Custom profile attributes field endpoints (#29662)

* Adds the main Property System Architecture components This change adds the necessary migrations for the Property Groups, Fields and Values tables to be created, the store layer and a Property Service that can be used from the app layer. * Adds Custom Profile Attributes endpoints and app layer * implement get and patch cpa values * run i18n-extract * Update property field type to use user instead of person * Update PropertyFields to allow for unique nondeleted fields and remove redundant indexes * Update PropertyValues to allow for unique nondeleted fields and remove redundant indexes * Use StringMap instead of the map[string]any on property fields * Add i18n strings * Revert "Use StringMap instead of the map[string]any on property fields" This reverts commit e2735ab0f8589d2524d636419ca0cb144575c4d6. * Cast JSON binary data to string and add todo note for StringMap use * Add mocks to the retrylayer tests * Cast JSON binary data to string in property value store * Check for binary parameter instead of casting to string for JSON data * Fix bad merge * Check property field type is one of the allowed ones * Avoid reusing err variable to be explicit about the returned value * Merge Property System Migrations into one file * Adds NOT NULL to timestamps at the DB level * Update stores to use tableSelectQuery instead of a slice var * Update PropertyField model translations to be more explicit and avoid repetition * Update PropertyValue model translations to be more explicit and avoid repetition * Use ExecBuilder instead of ToSql&Exec * Update property field errors to add context * Ensure PerPage is greater than zero * Update store errors to give more context * Use ExecBuilder in the property stores where possible * Add an on conflict suffix to the group register to avoid race conditions * Remove user profile API documentation changes * Update patchCPAValues endpoint and docs to return the updated information * Merge two similar error conditions * Use a route function for ListCPAValues * Remove badly used translation string * Remove unused get in register group method * Adds input sanitization and validation to the CPA API endpoints * Takes login outside of one test case to make it clear it affects multiple t.Runs * Fix wrap error and return code when property field has been deleted * Fix receiver name * Adds comment to move the CPA group ID to the db cache * Set the PerPage of CPA fields to the fields limit * Update server/channels/app/custom_profile_attributes_test.go Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com> * Standardize group ID access * Avoid polluting the state between tests * Use specific errors for the retrieval of CPA group --------- Co-authored-by: Scott Bishel <scott.bishel@mattermost.com> Co-authored-by: Mattermost Build <build@mattermost.com> Co-authored-by: Alejandro García Montoro <alejandro.garciamontoro@gmail.com>
2025-01-13 18:12:38 +01:00
--- a/server/channels/app/app_iface.go
+++ b/server/channels/app/app_iface.go
@@ -513,6 +513,7 @@ type AppIface interface {
 	CountNotification(notificationType model.NotificationType, platform string)
 	CountNotificationAck(notificationType model.NotificationType, platform string)
 	CountNotificationReason(notificationStatus model.NotificationStatus, notificationType model.NotificationType, notificationReason model.NotificationReason, platform string)
+	CreateCPAField(field *model.PropertyField) (*model.PropertyField, *model.AppError)
 	CreateChannel(c request.CTX, channel *model.Channel, addMember bool) (*model.Channel, *model.AppError)
 	CreateChannelBookmark(c request.CTX, newBookmark *model.ChannelBookmark, connectionId string) (*model.ChannelBookmarkWithFileInfo, *model.AppError)
 	CreateChannelWithUser(c request.CTX, channel *model.Channel, userID string) (*model.Channel, *model.AppError)
@@ -560,6 +561,7 @@ type AppIface interface {
 	DeleteAllExpiredPluginKeys() *model.AppError
 	DeleteAllKeysForPlugin(pluginID string) *model.AppError
 	DeleteBrandImage(rctx request.CTX) *model.AppError
+	DeleteCPAField(id string) *model.AppError
