From 8694b78cc8c32d1f17f6bafde7c976c2997eea84 Mon Sep 17 00:00:00 2001 From: Nick Misasi Date: Thu, 5 Sep 2024 14:28:51 -0400 Subject: [PATCH] [CLD-8304] Return 501 if not a cloud license accessing IP Filtering (#28093) * Return 501 if not a cloud license accessing IP Filtering * Changes for PR feedback --- server/channels/api4/ip_filtering.go | 2 +- server/channels/api4/ip_filtering_test.go | 87 +++++++++-------------- 2 files changed, 34 insertions(+), 55 deletions(-) diff --git a/server/channels/api4/ip_filtering.go b/server/channels/api4/ip_filtering.go index b055a6cf86..a7c45cef66 100644 --- a/server/channels/api4/ip_filtering.go +++ b/server/channels/api4/ip_filtering.go @@ -20,7 +20,7 @@ func (api *API) InitIPFiltering() { } func ensureIPFilteringInterface(c *Context, where string) (einterfaces.IPFilteringInterface, bool) { - if c.App.IPFiltering() == nil || !c.App.Config().FeatureFlags.CloudIPFiltering || c.App.License() == nil || c.App.License().SkuShortName != model.LicenseShortSkuEnterprise { + if c.App.IPFiltering() == nil || !c.App.Config().FeatureFlags.CloudIPFiltering || c.App.License() == nil || !c.App.License().IsCloud() || c.App.License().SkuShortName != model.LicenseShortSkuEnterprise { c.Err = model.NewAppError(where, "api.context.ip_filtering.not_available.app_error", nil, "", http.StatusNotImplemented) return nil, false } diff --git a/server/channels/api4/ip_filtering_test.go b/server/channels/api4/ip_filtering_test.go index 9338ffd264..23827d311e 100644 --- a/server/channels/api4/ip_filtering_test.go +++ b/server/channels/api4/ip_filtering_test.go @@ -30,16 +30,11 @@ func Test_getIPFilters(t *testing.T) { } t.Run("No license returns 501", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().RemoveLicense() @@ -59,10 +54,6 @@ func Test_getIPFilters(t *testing.T) { defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic) @@ -76,16 +67,11 @@ func Test_getIPFilters(t *testing.T) { }) t.Run("Feature flag and license but no permission", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic) @@ -99,8 +85,7 @@ func Test_getIPFilters(t *testing.T) { }) t.Run("Feature flag and license and permission", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() @@ -111,10 +96,6 @@ func Test_getIPFilters(t *testing.T) { Description: "test", }, }, nil) - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic) @@ -126,6 +107,32 @@ func Test_getIPFilters(t *testing.T) { require.NotNil(t, ipFilters) require.Equal(t, 200, r.StatusCode) }) + + t.Run("Feature flag and license and permission but not cloud returns 503", func(t *testing.T) { + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") + th := Setup(t).InitBasic() + defer th.TearDown() + + ipFiltering := &mocks.IPFilteringInterface{} + ipFiltering.Mock.On("GetIPFilters").Return(&model.AllowedIPRanges{ + model.AllowedIPRange{ + CIDRBlock: "127.0.0.1/32", + Description: "test", + }, + }, nil) + th.App.Srv().IPFiltering = ipFiltering + + lic.Features.Cloud = model.NewPointer(false) + + th.App.Srv().SetLicense(lic) + + th.Client.Login(context.Background(), th.SystemAdminUser.Email, th.SystemAdminUser.Password) + + ipFilters, r, err := th.Client.GetIPFilters(context.Background()) + require.Error(t, err) + require.Nil(t, ipFilters) + require.Equal(t, 501, r.StatusCode) + }) } func Test_applyIPFilters(t *testing.T) { @@ -141,16 +148,11 @@ func Test_applyIPFilters(t *testing.T) { // Initialize the allowedRanges variable t.Run("No license returns 501", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().RemoveLicense() @@ -170,10 +172,6 @@ func Test_applyIPFilters(t *testing.T) { defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic) @@ -186,18 +184,13 @@ func Test_applyIPFilters(t *testing.T) { }) t.Run("feature flag and license but no permission", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() th.Client.Login(context.Background(), th.BasicUser.Email, th.BasicUser.Password) ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic) @@ -208,8 +201,7 @@ func Test_applyIPFilters(t *testing.T) { }) t.Run("Feature flag and license and permission", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() @@ -222,10 +214,6 @@ func Test_applyIPFilters(t *testing.T) { Description: "test", }, }, nil) - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering cloud := &mocks.CloudInterface{} @@ -260,16 +248,11 @@ func Test_getMyIP(t *testing.T) { ExpiresAt: model.GetMillis() + 100000, } t.Run("No license returns 501", func(t *testing.T) { - os.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") - defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDIPFILTERING") + t.Setenv("MM_FEATUREFLAGS_CLOUDIPFILTERING", "true") th := Setup(t).InitBasic() defer th.TearDown() ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().RemoveLicense() @@ -291,10 +274,6 @@ func Test_getMyIP(t *testing.T) { th.Client.Login(context.Background(), th.BasicUser.Email, th.BasicUser.Password) ipFiltering := &mocks.IPFilteringInterface{} - ipFilteringImpl := th.App.Srv().IPFiltering - defer func() { - th.App.Srv().IPFiltering = ipFilteringImpl - }() th.App.Srv().IPFiltering = ipFiltering th.App.Srv().SetLicense(lic)