Webapp - Outgoing OAuth Connections (#25507)

* added store * make generated * add missing license headers * fix receiver name * i18n * i18n sorting * update migrations from master * make migrations-extract * update retrylayer tests * replaced sql query with id pagination * fixed flaky tests * missing columns * missing columns on save/update * typo * improved tests * remove enum from mysql colum * add password credentials to store * license changes * OAuthOutgoingConnectionInterface * Oauth -> OAuth * make generated * copied over installed_oauth_apps component and renamed things to installed_outgoing_oauth_connections * merge migrations * renamed migrations * model change suggestions * refactor test functionsn * migration typo * refactor store table names * updated sanitize test * cleanup merge * refactor symbol * "installed outgoing oauth connections" page works * move things into a nested folder * add and edit page stubs work * list endpoint * oauthoutgoingconnection -> outgoingoauthconnection * signature change * i18n update * granttype typo * naming * api list * uppercase typo * i18n * missing license header * fixed path in comments * updated openapi definitions * changes to support selecting command request url * sanitize connections * make generated * test license and no feature flag * removed t.fatal * updated testhelper calls * yaml schema fixes * switched interface name * suggested translation * missing i18n translation * management permission * moved permission initalization to proper place * endpoints * put tests * error check typo * fixed specific enttity urls * tests * read permission check * updated openapi definitions * i18n * GetConnectionByAudience method * notes * replaced GetConnectionsByAudience with a filter * added custom oauth token object * updated interface and usage * properly set enterprise interface * move retrieval logic to impl * webhook tests * translations * i18n: updates * address comments * endpoint and tests * i18n * api docs * fixed endpoint path * sq.like * use filter object instead of parameters * set url values if not empty * typos * converted some components to function components, and move around files * correctly check token url * restore flag to previous value * added command oauth handler * update enterprise imports * migrate last component to function component * Added enterprise import * refactor permissions and add necessary webapp code * Check correct flag in permission tree * allow partial updates * sort i18n webapp * missing test modification * fixed webapp i18n sorting * allow validating stored connections * added missing translation * fix finished adding connection link and text on result page * added missing permission to smoke tests * missing role in smoke test * updated translations * updated translations * support editing client secret on existing connection * fix some i18n strings * updated translations * better error messages * progress on using react select for command request url while maintaining typed in value * remove writeheader, test * HasValidGrantType * end early to avoid nil pointer errors * move slash command request url input box into its own component * wrap components related to oauth connections in config check * fix tests * i18n-extract * change some i18n strings to say "Outgoing OAuth 2.0 Connections" * remove debug code * fixed i18n * updated i18n file * feature configuration backend * typo * add system console setting * Revert "typo" This reverts commit 669da23e8ee47525ccaa6f59cbbd20bf8a121191. * Revert "updated i18n file" This reverts commit d0882c0dd7587533f0d0f7a7b7b190684186158a. * Revert "fixed i18n" This reverts commit 3108866bc19139182dfd094921c56cdefc4695ea. * fixed i18n * updated i18n file * typo * updated i18n * updated i18n * updated i18n * updated version to 9.6 * replace feature flag with system console configuration * i18n * updated tests * pr feedback * fix styling of disabled text box * fix styling of action links in integration console * server changes for validation feature * webapp changes for validation feature * pencil icon styling * styling fixes for oauth audience correct configuration message * fix sanitize test * remove max lengths from outgoing oauth connection form * use config var in webapp instead of feature flag * change asterisks to bullets * update api docs for validate endpoint * feedback from ux review * fix lint, types, tests * fix stylelint * implement validation button under the token url input * support wildcard for matching audience urls * updates for styling * update snapshots * add doc links for the outgoing oauth connections feature * change doc links to use permalink * add docs link to system console * fix: use limitedreader in json decoding * fix: form error in validation * management permission can read now * updated api documentation * doc typo * require one permission to read only * fix api connection list audience filter * fix audience matching and add loading indicator * fix team permissions on outgoing oauth connection api calls * fix api doc and test, for adding team id to query params * handle read permissions by adding a team in the payload * missing teamid query parameter in test * change validate button logic to not require audience urls to be filled out * fix redux type --------- Co-authored-by: Felipe Martin <me@fmartingr.com>
2024-02-09 14:49:49 -05:00
--- a/server/channels/app/channels.go
+++ b/server/channels/app/channels.go
@@ -60,14 +60,13 @@ type Channels struct {
 	// previously fetched notices
 	cachedNotices model.ProductNotices