 	DeleteChannel(c request.CTX, channel *model.Channel, userID string) *model.AppError
 	DeleteChannelBookmark(bookmarkId, connectionId string) (*model.ChannelBookmarkWithFileInfo, *model.AppError)
 	DeleteCommand(commandID string) *model.AppError
@@ -643,6 +645,8 @@ type AppIface interface {
 	GetBookmark(bookmarkId string, includeDeleted bool) (*model.ChannelBookmarkWithFileInfo, *model.AppError)
 	GetBrandImage(rctx request.CTX) ([]byte, *model.AppError)
 	GetBulkReactionsForPosts(postIDs []string) (map[string][]*model.Reaction, *model.AppError)
+	GetCPAField(fieldID string) (*model.PropertyField, *model.AppError)
+	GetCPAValue(valueID string) (*model.PropertyValue, *model.AppError)
 	GetChannel(c request.CTX, channelID string) (*model.Channel, *model.AppError)
 	GetChannelBookmarks(channelId string, since int64) ([]*model.ChannelBookmarkWithFileInfo, *model.AppError)
 	GetChannelByName(c request.CTX, channelName, teamID string, includeDeleted bool) (*model.Channel, *model.AppError)
@@ -948,6 +952,8 @@ type AppIface interface {
 	License() *model.License
 	LimitedClientConfig() map[string]string
 	ListAllCommands(teamID string, T i18n.TranslateFunc) ([]*model.Command, *model.AppError)
+	ListCPAFields() ([]*model.PropertyField, *model.AppError)
+	ListCPAValues(userID string) ([]*model.PropertyValue, *model.AppError)
 	ListDirectory(path string) ([]string, *model.AppError)
 	ListDirectoryRecursively(path string) ([]string, *model.AppError)
 	ListExportDirectory(path string) ([]string, *model.AppError)
@@ -973,6 +979,8 @@ type AppIface interface {
 	OpenInteractiveDialog(c request.CTX, request model.OpenDialogRequest) *model.AppError
 	OriginChecker() func(*http.Request) bool
 	OutgoingOAuthConnections() einterfaces.OutgoingOAuthConnectionInterface
+	PatchCPAField(fieldID string, patch *model.PropertyFieldPatch) (*model.PropertyField, *model.AppError)
+	PatchCPAValue(userID string, fieldID string, value string) (*model.PropertyValue, *model.AppError)
 	PatchChannel(c request.CTX, channel *model.Channel, patch *model.ChannelPatch, userID string) (*model.Channel, *model.AppError)
 	PatchChannelMembersNotifyProps(c request.CTX, members []*model.ChannelMemberIdentifier, notifyProps map[string]string) ([]*model.ChannelMember, *model.AppError)
 	PatchPost(c request.CTX, postID string, patch *model.PostPatch, patchPostOptions *model.UpdatePostOptions) (*model.Post, *model.AppError)
--- a/server/channels/app/custom_profile_attributes.go
+++ b/server/channels/app/custom_profile_attributes.go
@@ -0,0 +1,240 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"net/http"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/mattermost/mattermost/server/v8/channels/store"
+	"github.com/pkg/errors"
+)
+
+const CustomProfileAttributesFieldLimit = 20
+
+var cpaGroupID string
+
+// ToDo: we should explore moving this to the database cache layer
+// instead of maintaining the ID cached at the application level
+func (a *App) cpaGroupID() (string, error) {
+	if cpaGroupID != "" {
+		return cpaGroupID, nil
+	}
+
+	cpaGroup, err := a.Srv().propertyService.RegisterPropertyGroup(model.CustomProfileAttributesPropertyGroupName)
+	if err != nil {
+		return "", errors.Wrap(err, "cannot register Custom Profile Attributes property group")
+	}
+	cpaGroupID = cpaGroup.ID
+
+	return cpaGroupID, nil
+}
+
+func (a *App) GetCPAField(fieldID string) (*model.PropertyField, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("GetCPAField", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	field, err := a.Srv().propertyService.GetPropertyField(fieldID)
+	if err != nil {
+		return nil, model.NewAppError("GetCPAField", "app.custom_profile_attributes.get_property_field.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	if field.GroupID != groupID {
+		return nil, model.NewAppError("GetCPAField", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound)
+	}
+
+	return field, nil
+}
+
+func (a *App) ListCPAFields() ([]*model.PropertyField, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("GetCPAFields", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	opts := model.PropertyFieldSearchOpts{
