MM-28090 User settings api when ldap sync (#16822)

Automatic Merge
2021-03-22 14:02:16 -04:00
--- a/api4/user_test.go
+++ b/api4/user_test.go
@@ -14,9 +14,11 @@ import (

 	"github.com/dgryski/dgoogauth"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/mock"
 	"github.com/stretchr/testify/require"

 	"github.com/mattermost/mattermost-server/v5/app"
+	"github.com/mattermost/mattermost-server/v5/einterfaces/mocks"
 	"github.com/mattermost/mattermost-server/v5/model"
 	"github.com/mattermost/mattermost-server/v5/shared/mail"
 	"github.com/mattermost/mattermost-server/v5/utils/testutils"
@@ -5958,3 +5960,175 @@ func TestReadThreads(t *testing.T) {
 		require.Equal(t, uss3.Threads[0].LastViewedAt, timestamp)
 	})
 }
+
+func TestPatchAndUpdateWithProviderAttributes(t *testing.T) {
+	t.Run("LDAP user", func(t *testing.T) {
+		th := SetupEnterprise(t).InitBasic()
+		defer th.TearDown()
+		user := th.CreateUserWithAuth(model.USER_AUTH_SERVICE_LDAP)
+		ldapMock := &mocks.LdapInterface{}
+		ldapMock.Mock.On(
+			"CheckProviderAttributes",
+			mock.Anything, // app.AppIface
+			mock.Anything, // *model.User
+			mock.Anything, // *model.Patch
+		).Return("")
+		th.App.Srv().Ldap = ldapMock
+		// CheckProviderAttributes should be called for both Patch and Update
+		th.SystemAdminClient.PatchUser(user.Id, &model.UserPatch{})
+		ldapMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 1)
+		th.SystemAdminClient.UpdateUser(user)
+		ldapMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 2)
+	})
+	t.Run("SAML user", func(t *testing.T) {
+		t.Run("with LDAP sync", func(t *testing.T) {
+			th := SetupEnterprise(t).InitBasic()
+			defer th.TearDown()
+			th.SetupLdapConfig()
+			th.SetupSamlConfig()
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				*cfg.SamlSettings.EnableSyncWithLdap = true
+			})
+			user := th.CreateUserWithAuth(model.USER_AUTH_SERVICE_SAML)
+			ldapMock := &mocks.LdapInterface{}
+			ldapMock.Mock.On(
+				"CheckProviderAttributes", mock.Anything, mock.Anything, mock.Anything,
+			).Return("")
+			th.App.Srv().Ldap = ldapMock
+			th.SystemAdminClient.PatchUser(user.Id, &model.UserPatch{})
+			ldapMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 1)
+			th.SystemAdminClient.UpdateUser(user)
+			ldapMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 2)
+		})
+		t.Run("without LDAP sync", func(t *testing.T) {
+			th := SetupEnterprise(t).InitBasic()
+			defer th.TearDown()
+			user := th.CreateUserWithAuth(model.USER_AUTH_SERVICE_SAML)
+			samlMock := &mocks.SamlInterface{}
+			samlMock.Mock.On(
+				"CheckProviderAttributes", mock.Anything, mock.Anything, mock.Anything,
+			).Return("")
+			th.App.Srv().Saml = samlMock
+			th.SystemAdminClient.PatchUser(user.Id, &model.UserPatch{})
+			samlMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 1)
+			th.SystemAdminClient.UpdateUser(user)
+			samlMock.AssertNumberOfCalls(t, "CheckProviderAttributes", 2)
+		})
+	})
+	t.Run("OpenID user", func(t *testing.T) {
+		th := SetupEnterprise(t).InitBasic()
+		defer th.TearDown()
+		user := th.CreateUserWithAuth(model.SERVICE_OPENID)
+		// OAUTH users cannot change these fields
+		for _, fieldName := range []string{
+			"FirstName",
+			"LastName",
+		} {
+			patch := user.ToPatch()
+			patch.SetField(fieldName, "something new")
