From 7fb6901ad1f294d20987b8544073afb64d3be8a9 Mon Sep 17 00:00:00 2001 From: Miguel de la Cruz Date: Thu, 23 Jan 2025 09:50:43 +0100 Subject: [PATCH] Adds Custom Profile Attributes API endpoints license check (#29906) * Adds Custom Profile Attributes feature license and API endpoints check * Fix linter * Remove the specific license feature and fallback to checking for license presence * Add translation * Update the checks and tests to enable endpoints only for Enterprise licenses --------- Co-authored-by: Mattermost Build --- .../api4/custom_profile_attributes.go | 30 +++++++ .../api4/custom_profile_attributes_test.go | 84 +++++++++++++++++-- server/i18n/en.json | 4 + 3 files changed, 109 insertions(+), 9 deletions(-) diff --git a/server/channels/api4/custom_profile_attributes.go b/server/channels/api4/custom_profile_attributes.go index c2e23a371e..870e935348 100644 --- a/server/channels/api4/custom_profile_attributes.go +++ b/server/channels/api4/custom_profile_attributes.go @@ -25,6 +25,11 @@ func (api *API) InitCustomProfileAttributes() { } func listCPAFields(c *Context, w http.ResponseWriter, r *http.Request) { + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.listCPAFields", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + fields, appErr := c.App.ListCPAFields() if appErr != nil { c.Err = appErr @@ -42,6 +47,11 @@ func createCPAField(c *Context, w http.ResponseWriter, r *http.Request) { return } + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.createCPAField", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + var pf *model.PropertyField err := json.NewDecoder(r.Body).Decode(&pf) if err != nil || pf == nil { @@ -77,6 +87,11 @@ func patchCPAField(c *Context, w http.ResponseWriter, r *http.Request) { return } + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.patchCPAField", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + c.RequireFieldId() if c.Err != nil { return @@ -124,6 +139,11 @@ func deleteCPAField(c *Context, w http.ResponseWriter, r *http.Request) { return } + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.deleteCPAField", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + c.RequireFieldId() if c.Err != nil { return @@ -153,6 +173,11 @@ func deleteCPAField(c *Context, w http.ResponseWriter, r *http.Request) { } func patchCPAValues(c *Context, w http.ResponseWriter, r *http.Request) { + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.patchCPAValues", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + var attributeValues map[string]string if jsonErr := json.NewDecoder(r.Body).Decode(&attributeValues); jsonErr != nil { c.SetInvalidParamWithErr("attrs", jsonErr) @@ -190,6 +215,11 @@ func patchCPAValues(c *Context, w http.ResponseWriter, r *http.Request) { } func listCPAValues(c *Context, w http.ResponseWriter, r *http.Request) { + if c.App.Channels().License() == nil || !c.App.Channels().License().IsE20OrEnterprise() { + c.Err = model.NewAppError("Api4.listCPAValues", "api.custom_profile_attributes.license_error", nil, "", http.StatusForbidden) + return + } + c.RequireUserId() if c.Err != nil { return diff --git a/server/channels/api4/custom_profile_attributes_test.go b/server/channels/api4/custom_profile_attributes_test.go index ca77204bae..ba63fa879a 100644 --- a/server/channels/api4/custom_profile_attributes_test.go +++ b/server/channels/api4/custom_profile_attributes_test.go @@ -19,6 +19,19 @@ func TestCreateCPAField(t *testing.T) { th := Setup(t) defer th.TearDown() + th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) { + field := &model.PropertyField{Name: model.NewId(), Type: model.PropertyFieldTypeText} + + createdField, resp, err := client.CreateCPAField(context.Background(), field) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + require.Empty(t, createdField) + }, "endpoint should not work if no valid license is present") + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) + t.Run("a user without admin permissions should not be able to create a field", func(t *testing.T) { field := &model.PropertyField{ Name: model.NewId(), @@ -67,10 +80,22 @@ func TestListCPAFields(t *testing.T) { Type: model.PropertyFieldTypeText, Attrs: map[string]any{"visibility": "default"}, } - createdField, _, err := th.SystemAdminClient.CreateCPAField(context.Background(), field) - require.NoError(t, err) + + createdField, err := th.App.CreateCPAField(field) + require.Nil(t, err) require.NotNil(t, createdField) + t.Run("endpoint should not work if no valid license is present", func(t *testing.T) { + fields, resp, err := th.Client.ListCPAFields(context.Background()) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + require.Empty(t, fields) + }) + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) + t.Run("any user should be able to list fields", func(t *testing.T) { fields, resp, err := th.Client.ListCPAFields(context.Background()) CheckOKStatus(t, resp) @@ -95,6 +120,18 @@ func TestPatchCPAField(t *testing.T) { th := Setup(t) defer th.TearDown() + th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) { + patch := &model.PropertyFieldPatch{Name: model.NewPointer(model.NewId())} + patchedField, resp, err := client.PatchCPAField(context.Background(), model.NewId(), patch) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + require.Empty(t, patchedField) + }, "endpoint should not work if no valid license is present") + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) + t.Run("a user without admin permissions should not be able to patch a field", func(t *testing.T) { field := &model.PropertyField{ Name: model.NewId(), @@ -134,6 +171,16 @@ func TestDeleteCPAField(t *testing.T) { th := Setup(t) defer th.TearDown() + th.TestForSystemAdminAndLocal(t, func(t *testing.T, client *model.Client4) { + resp, err := client.DeleteCPAField(context.Background(), model.NewId()) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + }, "endpoint should not work if no valid license is present") + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) + t.Run("a user without admin permissions should not be able to delete a field", func(t *testing.T) { field := &model.PropertyField{ Name: model.NewId(), @@ -175,9 +222,7 @@ func TestListCPAValues(t *testing.T) { defer th.TearDown() th.RemovePermissionFromRole(model.PermissionViewMembers.Id, model.SystemUserRoleId) - defer func() { - th.AddPermissionToRole(model.PermissionViewMembers.Id, model.SystemUserRoleId) - }() + defer th.AddPermissionToRole(model.PermissionViewMembers.Id, model.SystemUserRoleId) field := &model.PropertyField{ Name: model.NewId(), @@ -187,10 +232,19 @@ func TestListCPAValues(t *testing.T) { require.Nil(t, appErr) require.NotNil(t, createdField) - values := map[string]string{} - values[createdField.ID] = "Field Value" - _, _, err := th.Client.PatchCPAValues(context.Background(), values) - require.NoError(t, err) + _, appErr = th.App.PatchCPAValue(th.BasicUser.Id, createdField.ID, "Field Value") + require.Nil(t, appErr) + + t.Run("endpoint should not work if no valid license is present", func(t *testing.T) { + values, resp, err := th.Client.ListCPAValues(context.Background(), th.BasicUser.Id) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + require.Empty(t, values) + }) + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) // login with Client2 from this point on th.LoginBasic2() @@ -228,6 +282,18 @@ func TestPatchCPAValues(t *testing.T) { require.Nil(t, appErr) require.NotNil(t, createdField) + t.Run("endpoint should not work if no valid license is present", func(t *testing.T) { + values := map[string]string{createdField.ID: "Field Value"} + patchedValues, resp, err := th.Client.PatchCPAValues(context.Background(), values) + CheckForbiddenStatus(t, resp) + require.Error(t, err) + CheckErrorID(t, err, "api.custom_profile_attributes.license_error") + require.Empty(t, patchedValues) + }) + + // add a valid license + th.App.Srv().SetLicense(model.NewTestLicenseSKU(model.LicenseShortSkuEnterprise)) + t.Run("any team member should be able to create their own values", func(t *testing.T) { values := map[string]string{} value := "Field Value" diff --git a/server/i18n/en.json b/server/i18n/en.json index 2bd1499432..42fd0d0dc9 100644 --- a/server/i18n/en.json +++ b/server/i18n/en.json @@ -1837,6 +1837,10 @@ "id": "api.custom_groups.no_remote_id", "translation": "remote_id must be blank for custom group" }, + { + "id": "api.custom_profile_attributes.license_error", + "translation": "Your license does not support Custom Profile Attributes." + }, { "id": "api.custom_status.disabled", "translation": "Custom status feature has been disabled. Please contact your system administrator for details."