+		GroupID: groupID,
+		Page:    0,
+		PerPage: CustomProfileAttributesFieldLimit,
+	}
+
+	fields, err := a.Srv().propertyService.SearchPropertyFields(opts)
+	if err != nil {
+		return nil, model.NewAppError("GetCPAFields", "app.custom_profile_attributes.search_property_fields.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	return fields, nil
+}
+
+func (a *App) CreateCPAField(field *model.PropertyField) (*model.PropertyField, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("CreateCPAField", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	existingFields, appErr := a.ListCPAFields()
+	if appErr != nil {
+		return nil, appErr
+	}
+
+	if len(existingFields) >= CustomProfileAttributesFieldLimit {
+		return nil, model.NewAppError("CreateCPAField", "app.custom_profile_attributes.limit_reached.app_error", nil, "", http.StatusUnprocessableEntity).Wrap(err)
+	}
+
+	field.GroupID = groupID
+	newField, err := a.Srv().propertyService.CreatePropertyField(field)
+	if err != nil {
+		var appErr *model.AppError
+		switch {
+		case errors.As(err, &appErr):
+			return nil, appErr
+		default:
+			return nil, model.NewAppError("CreateCPAField", "app.custom_profile_attributes.create_property_field.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+
+	return newField, nil
+}
+
+func (a *App) PatchCPAField(fieldID string, patch *model.PropertyFieldPatch) (*model.PropertyField, *model.AppError) {
+	existingField, appErr := a.GetCPAField(fieldID)
+	if appErr != nil {
+		return nil, appErr
+	}
+
+	// custom profile attributes doesn't use targets
+	patch.TargetID = nil
+	patch.TargetType = nil
+	existingField.Patch(patch)
+
+	patchedField, err := a.Srv().propertyService.UpdatePropertyField(existingField)
+	if err != nil {
+		var nfErr *store.ErrNotFound
+		switch {
+		case errors.As(err, &nfErr):
+			return nil, model.NewAppError("UpdateCPAField", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound).Wrap(err)
+		default:
+			return nil, model.NewAppError("UpdateCPAField", "app.custom_profile_attributes.property_field_update.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+
+	return patchedField, nil
+}
+
+func (a *App) DeleteCPAField(id string) *model.AppError {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return model.NewAppError("DeleteCPAField", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	existingField, err := a.Srv().propertyService.GetPropertyField(id)
+	if err != nil {
+		return model.NewAppError("DeleteCPAField", "app.custom_profile_attributes.get_property_field.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	if existingField.GroupID != groupID {
+		return model.NewAppError("DeleteCPAField", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound)
+	}
+
+	if err := a.Srv().propertyService.DeletePropertyField(id); err != nil {
+		var nfErr *store.ErrNotFound
+		switch {
+		case errors.As(err, &nfErr):
+			return model.NewAppError("DeleteCPAField", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound).Wrap(err)
+		default:
+			return model.NewAppError("DeleteCPAField", "app.custom_profile_attributes.property_field_delete.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+
+	return nil
+}
+
+func (a *App) ListCPAValues(userID string) ([]*model.PropertyValue, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("GetCPAFields", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	opts := model.PropertyValueSearchOpts{
+		GroupID:        groupID,
+		TargetID:       userID,
+		Page:           0,
+		PerPage:        999999,
+		IncludeDeleted: false,
+	}
+	fields, err := a.Srv().propertyService.SearchPropertyValues(opts)
+	if err != nil {
+		return nil, model.NewAppError("ListCPAValues", "app.custom_profile_attributes.list_property_values.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	return fields, nil
+}
+
+func (a *App) GetCPAValue(valueID string) (*model.PropertyValue, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("GetCPAValue", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	value, err := a.Srv().propertyService.GetPropertyValue(valueID)
+	if err != nil {