+			conflictField := th.App.CheckProviderAttributes(user, patch)
+			require.NotEqual(t, "", conflictField)
+		}
+	})
+	t.Run("Patch username", func(t *testing.T) {
+		th := SetupEnterprise(t).InitBasic()
+		defer th.TearDown()
+		// For non-email users, the username must be changed through the provider
+		for _, authService := range []string{
+			model.USER_AUTH_SERVICE_LDAP,
+			model.USER_AUTH_SERVICE_SAML,
+			model.SERVICE_OPENID,
+		} {
+			user := th.CreateUserWithAuth(authService)
+			patch := &model.UserPatch{Username: model.NewString("something new")}
+			conflictField := th.App.CheckProviderAttributes(user, patch)
+			require.NotEqual(t, "", conflictField)
+		}
+	})
+}
+
+func TestSetProfileImageWithProviderAttributes(t *testing.T) {
+	data, err := testutils.ReadTestFile("test.png")
+	require.NoError(t, err)
+
+	type imageTestCase struct {
+		testName      string
+		ldapAttrIsSet bool
+		shouldPass    bool
+	}
+
+	doImageTest := func(t *testing.T, th *TestHelper, user *model.User, testCase imageTestCase) {
+		client := th.SystemAdminClient
+		t.Run(testCase.testName, func(t *testing.T) {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				if testCase.ldapAttrIsSet {
+					*cfg.LdapSettings.PictureAttribute = "jpegPhoto"
+				} else {
+					*cfg.LdapSettings.PictureAttribute = ""
+				}
+			})
+			ok, resp := client.SetProfileImage(user.Id, data)
+			if testCase.shouldPass {
+				require.True(t, ok)
+				CheckNoError(t, resp)
+			} else {
+				require.False(t, ok)
+				checkHTTPStatus(t, resp, http.StatusConflict, true)
+			}
+		})
+	}
+	doCleanup := func(t *testing.T, th *TestHelper, user *model.User) {
+		info := &model.FileInfo{Path: "users/" + user.Id + "/profile.png"}
+		err = th.cleanupTestFile(info)
+		require.Nil(t, err)
+	}
+
+	t.Run("LDAP user", func(t *testing.T) {
+		testCases := []imageTestCase{
+			{"profile picture attribute is set", true, false},
+			{"profile picture attribute is not set", false, true},
+		}
+		th := SetupEnterprise(t).InitBasic()
+		defer th.TearDown()
+		th.SetupLdapConfig()
+		user := th.CreateUserWithAuth(model.USER_AUTH_SERVICE_LDAP)
+		for _, testCase := range testCases {
+			doImageTest(t, th, user, testCase)
+		}
+		doCleanup(t, th, user)
+	})
+
+	t.Run("SAML user", func(t *testing.T) {
+		th := SetupEnterprise(t).InitBasic()
+		defer th.TearDown()
+		th.SetupLdapConfig()
+		th.SetupSamlConfig()
+		user := th.CreateUserWithAuth(model.USER_AUTH_SERVICE_SAML)
+
+		t.Run("with LDAP sync", func(t *testing.T) {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				*cfg.SamlSettings.EnableSyncWithLdap = true
+			})
+			testCases := []imageTestCase{
+				{"profile picture attribute is set", true, false},
+				{"profile picture attribute is not set", false, true},
+			}
+			for _, testCase := range testCases {
+				doImageTest(t, th, user, testCase)
+			}
+		})
+		t.Run("without LDAP sync", func(t *testing.T) {
+			th.App.UpdateConfig(func(cfg *model.Config) {
+				*cfg.SamlSettings.EnableSyncWithLdap = false
+			})
+			testCases := []imageTestCase{
+				{"profile picture attribute is set", true, true},
+				{"profile picture attribute is not set", false, true},
+			}
+			for _, testCase := range testCases {
+				doImageTest(t, th, user, testCase)
+			}
+		})
+		doCleanup(t, th, user)
+	})
+}