-	AccountMigration        einterfaces.AccountMigrationInterface
-	Compliance              einterfaces.ComplianceInterface
-	DataRetention           einterfaces.DataRetentionInterface
-	MessageExport           einterfaces.MessageExportInterface
-	Saml                    einterfaces.SamlInterface
-	Notification            einterfaces.NotificationInterface
-	OutgoingOAuthConnection einterfaces.OutgoingOAuthConnectionInterface
-	Ldap                    einterfaces.LdapInterface
+	AccountMigration einterfaces.AccountMigrationInterface
+	Compliance       einterfaces.ComplianceInterface
+	DataRetention    einterfaces.DataRetentionInterface
+	MessageExport    einterfaces.MessageExportInterface
+	Saml             einterfaces.SamlInterface
+	Notification     einterfaces.NotificationInterface
+	Ldap             einterfaces.LdapInterface

 	// These are used to prevent concurrent upload requests
 	// for a given upload session which could cause inconsistencies
@@ -177,9 +176,6 @@ func NewChannels(services map[product.ServiceKey]any) (*Channels, error) {
 	if notificationInterface != nil {
 		ch.Notification = notificationInterface(New(ServerConnector(ch)))
 	}
-	if outgoingOauthConnectionInterface != nil {
-		ch.OutgoingOAuthConnection = outgoingOauthConnectionInterface(New(ServerConnector(ch)))
-	}
 	if samlInterfaceNew != nil {
 		ch.Saml = samlInterfaceNew(New(ServerConnector(ch)))
 		if err := ch.Saml.ConfigureSP(request.EmptyContext(s.Log())); err != nil {
--- a/server/channels/app/command.go
+++ b/server/channels/app/command.go
@@ -485,6 +485,23 @@ func (a *App) DoCommandRequest(rctx request.CTX, cmd *model.Command, p url.Value
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(*a.Config().ServiceSettings.OutgoingIntegrationRequestsTimeout)*time.Second)
 	defer cancel()

+	var accessToken *model.OutgoingOAuthConnectionToken
+
+	// Retrieve an access token from a connection if one exists to use for the webhook request
+	if a.Config().ServiceSettings.EnableOutgoingOAuthConnections != nil && *a.Config().ServiceSettings.EnableOutgoingOAuthConnections && a.OutgoingOAuthConnections() != nil {
+		connection, err := a.OutgoingOAuthConnections().GetConnectionForAudience(rctx, cmd.URL)
+		if err != nil {
+			a.Log().Error("Failed to find an outgoing oauth connection for the webhook", mlog.Err(err))
+		}
+
+		if connection != nil {
+			accessToken, err = a.OutgoingOAuthConnections().RetrieveTokenForConnection(rctx, connection)
+			if err != nil {
+				a.Log().Error("Failed to retrieve token for outgoing oauth connection", mlog.Err(err))
+			}
+		}
+	}
+
 	// Prepare the request
 	var req *http.Request
 	var err error
@@ -506,7 +523,14 @@ func (a *App) DoCommandRequest(rctx request.CTX, cmd *model.Command, p url.Value
 	}

 	req.Header.Set("Accept", "application/json")
-	req.Header.Set("Authorization", "Token "+cmd.Token)
+	if cmd.Token != "" {
+		req.Header.Set("Authorization", "Token "+cmd.Token)
+	}
+
+	if accessToken != nil {
+		req.Header.Set("Authorization", accessToken.AsHeaderValue())
+	}
+
 	if cmd.Method == model.CommandMethodPost {
 		req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	}
--- a/server/channels/app/permissions_migrations.go
+++ b/server/channels/app/permissions_migrations.go
@@ -1141,6 +1141,21 @@ func (a *App) getAddIPFilterPermissionsMigration() (permissionsMap, error) {
 	return t, nil
 }

+func (a *App) getAddOutgoingOAuthConnectionsPermissions() (permissionsMap, error) {
+	t := []permissionTransformation{}
+
+	permissionManageOutgoingOAuthConnections := []string{
+		model.PermissionManageOutgoingOAuthConnections.Id,
+	}
+
+	t = append(t, permissionTransformation{
+		On:  permissionOr(isExactRole(model.SystemAdminRoleId)),
+		Add: permissionManageOutgoingOAuthConnections,
+	})
+
+	return t, nil
+}
+
 // DoPermissionsMigrations execute all the permissions migrations need by the current version.
 func (a *App) DoPermissionsMigrations() error {
 	return a.Srv().doPermissionsMigrations()
@@ -1186,6 +1201,7 @@ func (s *Server) doPermissionsMigrations() error {
 		{Key: model.MigrationKeyAddCustomUserGroupsPermissionRestore, Migration: a.getAddCustomUserGroupsPermissionRestore},
 		{Key: model.MigrationKeyAddReadChannelContentPermissions, Migration: a.getAddChannelReadContentPermissions},
 		{Key: model.MigrationKeyAddIPFilteringPermissions, Migration: a.getAddIPFilterPermissionsMigration},
+		{Key: model.MigrationKeyAddOutgoingOAuthConnectionsPermissions, Migration: a.getAddOutgoingOAuthConnectionsPermissions},
 	}

