[MM-44475] Team Unarchive: Do not allow to unarchive if workspace has reached the limit of teams (#20281)

* Prevent cloud limited installations from restoring teams when at or above the teams limit * Code clean up * fix i18n * Actually fix i18n * updates for govet * Update model/client4.go Co-authored-by: Vishal <vish9812@gmail.com> * [MM-44397] Restrict team creation based on subscription limits (#20282) * restrict team creation based on limits * Update api4/team.go Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com> * Fix tests Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com> * Add additional field to teamsusage * Fix * remove useless test * Fix error for team creation * Remove apostrophe Co-authored-by: Mattermod <mattermod@users.noreply.github.com> Co-authored-by: Vishal <vish9812@gmail.com> Co-authored-by: Maria A Nunez <maria.nunez@mattermost.com>
2022-05-31 15:06:54 -04:00
--- a/api4/team.go
+++ b/api4/team.go
@@ -95,6 +95,29 @@ func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}

+	// Freemium enabled, on a cloud license. We must check limits before allowing to create
+	if c.App.Config().FeatureFlags != nil && c.App.Config().FeatureFlags.CloudFree && (c.App.Channels().License() != nil && c.App.Channels().License().Features != nil && *c.App.Channels().License().Features.Cloud) {
+		limits, err := c.App.Cloud().GetCloudLimits(c.AppContext.Session().UserId)
+		if err != nil {
+			c.Err = model.NewAppError("Api4.createTeam", "api.cloud.app_error", nil, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		// If there are no limits for teams, for active teams, or the limit for active teams is less than 0, do nothing
+		if !(limits == nil || limits.Teams == nil || limits.Teams.Active == nil || *limits.Teams.Active <= 0) {
+			teamsUsage, appErr := c.App.GetTeamsUsage()
+			if appErr != nil {
+				c.Err = appErr
+				return
+			}
+			// if the number of active teams is greater than or equal to the limit, return 400
+			if teamsUsage.Active >= int64(*limits.Teams.Active) {
+				c.Err = model.NewAppError("Api4.createTeam", "api.cloud.teams_limit_reached.create", nil, "", http.StatusBadRequest)
+				return
+			}
+		}
+	}
+
 	rteam, err := c.App.CreateTeamWithUser(c.AppContext, &team, c.AppContext.Session().UserId)
 	if err != nil {
 		c.Err = err
@@ -258,6 +281,28 @@ func restoreTeam(c *Context, w http.ResponseWriter, r *http.Request) {
 		c.SetPermissionError(model.PermissionManageTeam)
 		return
 	}
+	// Freemium enabled, on a cloud license. We must check limits before allowing to restore
+	if c.App.Config().FeatureFlags != nil && c.App.Config().FeatureFlags.CloudFree && (c.App.Channels().License() != nil && c.App.Channels().License().Features != nil && *c.App.Channels().License().Features.Cloud) {
+		limits, err := c.App.Cloud().GetCloudLimits(c.AppContext.Session().UserId)
+		if err != nil {
+			c.Err = model.NewAppError("Api4.restoreTeam", "api.cloud.app_error", nil, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		// If there are no limits for teams, for active teams, or the limit for active teams is less than 0, do nothing
+		if !(limits == nil || limits.Teams == nil || limits.Teams.Active == nil || *limits.Teams.Active <= 0) {
+			teamsUsage, appErr := c.App.GetTeamsUsage()
+			if appErr != nil {
+				c.Err = appErr
+				return
+			}
+			// if the number of active teams is greater than or equal to the limit, return 400
+			if teamsUsage.Active >= int64(*limits.Teams.Active) {
+				c.Err = model.NewAppError("Api4.restoreTeam", "api.cloud.teams_limit_reached.restore", nil, "", http.StatusBadRequest)
+				return
+			}
+		}
+	}

 	err := c.App.RestoreTeam(c.Params.TeamId)
 	if err != nil {
--- a/api4/team_test.go
+++ b/api4/team_test.go
@@ -9,6 +9,7 @@ import (
 	"encoding/json"
 	"fmt"
 	"net/http"
+	"os"
 	"strconv"
 	"strings"
 	"testing"
@@ -17,7 +18,9 @@ import (
 	"github.com/stretchr/testify/require"