+		return nil, model.NewAppError("GetCPAValue", "app.custom_profile_attributes.get_property_field.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	if value.GroupID != groupID {
+		return nil, model.NewAppError("GetCPAValue", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound)
+	}
+
+	return value, nil
+}
+
+func (a *App) PatchCPAValue(userID string, fieldID string, value string) (*model.PropertyValue, *model.AppError) {
+	groupID, err := a.cpaGroupID()
+	if err != nil {
+		return nil, model.NewAppError("PatchCPAValues", "app.custom_profile_attributes.cpa_group_id.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+	}
+
+	// make sure field exists in this group
+	existingField, appErr := a.GetCPAField(fieldID)
+	if appErr != nil {
+		return nil, model.NewAppError("PatchCPAValue", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound).Wrap(appErr)
+	} else if existingField.DeleteAt > 0 {
+		return nil, model.NewAppError("PatchCPAValue", "app.custom_profile_attributes.property_field_not_found.app_error", nil, "", http.StatusNotFound)
+	}
+
+	existingValues, appErr := a.ListCPAValues(userID)
+	if appErr != nil {
+		return nil, model.NewAppError("PatchCPAValue", "app.custom_profile_attributes.property_value_list.app_error", nil, "", http.StatusNotFound).Wrap(err)
+	}
+	var existingValue *model.PropertyValue
+	for key, value := range existingValues {
+		if value.FieldID == fieldID {
+			existingValue = existingValues[key]
+			break
+		}
+	}
+
+	if existingValue != nil {
+		existingValue.Value = value
+		_, err = a.ch.srv.propertyService.UpdatePropertyValue(existingValue)
+		if err != nil {
+			return nil, model.NewAppError("PatchCPAValue", "app.custom_profile_attributes.property_value_update.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	} else {
+		propertyValue := &model.PropertyValue{
+			GroupID:    groupID,
+			TargetType: "user",
+			TargetID:   userID,
+			FieldID:    fieldID,
+			Value:      value,
+		}
+		existingValue, err = a.ch.srv.propertyService.CreatePropertyValue(propertyValue)
+		if err != nil {
+			return nil, model.NewAppError("PatchCPAValue", "app.custom_profile_attributes.property_value_creation.app_error", nil, "", http.StatusInternalServerError).Wrap(err)
+		}
+	}
+	return existingValue, nil
+}
--- a/server/channels/app/custom_profile_attributes_test.go
+++ b/server/channels/app/custom_profile_attributes_test.go
@@ -0,0 +1,462 @@
+// Copyright (c) 2015-present Mattermost, Inc. All Rights Reserved.
+// See LICENSE.txt for license information.
+
+package app
+
+import (
+	"fmt"
+	"net/http"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/mattermost/mattermost/server/public/model"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetCPAField(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	t.Run("should fail when getting a non-existent field", func(t *testing.T) {
+		field, err := th.App.GetCPAField(model.NewId())
+		require.NotNil(t, err)
+		require.Equal(t, "app.custom_profile_attributes.get_property_field.app_error", err.Id)
+		require.Empty(t, field)
+	})
+
+	t.Run("should fail when getting a field from a different group", func(t *testing.T) {
+		field := &model.PropertyField{
+			GroupID: model.NewId(),
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+		createdField, err := th.App.Srv().propertyService.CreatePropertyField(field)
+		require.NoError(t, err)
+
+		fetchedField, appErr := th.App.GetCPAField(createdField.ID)
+		require.NotNil(t, appErr)
+		require.Equal(t, "app.custom_profile_attributes.property_field_not_found.app_error", appErr.Id)
+		require.Empty(t, fetchedField)
+	})
+
+	t.Run("should get an existing CPA field", func(t *testing.T) {
+		field := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    "Test Field",
+			Type:    model.PropertyFieldTypeText,
+			Attrs:   map[string]any{"visibility": "hidden"},
+		}
+
+		createdField, err := th.App.CreateCPAField(field)
+		require.Nil(t, err)
+		require.NotEmpty(t, createdField.ID)
+
+		fetchedField, err := th.App.GetCPAField(createdField.ID)
+		require.Nil(t, err)
+		require.Equal(t, createdField.ID, fetchedField.ID)
