From 5a923e0b94d5bd9bee0e9b5d0f5a94effaaf0ea2 Mon Sep 17 00:00:00 2001
From: Miguel de la Cruz <miguel@mcrx.me>
Date: Fri, 18 Oct 2024 12:22:27 +0200
Subject: [PATCH] Updates the create remote cluster endpoint to require a
 default team id (#28709)

Support for RemoteClusters without a default team id is in place for
old servers that created those connections before v10.1. This change
forbids the creation of new RemoteClusters without providing this
field, and will be removed when manual invites are implemented.

Co-authored-by: Caleb Roseland <caleb@calebroseland.com>
---
 api/v4/source/remoteclusters.yaml           |  3 +++
 server/channels/api4/remote_cluster.go      |  5 +++++
 server/channels/api4/remote_cluster_test.go | 23 +++++++++++++++++----
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/api/v4/source/remoteclusters.yaml b/api/v4/source/remoteclusters.yaml
index 86d004fb54..e7f0853f88 100644
--- a/api/v4/source/remoteclusters.yaml
+++ b/api/v4/source/remoteclusters.yaml
@@ -86,11 +86,14 @@
               type: object
               required:
                 - name
+                - default_team_id
               properties:
                 name:
                   type: string
                 display_name:
                   type: string
+                default_team_id:
+                  type: string
                 password:
                   type: string
                   description: |
diff --git a/server/channels/api4/remote_cluster.go b/server/channels/api4/remote_cluster.go
index 6c21c45c0f..3bc245a5d7 100644
--- a/server/channels/api4/remote_cluster.go
+++ b/server/channels/api4/remote_cluster.go
@@ -382,6 +382,11 @@ func createRemoteCluster(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if rcWithTeamAndPassword.DefaultTeamId == "" {
+		c.SetInvalidParam("remote_cluster.default_team_id")
+		return
+	}
+
 	if rcWithTeamAndPassword.DisplayName == "" {
 		rcWithTeamAndPassword.DisplayName = rcWithTeamAndPassword.Name
 	}
diff --git a/server/channels/api4/remote_cluster_test.go b/server/channels/api4/remote_cluster_test.go
index 9ecdd5b9e6..24aece8f6f 100644
--- a/server/channels/api4/remote_cluster_test.go
+++ b/server/channels/api4/remote_cluster_test.go
@@ -185,7 +185,6 @@ func TestCreateRemoteCluster(t *testing.T) {
 	rcWithTeamAndPassword := &model.RemoteClusterWithPassword{
 		RemoteCluster: &model.RemoteCluster{
 			Name:          "remotecluster",
-			SiteURL:       "http://example.com",
 			DefaultTeamId: model.NewId(),
 			Token:         model.NewId(),
 		},
@@ -222,13 +221,29 @@ func TestCreateRemoteCluster(t *testing.T) {
 
 	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SiteURL = "http://localhost:8065" })
 
+	t.Run("Should not work if no default team id is provided", func(t *testing.T) {
+		rcWithoutDefaultTeamId := &model.RemoteClusterWithPassword{
+			RemoteCluster: &model.RemoteCluster{
+				Name:  "remotecluster-nodefaultteamid",
+				Token: model.NewId(),
+			},
+			Password: "",
+		}
+
+		rcWithInvite, resp, err := th.SystemAdminClient.CreateRemoteCluster(context.Background(), rcWithoutDefaultTeamId)
+		CheckBadRequestStatus(t, resp)
+		require.Error(t, err)
+		require.ErrorContains(t, err, "remote_cluster.default_team_id")
+		require.Zero(t, rcWithInvite)
+	})
+
 	t.Run("Should generate a password if none is given", func(t *testing.T) {
 		// clean the password and check the response
 		rcWithTeamNoPassword := &model.RemoteClusterWithPassword{
 			RemoteCluster: &model.RemoteCluster{
-				Name:    "remotecluster-nopasswd",
-				SiteURL: "http://no-passwd.example.com",
-				Token:   model.NewId(),
+				Name:          "remotecluster-nopasswd",
+				DefaultTeamId: model.NewId(),
+				Token:         model.NewId(),
 			},
 			Password: "",
 		}