[MM-56073] MMCTL delete post command (#27539)

Co-authored-by: Ben Schumacher <ben.schumacher@mattermost.com>
2024-10-08 10:45:31 -04:00
--- a/server/channels/api4/post.go
+++ b/server/channels/api4/post.go
@@ -626,13 +626,28 @@ func deletePost(c *Context, w http.ResponseWriter, _ *http.Request) {
 		return
 	}

+	permanent := c.Params.Permanent
+
 	auditRec := c.MakeAuditRecord("deletePost", audit.Fail)
 	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
 	audit.AddEventParameter(auditRec, "post_id", c.Params.PostId)
+	audit.AddEventParameter(auditRec, "permanent", permanent)

-	post, err := c.App.GetSinglePost(c.AppContext, c.Params.PostId, false)
-	if err != nil {
-		c.SetPermissionError(model.PermissionDeletePost)
+	includeDeleted := permanent
+
+	if permanent && !*c.App.Config().ServiceSettings.EnableAPIPostDeletion {
+		c.Err = model.NewAppError("deletePost", "api.post.delete_post.not_enabled.app_error", nil, "postId="+c.Params.PostId, http.StatusNotImplemented)
+		return
+	}
+
+	if permanent && !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
+		c.SetPermissionError(model.PermissionManageSystem)
+		return
+	}
+
+	post, appErr := c.App.GetSinglePost(c.AppContext, c.Params.PostId, includeDeleted)
+	if appErr != nil {
+		c.Err = appErr
 		return
 	}
 	auditRec.AddEventPriorState(post)
@@ -650,8 +665,14 @@ func deletePost(c *Context, w http.ResponseWriter, _ *http.Request) {
 		}
 	}

-	if _, err := c.App.DeletePost(c.AppContext, c.Params.PostId, c.AppContext.Session().UserId); err != nil {
-		c.Err = err
+	if permanent {
+		appErr = c.App.PermanentDeletePost(c.AppContext, c.Params.PostId, c.AppContext.Session().UserId)
+	} else {
+		_, appErr = c.App.DeletePost(c.AppContext, c.Params.PostId, c.AppContext.Session().UserId)
+	}
+
+	if appErr != nil {
+		c.Err = appErr
 		return
 	}

--- a/server/channels/api4/post_local.go
+++ b/server/channels/api4/post_local.go
@@ -3,10 +3,53 @@

 package api4

-import "net/http"
+import (
+	"net/http"
+
+	"github.com/mattermost/mattermost/server/v8/channels/app"
+	"github.com/mattermost/mattermost/server/v8/channels/audit"
+)

 func (api *API) InitPostLocal() {
 	api.BaseRoutes.Post.Handle("", api.APILocal(getPost)).Methods(http.MethodGet)
-
 	api.BaseRoutes.PostsForChannel.Handle("", api.APILocal(getPostsForChannel)).Methods(http.MethodGet)
+	api.BaseRoutes.Post.Handle("", api.APILocal(localDeletePost)).Methods(http.MethodDelete)
+}
+
+func localDeletePost(c *Context, w http.ResponseWriter, r *http.Request) {
+	c.RequirePostId()
+	if c.Err != nil {
+		return
+	}
+
+	permanent := c.Params.Permanent
+
+	auditRec := c.MakeAuditRecord("localDeletePost", audit.Fail)
+	defer c.LogAuditRecWithLevel(auditRec, app.LevelContent)
+	audit.AddEventParameter(auditRec, "post_id", c.Params.PostId)
+	audit.AddEventParameter(auditRec, "permanent", permanent)
+
+	includeDeleted := permanent
+
+	post, appErr := c.App.GetSinglePost(c.AppContext, c.Params.PostId, includeDeleted)
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+	auditRec.AddEventPriorState(post)
+	auditRec.AddEventObjectType("post")
+
+	if permanent {
+		appErr = c.App.PermanentDeletePost(c.AppContext, c.Params.PostId, c.AppContext.Session().UserId)
+	} else {
+		_, appErr = c.App.DeletePost(c.AppContext, c.Params.PostId, c.AppContext.Session().UserId)
+	}
+
+	if appErr != nil {
+		c.Err = appErr
+		return
+	}
+
+	auditRec.Success()
+	ReturnStatusOK(w)
 }
--- a/server/channels/api4/post_test.go
+++ b/server/channels/api4/post_test.go
@@ -2817,39 +2817,124 @@ func TestDeletePost(t *testing.T) {
 	defer th.TearDown()
 	client := th.Client

-	resp, err := client.DeletePost(context.Background(), "")
-	require.Error(t, err)
-	CheckNotFoundStatus(t, resp)
+	t.Run("Post not found", func(t *testing.T) {
+		resp, err := client.DeletePost(context.Background(), "")
+		require.Error(t, err)
+		CheckNotFoundStatus(t, resp)
+	})

-	resp, err = client.DeletePost(context.Background(), "junk")
-	require.Error(t, err)
-	CheckBadRequestStatus(t, resp)
+	t.Run("Post doesn't exist", func(t *testing.T) {
+		resp, err := client.DeletePost(context.Background(), "junk")
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})

