermost.org" -> corp.mattermost.com mattermost.com mattermost.org + return strings.Fields(strings.TrimSpace(strings.ToLower(strings.Replace(strings.Replace(domains, "@", " ", -1), ",", " ", -1)))) } func localCreateTeam(c *Context, w http.ResponseWriter, r *http.Request) { diff --git a/api4/team_test.go b/api4/team_test.go index 907a6febb4..7e3b67d55b 100644 --- a/api4/team_test.go +++ b/api4/team_test.go @@ -2636,60 +2636,71 @@ func TestInviteUsersToTeam(t *testing.T) { }() th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableEmailInvitations = false }) - _, resp := th.SystemAdminClient.InviteUsersToTeam(th.BasicTeam.Id, emailList) - require.NotNil(t, resp.Error, "Should be disabled") + th.TestForAllClients(t, func(t *testing.T, client *model.Client4) { + _, resp := client.InviteUsersToTeam(th.BasicTeam.Id, emailList) + require.NotNil(t, resp.Error, "Should be disabled") + }) + + checkEmail := func(t *testing.T, expectedSubject string) { + //Check if the email was sent to the right email address + for _, email := range emailList { + var resultsMailbox mailservice.JSONMessageHeaderInbucket + err := mailservice.RetryInbucket(5, func() error { + var err error + resultsMailbox, err = mailservice.GetMailBox(email) + return err + }) + if err != nil { + t.Log(err) + t.Log("No email was received, maybe due load on the server. Disabling this verification") + } + if err == nil && len(resultsMailbox) > 0 { + require.True(t, strings.ContainsAny(resultsMailbox[len(resultsMailbox)-1].To[0], email), "Wrong To recipient") + resultsEmail, err := mailservice.GetMessageFromMailbox(email, resultsMailbox[len(resultsMailbox)-1].ID) + if err == nil { + require.Equalf(t, resultsEmail.Subject, expectedSubject, "Wrong Subject, actual: %s, expected: %s", resultsEmail.Subject, expectedSubject) + } + } + } + } th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableEmailInvitations = true }) okMsg, resp := th.SystemAdminClient.InviteUsersToTeam(th.BasicTeam.Id, emailList) CheckNoError(t, resp) require.True(t, okMsg, "should return true") - nameFormat := *th.App.Config().TeamSettings.TeammateNameDisplay expectedSubject := utils.T("api.templates.invite_subject", map[string]interface{}{"SenderName": th.SystemAdminUser.GetDisplayName(nameFormat), "TeamDisplayName": th.BasicTeam.DisplayName, "SiteName": th.App.ClientConfig()["SiteName"]}) + checkEmail(t, expectedSubject) - //Check if the email was send to the right email address - for _, email := range emailList { - var resultsMailbox mailservice.JSONMessageHeaderInbucket - err := mailservice.RetryInbucket(5, func() error { - var err error - resultsMailbox, err = mailservice.GetMailBox(email) - return err - }) - if err != nil { - t.Log(err) - t.Log("No email was received, maybe due load on the server. Disabling this verification") - } - if err == nil && len(resultsMailbox) > 0 { - require.True(t, strings.ContainsAny(resultsMailbox[len(resultsMailbox)-1].To[0], email), "Wrong To recipient") - resultsEmail, err := mailservice.GetMessageFromMailbox(email, resultsMailbox[len(resultsMailbox)-1].ID) - if err == nil { - require.Equalf(t, resultsEmail.Subject, expectedSubject, "Wrong Subject, actual: %s, expected: %s", resultsEmail.Subject, expectedSubject) - } - } - } + mailservice.DeleteMailBox(user1) + mailservice.DeleteMailBox(user2) + okMsg, resp = th.LocalClient.InviteUsersToTeam(th.BasicTeam.Id, emailList) + CheckNoError(t, resp) + require.True(t, okMsg, "should return true") + expectedSubject = utils.T("api.templates.invite_subject", + map[string]interface{}{"SenderName": "Administrator", + "TeamDisplayName": th.BasicTeam.DisplayName, + "SiteName": th.App.ClientConfig()["SiteName"]}) + checkEmail(t, expectedSubject) th.App.UpdateConfig(func(cfg *model.Config) { *cfg.TeamSettings.RestrictCreationToDomains = "@global.com,@common.com" }) - t.Run("restricted domains", func(t *testing.T) { - err := th.App.InviteNewUsersToTeam(emailList, th.BasicTeam.Id, th.BasicUser.Id) + th.TestForAllClients(t, func(t *testing.T, client *model.Client4) { + okMsg, resp := client.InviteUsersToTeam(th.BasicTeam.Id, emailList) + require.False(t, okMsg, "should return false") + require.NotNil(t, resp.Error, "Adding users with non-restricted domains was allowed") - require.NotNil(t, err, "Adding users with non-restricted domains was allowed") + invitesWithErrors, resp := client.InviteUsersToTeamGracefully(th.BasicTeam.Id, emailList) + CheckNoError(t, resp) + require.Len(t, invitesWithErrors, 2) + require.NotNil(t, invitesWithErrors[0].Error) + require.NotNil(t, invitesWithErrors[1].Error) + }, "restricted domains") - require.Equalf(t, err.Where, "InviteNewUsersToTeam", "%v, Got wrong error message!", err) - require.Equalf(t, err.Id, "api.team.invite_members.invalid_email.app_error", "%v, Got wrong error message!", err) - - res, err := th.App.InviteNewUsersToTeamGracefully(emailList, th.BasicTeam.Id, th.BasicUser.Id) - - require.Nil(t, err) - require.Len(t, res, 2) - require.NotNil(t, res[0].Error) - require.NotNil(t, res[1].Error) - }) - - t.Run("override restricted domains", func(t *testing.T) { + th.TestForAllClients(t, func(t *testing.T, client *model.Client4) { th.BasicTeam.AllowedDomains = "invalid.com,common.com" _, err := th.App.UpdateTeam(th.BasicTeam) require.NotNil(t, err, "Should not update the team") @@ -2698,22 +2709,24 @@ func TestInviteUsersToTeam(t *testing.T) { _, err = th.App.UpdateTeam(th.BasicTeam) require.Nilf(t, err, "%v, Should update the team", err) - err = th.App.InviteNewUsersToTeam([]string{"test@global.com"}, th.BasicTeam.Id, th.BasicUser.Id) - require.NotNilf(t, err, "%v, Per team restriction should take precedence over the global restriction", err) - require.Equalf(t, err.Where, "InviteNewUsersToTeam", "%v, Per team restriction should take precedence over the global restriction", err) + okMsg, resp := client.InviteUsersToTeam(th.BasicTeam.Id, []string{"test@global.com"}) + require.False(t, okMsg, "should return false") + require.NotNilf(t, resp.Error, "%v, Per team restriction should take precedence over the globally allowed domains", err) - err = th.App.InviteNewUsersToTeam([]string{"test@common.com"}, th.BasicTeam.Id, th.BasicUser.Id) - require.Nilf(t, err, "%v, Failed to invite user which was common between team and global domain restriction", err) + okMsg, resp = client.InviteUsersToTeam(th.BasicTeam.Id, []string{"test@common.com"}) + require.True(t, okMsg, "should return true") + require.Nilf(t, resp.Error, "%v, Failed to invite user which was common between team and global domain restriction", err) - err = th.App.InviteNewUsersToTeam([]string{"test@invalid.com"}, th.BasicTeam.Id, th.BasicUser.Id) - require.NotNilf(t, err, "%v, Should not invite user", err) + okMsg, resp = client.InviteUsersToTeam(th.BasicTeam.Id, []string{"test@invalid.com"}) + require.False(t, okMsg, "should return false") + require.NotNilf(t, resp.Error, "%v, Should not invite user", err) - res, err := th.App.InviteNewUsersToTeamGracefully([]string{"test@invalid.com", "test@common.com"}, th.BasicTeam.Id, th.BasicUser.Id) - require.Nil(t, err) - require.Len(t, res, 2) - require.NotNil(t, res[0].Error) - require.Nil(t, res[1].Error) - }) + invitesWithErrors, resp := client.InviteUsersToTeamGracefully(th.BasicTeam.Id, []string{"test@invalid.com", "test@common.com"}) + CheckNoError(t, resp) + require.Len(t, invitesWithErrors, 2) + require.NotNil(t, invitesWithErrors[0].Error) + require.Nil(t, invitesWithErrors[1].Error) + }, "override restricted domains") } func TestInviteGuestsToTeam(t *testing.T) {