+		require.Equal(t, "Test Field", fetchedField.Name)
+		require.Equal(t, map[string]any{"visibility": "hidden"}, fetchedField.Attrs)
+	})
+}
+
+func TestListCPAFields(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	t.Run("should list the CPA property fields", func(t *testing.T) {
+		field1 := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    "Field 1",
+			Type:    model.PropertyFieldTypeText,
+		}
+
+		_, err := th.App.Srv().propertyService.CreatePropertyField(field1)
+		require.NoError(t, err)
+
+		field2 := &model.PropertyField{
+			GroupID: model.NewId(),
+			Name:    "Field 2",
+			Type:    model.PropertyFieldTypeText,
+		}
+		_, err = th.App.Srv().propertyService.CreatePropertyField(field2)
+		require.NoError(t, err)
+
+		field3 := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    "Field 3",
+			Type:    model.PropertyFieldTypeText,
+		}
+		_, err = th.App.Srv().propertyService.CreatePropertyField(field3)
+		require.NoError(t, err)
+
+		fields, appErr := th.App.ListCPAFields()
+		require.Nil(t, appErr)
+		require.Len(t, fields, 2)
+
+		fieldNames := []string{}
+		for _, field := range fields {
+			fieldNames = append(fieldNames, field.Name)
+		}
+		require.ElementsMatch(t, []string{"Field 1", "Field 3"}, fieldNames)
+	})
+}
+
+func TestCreateCPAField(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	t.Run("should fail if the field is not valid", func(t *testing.T) {
+		field := &model.PropertyField{Name: model.NewId()}
+
+		createdField, err := th.App.CreateCPAField(field)
+		require.NotNil(t, err)
+		require.Empty(t, createdField)
+	})
+
+	t.Run("should not be able to create a property field for a different feature", func(t *testing.T) {
+		field := &model.PropertyField{
+			GroupID: model.NewId(),
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+
+		createdField, appErr := th.App.CreateCPAField(field)
+		require.Nil(t, appErr)
+		require.Equal(t, cpaGroupID, createdField.GroupID)
+	})
+
+	t.Run("should correctly create a CPA field", func(t *testing.T) {
+		field := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+			Attrs:   map[string]any{"visibility": "hidden"},
+		}
+
+		createdField, err := th.App.CreateCPAField(field)
+		require.Nil(t, err)
+		require.NotZero(t, createdField.ID)
+		require.Equal(t, cpaGroupID, createdField.GroupID)
+		require.Equal(t, map[string]any{"visibility": "hidden"}, createdField.Attrs)
+
+		fetchedField, gErr := th.App.Srv().propertyService.GetPropertyField(createdField.ID)
+		require.NoError(t, gErr)
+		require.Equal(t, field.Name, fetchedField.Name)
+		require.NotZero(t, fetchedField.CreateAt)
+		require.Equal(t, fetchedField.CreateAt, fetchedField.UpdateAt)
+	})
+
+	// reset the server at this point to avoid polluting the state
+	th.TearDown()
+
+	t.Run("CPA should honor the field limit", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		t.Run("should not be able to create CPA fields above the limit", func(t *testing.T) {
+			// we create the rest of the fields required to reach the limit
+			for i := 1; i <= CustomProfileAttributesFieldLimit; i++ {
+				field := &model.PropertyField{
+					Name: model.NewId(),
+					Type: model.PropertyFieldTypeText,
+				}
+				createdField, err := th.App.CreateCPAField(field)
+				require.Nil(t, err)
+				require.NotZero(t, createdField.ID)
+			}
+
+			// then, we create a last one that would exceed the limit
+			field := &model.PropertyField{
+				Name: model.NewId(),
+				Type: model.PropertyFieldTypeText,
+			}
+			createdField, err := th.App.CreateCPAField(field)
+			require.NotNil(t, err)
+			require.Equal(t, http.StatusUnprocessableEntity, err.StatusCode)
+			require.Zero(t, createdField)
+		})
+
+		t.Run("deleted fields should not count for the limit", func(t *testing.T) {
+			// we retrieve the list of fields and check we've reached the limit
+			fields, err := th.App.ListCPAFields()
+			require.Nil(t, err)
+			require.Len(t, fields, CustomProfileAttributesFieldLimit)
+
+			// then we delete one field
+			require.Nil(t, th.App.DeleteCPAField(fields[0].ID))
+
+			// creating a new one should work now