-	resp, err = client.DeletePost(context.Background(), th.BasicPost.Id)
-	require.Error(t, err)
-	CheckForbiddenStatus(t, resp)
+	t.Run("No permissions to delete a post", func(t *testing.T) {
+		resp, err := client.DeletePost(context.Background(), th.BasicPost.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})

-	client.Login(context.Background(), th.TeamAdminUser.Email, th.TeamAdminUser.Password)
-	_, err = client.DeletePost(context.Background(), th.BasicPost.Id)
-	require.NoError(t, err)
+	t.Run("Try to delete a post across different user roles", func(t *testing.T) {
+		client.Login(context.Background(), th.TeamAdminUser.Email, th.TeamAdminUser.Password)
+		_, cErr := client.DeletePost(context.Background(), th.BasicPost.Id)
+		require.NoError(t, cErr)

-	post := th.CreatePost()
-	user := th.CreateUser()
+		post := th.CreatePost()
+		post2 := th.CreatePost()
+		user := th.CreateUser()

-	client.Logout(context.Background())
-	client.Login(context.Background(), user.Email, user.Password)
+		client.Logout(context.Background())
+		client.Login(context.Background(), user.Email, user.Password)

-	resp, err = client.DeletePost(context.Background(), post.Id)
-	require.Error(t, err)
-	CheckForbiddenStatus(t, resp)
+		resp, err := client.DeletePost(context.Background(), post.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)

-	client.Logout(context.Background())
-	resp, err = client.DeletePost(context.Background(), model.NewId())
-	require.Error(t, err)
-	CheckUnauthorizedStatus(t, resp)
+		client.Logout(context.Background())
+		resp, err = client.DeletePost(context.Background(), model.NewId())
+		require.Error(t, err)
+		CheckUnauthorizedStatus(t, resp)

-	_, err = th.SystemAdminClient.DeletePost(context.Background(), post.Id)
-	require.NoError(t, err)
+		_, err = th.SystemAdminClient.DeletePost(context.Background(), post.Id)
+		require.NoError(t, err)
+
+		_, err = th.LocalClient.DeletePost(context.Background(), post2.Id)
+		require.NoError(t, err)
+	})
+}
+
+func TestPermanentDeletePost(t *testing.T) {
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+	client := th.Client
+
+	enableAPIPostDeletion := *th.App.Config().ServiceSettings.EnableAPIPostDeletion
+	defer func() {
+		th.App.UpdateConfig(func(cfg *model.Config) { cfg.ServiceSettings.EnableAPIPostDeletion = &enableAPIPostDeletion })
+	}()
+
+	th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPIPostDeletion = false })
+
+	t.Run("Post not found", func(t *testing.T) {
+		resp, err := client.PermanentDeletePost(context.Background(), "")
+		require.Error(t, err)
+		CheckNotFoundStatus(t, resp)
+	})
+
+	t.Run("Post doesn't exist", func(t *testing.T) {
+		resp, err := client.PermanentDeletePost(context.Background(), "junk")
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("Permanent deletion not available through API if EnableAPIPostDeletion is not set", func(t *testing.T) {
+		resp, err := th.SystemAdminClient.PermanentDeletePost(context.Background(), th.BasicPost.Id)
+		require.Error(t, err)
+		CheckNotImplementedStatus(t, resp)
+	})
+
+	t.Run("Permanent deletion available through local mode even if EnableAPIPostDeletion is not set", func(t *testing.T) {
+		post := th.CreatePost()
+		_, err := th.LocalClient.PermanentDeletePost(context.Background(), post.Id)
+		require.NoError(t, err)
+	})
+
+	t.Run("No permissions to permanently delete a post", func(t *testing.T) {
+		th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.EnableAPIPostDeletion = true })
+		resp, err := client.PermanentDeletePost(context.Background(), th.BasicPost.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("Try to permanently delete a post across different user roles", func(t *testing.T) {
+		client.Login(context.Background(), th.TeamAdminUser.Email, th.TeamAdminUser.Password)
+		resp, err := client.PermanentDeletePost(context.Background(), th.BasicPost.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+
+		post := th.CreatePost()
+		post2 := th.CreatePost()
+		user := th.CreateUser()
+
+		client.Logout(context.Background())
+		client.Login(context.Background(), user.Email, user.Password)
+
+		resp, err = client.PermanentDeletePost(context.Background(), post.Id)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+
+		client.Logout(context.Background())
+		resp, err = client.PermanentDeletePost(context.Background(), post.Id)
+		require.Error(t, err)
+		CheckUnauthorizedStatus(t, resp)
+
+		_, err = th.SystemAdminClient.PermanentDeletePost(context.Background(), post.Id)
+		require.NoError(t, err)
+
+		_, err = th.LocalClient.PermanentDeletePost(context.Background(), post2.Id)
+		require.NoError(t, err)
+	})
 }

 func TestDeletePostEvent(t *testing.T) {