 	roles, err := s.Store().Role().GetAll()
--- a/server/channels/app/server.go
+++ b/server/channels/app/server.go
@@ -402,6 +402,10 @@ func NewServer(options ...Option) (*Server, error) {
 		s.IPFiltering = ipFilteringInterface(app)
 	}

+	if outgoingOauthConnectionInterface != nil {
+		s.OutgoingOAuthConnection = outgoingOauthConnectionInterface(app)
+	}
+
 	s.clusterLeaderListenerId = s.AddClusterLeaderChangedListener(func() {
 		mlog.Info("Cluster leader changed. Determining if job schedulers should be running:", mlog.Bool("isLeader", s.IsLeader()))
 		if s.Jobs != nil {
--- a/server/channels/app/slashcommands/command_test.go
+++ b/server/channels/app/slashcommands/command_test.go
@@ -17,6 +17,8 @@ import (
 	"github.com/stretchr/testify/require"

 	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/public/plugin/plugintest/mock"
+	"github.com/mattermost/mattermost/server/v8/einterfaces/mocks"
 )

 type InfiniteReader struct {
@@ -459,6 +461,51 @@ func TestDoCommandRequest(t *testing.T) {
 		require.NotNil(t, resp)
 		assert.Equal(t, "Hello, World!", resp.Text)
 	})
+
+	t.Run("with a url that matches an outgoing oauth connection", func(t *testing.T) {
+		outgoingOauthIface := &mocks.OutgoingOAuthConnectionInterface{}
+		outgoingOauthImpl := th.App.Srv().OutgoingOAuthConnection
+		outgoingOAuthConnectionConfig := th.App.Config().ServiceSettings.EnableOutgoingOAuthConnections
+		th.App.Config().ServiceSettings.EnableOutgoingOAuthConnections = model.NewBool(true)
+		t.Cleanup(func() {
+			th.App.Srv().OutgoingOAuthConnection = outgoingOauthImpl
+			th.App.Config().ServiceSettings.EnableOutgoingOAuthConnections = outgoingOAuthConnectionConfig
+		})
+		th.App.Srv().OutgoingOAuthConnection = outgoingOauthIface
+
+		serverCommand := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			io.Copy(w, strings.NewReader(r.Header.Get("Authorization")))
+		}))
+		defer serverCommand.Close()
+
+		connection := &model.OutgoingOAuthConnection{
+			Id:            model.NewId(),
+			Name:          "test",
+			ClientId:      "test",
+			ClientSecret:  "test",
+			CreatorId:     model.NewId(),
+			OAuthTokenURL: "fake",
+			GrantType:     model.OutgoingOAuthConnectionGrantTypeClientCredentials,
+			Audiences: model.StringArray{
+				serverCommand.URL,
+			},
+		}
+
+		outgoingOauthIface.Mock.On("GetConnectionForAudience", mock.Anything, serverCommand.URL).Return(connection, nil)
+		outgoingOauthIface.Mock.On("SanitizeConnections", mock.Anything)
+		outgoingOauthIface.Mock.On("RetrieveTokenForConnection", mock.Anything, connection).Return(&model.OutgoingOAuthConnectionToken{
+			AccessToken: "token",
+			TokenType:   "type",
+		}, nil)
+
+		_, resp, err := th.App.DoCommandRequest(th.Context, &model.Command{URL: serverCommand.URL}, url.Values{})
+		require.Nil(t, err)
+
+		require.NotNil(t, resp)
+		// Ensure that the Authorization header was set correctly by reading the body from the command response
+		// which was set to the Authorization header by the command handler.
+		assert.Equal(t, "type token", resp.Text)
+	})
 }

 func TestMentionsToTeamMembers(t *testing.T) {
--- a/server/channels/app/webhook.go
+++ b/server/channels/app/webhook.go
@@ -117,7 +117,27 @@ func (a *App) TriggerWebhook(c request.CTX, payload *model.OutgoingWebhookPayloa