+			field := &model.PropertyField{
+				Name: model.NewId(),
+				Type: model.PropertyFieldTypeText,
+			}
+			createdField, err := th.App.CreateCPAField(field)
+			require.Nil(t, err)
+			require.NotZero(t, createdField.ID)
+		})
+	})
+}
+
+func TestPatchCPAField(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	newField := &model.PropertyField{
+		GroupID: cpaGroupID,
+		Name:    model.NewId(),
+		Type:    model.PropertyFieldTypeText,
+		Attrs:   map[string]any{"visibility": "hidden"},
+	}
+	createdField, err := th.App.CreateCPAField(newField)
+	require.Nil(t, err)
+
+	patch := &model.PropertyFieldPatch{
+		Name:       model.NewPointer("Patched name"),
+		Attrs:      model.NewPointer(map[string]any{"visibility": "default"}),
+		TargetID:   model.NewPointer(model.NewId()),
+		TargetType: model.NewPointer(model.NewId()),
+	}
+
+	t.Run("should fail if the field doesn't exist", func(t *testing.T) {
+		updatedField, err := th.App.PatchCPAField(model.NewId(), patch)
+		require.NotNil(t, err)
+		require.Empty(t, updatedField)
+	})
+
+	t.Run("should not allow to patch a field outside of CPA", func(t *testing.T) {
+		newField := &model.PropertyField{
+			GroupID: model.NewId(),
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+		field, err := th.App.Srv().propertyService.CreatePropertyField(newField)
+		require.NoError(t, err)
+
+		updatedField, uErr := th.App.PatchCPAField(field.ID, patch)
+		require.NotNil(t, uErr)
+		require.Equal(t, "app.custom_profile_attributes.property_field_not_found.app_error", uErr.Id)
+		require.Empty(t, updatedField)
+	})
+
+	t.Run("should correctly patch the CPA property field", func(t *testing.T) {
+		time.Sleep(10 * time.Millisecond) // ensure the UpdateAt is different than CreateAt
+
+		updatedField, err := th.App.PatchCPAField(createdField.ID, patch)
+		require.Nil(t, err)
+		require.Equal(t, createdField.ID, updatedField.ID)
+		require.Equal(t, "Patched name", updatedField.Name)
+		require.Equal(t, "default", updatedField.Attrs["visibility"])
+		require.Empty(t, updatedField.TargetID, "CPA should not allow to patch the field's target ID")
+		require.Empty(t, updatedField.TargetType, "CPA should not allow to patch the field's target type")
+		require.Greater(t, updatedField.UpdateAt, createdField.UpdateAt)
+	})
+}
+
+func TestDeleteCPAField(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	newField := &model.PropertyField{
+		GroupID: cpaGroupID,
+		Name:    model.NewId(),
+		Type:    model.PropertyFieldTypeText,
+	}
+	createdField, err := th.App.CreateCPAField(newField)
+	require.Nil(t, err)
+
+	for i := 0; i < 3; i++ {
+		newValue := &model.PropertyValue{
+			TargetID:   model.NewId(),
+			TargetType: "user",
+			GroupID:    cpaGroupID,
+			FieldID:    createdField.ID,
+			Value:      fmt.Sprintf("Value %d", i),
+		}
+		value, err := th.App.Srv().propertyService.CreatePropertyValue(newValue)
+		require.NoError(t, err)
+		require.NotZero(t, value.ID)
+	}
+
+	t.Run("should fail if the field doesn't exist", func(t *testing.T) {
+		err := th.App.DeleteCPAField(model.NewId())
+		require.NotNil(t, err)
+		require.Equal(t, "app.custom_profile_attributes.get_property_field.app_error", err.Id)
+	})
+
+	t.Run("should not allow to delete a field outside of CPA", func(t *testing.T) {
+		newField := &model.PropertyField{
+			GroupID: model.NewId(),
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+		field, err := th.App.Srv().propertyService.CreatePropertyField(newField)
+		require.NoError(t, err)
+
+		dErr := th.App.DeleteCPAField(field.ID)
+		require.NotNil(t, dErr)
+		require.Equal(t, "app.custom_profile_attributes.property_field_not_found.app_error", dErr.Id)
+	})
+
+	t.Run("should correctly delete the field", func(t *testing.T) {
+		// check that we have the associated values to the field prior deletion
+		opts := model.PropertyValueSearchOpts{PerPage: 10, FieldID: createdField.ID}
+		values, err := th.App.Srv().propertyService.SearchPropertyValues(opts)
+		require.NoError(t, err)
+		require.Len(t, values, 3)
+
+		// delete the field
+		require.Nil(t, th.App.DeleteCPAField(createdField.ID))
+
+		// check that it is marked as deleted
+		fetchedField, err := th.App.Srv().propertyService.GetPropertyField(createdField.ID)
+		require.NoError(t, err)
+		require.NotZero(t, fetchedField.DeleteAt)
+
+		// ensure that the associated fields have been marked as deleted too
+		values, err = th.App.Srv().propertyService.SearchPropertyValues(opts)
+		require.NoError(t, err)
+		require.Len(t, values, 0)
+
+		opts.IncludeDeleted = true
+		values, err = th.App.Srv().propertyService.SearchPropertyValues(opts)
+		require.NoError(t, err)
+		require.Len(t, values, 3)
+		for _, value := range values {
+			require.NotZero(t, value.DeleteAt)
+		}
+	})
+}
+
+func TestGetCPAValue(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	fieldID := model.NewId()
+
+	t.Run("should fail if the value doesn't exist", func(t *testing.T) {
+		pv, appErr := th.App.GetCPAValue(model.NewId())
+		require.NotNil(t, appErr)
+		require.Nil(t, pv)
+	})
+
+	t.Run("should fail if the group id is invalid", func(t *testing.T) {
+		propertyValue := &model.PropertyValue{
+			TargetID:   model.NewId(),
+			TargetType: "user",
+			GroupID:    model.NewId(),
+			FieldID:    fieldID,
+			Value:      "Value",
+		}
+		propertyValue, err := th.App.Srv().propertyService.CreatePropertyValue(propertyValue)
+		require.NoError(t, err)
+
+		pv, appErr := th.App.GetCPAValue(propertyValue.ID)
+		require.NotNil(t, appErr)
+		require.Nil(t, pv)
+	})
+
+	t.Run("should succeed if id exists", func(t *testing.T) {
+		propertyValue := &model.PropertyValue{
+			TargetID:   model.NewId(),
+			TargetType: "user",
+			GroupID:    cpaGroupID,
+			FieldID:    fieldID,
+			Value:      "Value",
+		}
+		propertyValue, err := th.App.Srv().propertyService.CreatePropertyValue(propertyValue)
+		require.NoError(t, err)
+
+		pv, appErr := th.App.GetCPAValue(propertyValue.ID)
+		require.Nil(t, appErr)
+		require.NotNil(t, pv)
+	})
+}
+
+func TestPatchCPAValue(t *testing.T) {
+	os.Setenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES", "true")
+	defer os.Unsetenv("MM_FEATUREFLAGS_CUSTOMPROFILEATTRIBUTES")
+	th := Setup(t).InitBasic()
+	defer th.TearDown()
+
+	cpaGroupID, cErr := th.App.cpaGroupID()
+	require.NoError(t, cErr)
+
+	t.Run("should fail if the field doesn't exist", func(t *testing.T) {
+		invalidFieldID := model.NewId()
+		_, appErr := th.App.PatchCPAValue(model.NewId(), invalidFieldID, "fieldValue")
+		require.NotNil(t, appErr)
+	})
+
+	t.Run("should create value if new field value", func(t *testing.T) {
+		newField := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+		createdField, err := th.App.Srv().propertyService.CreatePropertyField(newField)
+		require.NoError(t, err)
+
+		userID := model.NewId()
+		patchedValue, appErr := th.App.PatchCPAValue(userID, createdField.ID, "test value")
+		require.Nil(t, appErr)
+		require.NotNil(t, patchedValue)
+		require.Equal(t, "test value", patchedValue.Value)
+		require.Equal(t, userID, patchedValue.TargetID)
+
+		t.Run("should correctly patch the CPA property value", func(t *testing.T) {
+			patch2, appErr := th.App.PatchCPAValue(userID, createdField.ID, "new patched value")
+			require.Nil(t, appErr)
+			require.NotNil(t, patch2)
+			require.Equal(t, patchedValue.ID, patch2.ID)
+			require.Equal(t, "new patched value", patch2.Value)
+			require.Equal(t, userID, patch2.TargetID)
+		})
+	})
+
+	t.Run("should fail if field is deleted", func(t *testing.T) {
+		newField := &model.PropertyField{
+			GroupID: cpaGroupID,
+			Name:    model.NewId(),
+			Type:    model.PropertyFieldTypeText,
+		}
+		createdField, err := th.App.Srv().propertyService.CreatePropertyField(newField)
+		require.NoError(t, err)
+		err = th.App.Srv().propertyService.DeletePropertyField(createdField.ID)
+		require.NoError(t, err)
+
+		userID := model.NewId()
+		patchedValue, appErr := th.App.PatchCPAValue(userID, createdField.ID, "test value")
+		require.NotNil(t, appErr)
+		require.Nil(t, patchedValue)
+	})
+}
--- a/server/channels/app/opentracing/opentracing_layer.go
+++ b/server/channels/app/opentracing/opentracing_layer.go
@@ -2041,6 +2041,28 @@ func (a *OpenTracingAppLayer) CreateBot(rctx request.CTX, bot *model.Bot) (*mode