 		go func() {
 			defer wg.Done()
-			webhookResp, err := a.doOutgoingWebhookRequest(url, body, contentType)
+
+			var accessToken *model.OutgoingOAuthConnectionToken
+
+			// Retrieve an access token from a connection if one exists to use for the webhook request
+			if a.Config().ServiceSettings.EnableOutgoingOAuthConnections != nil && *a.Config().ServiceSettings.EnableOutgoingOAuthConnections && a.OutgoingOAuthConnections() != nil {
+				connection, err := a.OutgoingOAuthConnections().GetConnectionForAudience(c, url)
+				if err != nil {
+					c.Logger().Error("Failed to find an outgoing oauth connection for the webhook", mlog.Err(err))
+					return
+				}
+
+				if connection != nil {
+					accessToken, err = a.OutgoingOAuthConnections().RetrieveTokenForConnection(c, connection)
+					if err != nil {
+						c.Logger().Error("Failed to retrieve token for outgoing oauth connection", mlog.Err(err))
+						return
+					}
+				}
+			}
+
+			webhookResp, err := a.doOutgoingWebhookRequest(url, body, contentType, accessToken)
 			if err != nil {
 				if errors.Is(err, context.DeadlineExceeded) {
 					c.Logger().Error("Outgoing Webhook POST timed out. Consider increasing ServiceSettings.OutgoingIntegrationRequestsTimeout.", mlog.Err(err))
@@ -162,7 +182,7 @@ func (a *App) TriggerWebhook(c request.CTX, payload *model.OutgoingWebhookPayloa
 	wg.Wait()
 }

-func (a *App) doOutgoingWebhookRequest(url string, body io.Reader, contentType string) (*model.OutgoingWebhookResponse, error) {
+func (a *App) doOutgoingWebhookRequest(url string, body io.Reader, contentType string, accessToken *model.OutgoingOAuthConnectionToken) (*model.OutgoingWebhookResponse, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), time.Duration(*a.Config().ServiceSettings.OutgoingIntegrationRequestsTimeout)*time.Second)
 	defer cancel()

@@ -174,6 +194,10 @@ func (a *App) doOutgoingWebhookRequest(url string, body io.Reader, contentType s
 	req.Header.Set("Content-Type", contentType)
 	req.Header.Set("Accept", "application/json")

+	if accessToken != nil {
+		req.Header.Add("Authorization", accessToken.AsHeaderValue())
+	}
+
 	resp, err := a.Srv().outgoingWebhookClient.Do(req)
 	if err != nil {
 		return nil, err
--- a/server/channels/app/webhook_test.go
+++ b/server/channels/app/webhook_test.go
@@ -6,6 +6,7 @@ package app
 import (
 	"bytes"
 	"encoding/json"
+	"fmt"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -783,7 +784,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 		}))
 		defer server.Close()

-		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.NoError(t, err)

 		require.NotNil(t, resp)
@@ -797,7 +798,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 		}))
 		defer server.Close()

-		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.Error(t, err)
 		require.Equal(t, "api.unmarshal_error", err.(*model.AppError).Id)
 	})
@@ -808,7 +809,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 		}))
 		defer server.Close()

-		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.Error(t, err)
 		require.Equal(t, "api.unmarshal_error", err.(*model.AppError).Id)
 	})
@@ -819,7 +820,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 		}))
 		defer server.Close()

-		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.Error(t, err)
 		require.Equal(t, "api.unmarshal_error", err.(*model.AppError).Id)
 	})
@@ -838,7 +839,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 			cfg.ServiceSettings.OutgoingIntegrationRequestsTimeout = model.NewInt64(1)
 		})

-		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		_, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.Error(t, err)
 		require.IsType(t, &url.Error{}, err)
 	})
@@ -855,7 +856,7 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 			cfg.ServiceSettings.OutgoingIntegrationRequestsTimeout = model.NewInt64(2)
 		})

-		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.NoError(t, err)
 		require.NotNil(t, resp)
 		assert.NotNil(t, resp.Text)
@@ -867,8 +868,22 @@ func TestDoOutgoingWebhookRequest(t *testing.T) {
 		}))
 		defer server.Close()

-		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json")
+		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", nil)
 		require.NoError(t, err)
 		require.Nil(t, resp)
 	})
+
+	t.Run("with auth token", func(t *testing.T) {
+		server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			io.Copy(w, strings.NewReader(fmt.Sprintf(`{"text":"%s"}`, r.Header.Get("Authorization"))))
+		}))
+		defer server.Close()
+
+		resp, err := th.App.doOutgoingWebhookRequest(server.URL, strings.NewReader(""), "application/json", &model.OutgoingOAuthConnectionToken{
+			AccessToken: "test",
+			TokenType:   "Bearer",
+		})
+		require.NoError(t, err)
+		require.Equal(t, `Bearer test`, *resp.Text)
+	})
 }