 	return resultVar0, resultVar1
 }

+func (a *OpenTracingAppLayer) CreateCPAField(field *model.PropertyField) (*model.PropertyField, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.CreateCPAField")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.CreateCPAField(field)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) CreateChannel(c request.CTX, channel *model.Channel, addMember bool) (*model.Channel, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.CreateChannel")
@@ -3206,6 +3228,28 @@ func (a *OpenTracingAppLayer) DeleteBrandImage(rctx request.CTX) *model.AppError
 	return resultVar0
 }

+func (a *OpenTracingAppLayer) DeleteCPAField(id string) *model.AppError {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.DeleteCPAField")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0 := a.app.DeleteCPAField(id)
+
+	if resultVar0 != nil {
+		span.LogFields(spanlog.Error(resultVar0))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0
+}
+
 func (a *OpenTracingAppLayer) DeleteChannel(c request.CTX, channel *model.Channel, userID string) *model.AppError {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.DeleteChannel")
@@ -5484,6 +5528,50 @@ func (a *OpenTracingAppLayer) GetBulkReactionsForPosts(postIDs []string) (map[st
 	return resultVar0, resultVar1
 }

+func (a *OpenTracingAppLayer) GetCPAField(fieldID string) (*model.PropertyField, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetCPAField")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.GetCPAField(fieldID)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (a *OpenTracingAppLayer) GetCPAValue(valueID string) (*model.PropertyValue, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetCPAValue")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.GetCPAValue(valueID)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) GetChannel(c request.CTX, channelID string) (*model.Channel, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.GetChannel")
@@ -12677,6 +12765,50 @@ func (a *OpenTracingAppLayer) ListAutocompleteCommands(teamID string, T i18n.Tra
 	return resultVar0, resultVar1
 }

+func (a *OpenTracingAppLayer) ListCPAFields() ([]*model.PropertyField, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.ListCPAFields")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.ListCPAFields()
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (a *OpenTracingAppLayer) ListCPAValues(userID string) ([]*model.PropertyValue, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.ListCPAValues")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.ListCPAValues(userID)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) ListDirectory(path string) ([]string, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.ListDirectory")
@@ -13367,6 +13499,50 @@ func (a *OpenTracingAppLayer) PatchBot(rctx request.CTX, botUserId string, botPa
 	return resultVar0, resultVar1
 }

+func (a *OpenTracingAppLayer) PatchCPAField(fieldID string, patch *model.PropertyFieldPatch) (*model.PropertyField, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.PatchCPAField")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.PatchCPAField(fieldID, patch)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
+func (a *OpenTracingAppLayer) PatchCPAValue(userID string, fieldID string, value string) (*model.PropertyValue, *model.AppError) {
+	origCtx := a.ctx
+	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.PatchCPAValue")
+
+	a.ctx = newCtx
+	a.app.Srv().Store().SetContext(newCtx)
+	defer func() {
+		a.app.Srv().Store().SetContext(origCtx)
+		a.ctx = origCtx
+	}()
+
+	defer span.Finish()
+	resultVar0, resultVar1 := a.app.PatchCPAValue(userID, fieldID, value)
+
+	if resultVar1 != nil {
+		span.LogFields(spanlog.Error(resultVar1))
+		ext.Error.Set(span, true)
+	}
+
+	return resultVar0, resultVar1
+}
+
 func (a *OpenTracingAppLayer) PatchChannel(c request.CTX, channel *model.Channel, patch *model.ChannelPatch, userID string) (*model.Channel, *model.AppError) {
 	origCtx := a.ctx
 	span, newCtx := tracing.StartSpanWithParentByContext(a.ctx, "app.PatchChannel")