 	"github.com/mattermost/mattermost-server/v6/app"
+	"github.com/mattermost/mattermost-server/v6/einterfaces/mocks"
 	"github.com/mattermost/mattermost-server/v6/model"
+	"github.com/mattermost/mattermost-server/v6/plugin/plugintest/mock"
 	"github.com/mattermost/mattermost-server/v6/shared/i18n"
 	"github.com/mattermost/mattermost-server/v6/shared/mail"
 	"github.com/mattermost/mattermost-server/v6/utils/testutils"
@@ -67,27 +70,78 @@ func TestCreateTeam(t *testing.T) {
 		assert.Equal(t, *rteam.GroupConstrained, *groupConstrainedTeam.GroupConstrained, "GroupConstrained flags do not match")
 	})

-	th.Client.Logout()
+	t.Run("unauthenticated receives 403", func(t *testing.T) {
+		th.Client.Logout()

-	team := &model.Team{Name: GenerateTestUsername(), DisplayName: "Some Team", Type: model.TeamOpen}
-	_, resp, err := th.Client.CreateTeam(team)
-	require.Error(t, err)
-	CheckUnauthorizedStatus(t, resp)
+		team := &model.Team{Name: GenerateTestUsername(), DisplayName: "Some Team", Type: model.TeamOpen}
+		_, resp, err := th.Client.CreateTeam(team)
+		require.Error(t, err)
+		CheckUnauthorizedStatus(t, resp)

-	th.LoginBasic()
+		th.LoginBasic()

-	// Check the appropriate permissions are enforced.
-	defaultRolePermissions := th.SaveDefaultRolePermissions()
-	defer func() {
-		th.RestoreDefaultRolePermissions(defaultRolePermissions)
-	}()
+		// Check the appropriate permissions are enforced.
+		defaultRolePermissions := th.SaveDefaultRolePermissions()
+		defer func() {
+			th.RestoreDefaultRolePermissions(defaultRolePermissions)
+		}()

-	th.RemovePermissionFromRole(model.PermissionCreateTeam.Id, model.SystemUserRoleId)
-	th.AddPermissionToRole(model.PermissionCreateTeam.Id, model.SystemAdminRoleId)
+		th.RemovePermissionFromRole(model.PermissionCreateTeam.Id, model.SystemUserRoleId)
+		th.AddPermissionToRole(model.PermissionCreateTeam.Id, model.SystemAdminRoleId)

-	_, resp, err = th.Client.CreateTeam(team)
-	require.Error(t, err)
-	CheckForbiddenStatus(t, resp)
+		_, resp, err = th.Client.CreateTeam(team)
+		require.Error(t, err)
+		CheckForbiddenStatus(t, resp)
+	})
+
+	t.Run("cloud limit reached returns 400", func(t *testing.T) {
+		os.Setenv("MM_FEATUREFLAGS_CLOUDFREE", "true")
+		defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDFREE")
+		th.App.ReloadConfig()
+		th.App.Srv().SetLicense(model.NewTestLicense("cloud"))
+
+		cloud := &mocks.CloudInterface{}
+		cloudImpl := th.App.Srv().Cloud
+		defer func() {
+			th.App.Srv().Cloud = cloudImpl
+		}()
+		th.App.Srv().Cloud = cloud
+
+		cloud.Mock.On("GetCloudLimits", mock.Anything).Return(&model.ProductLimits{
+			Teams: &model.TeamsLimits{
+				Active: model.NewInt(1),
+			},
+		}, nil).Once()
+		team := &model.Team{Name: GenerateTestUsername(), DisplayName: "Some Team", Type: model.TeamOpen}
+		_, resp, err := th.Client.CreateTeam(team)
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("cloud below limit returns 200", func(t *testing.T) {
+		os.Setenv("MM_FEATUREFLAGS_CLOUDFREE", "true")
+		defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDFREE")
+		th.App.ReloadConfig()
+		defer th.App.ReloadConfig()
+		th.App.Srv().SetLicense(model.NewTestLicense("cloud"))
+
+		cloud := &mocks.CloudInterface{}
+		cloudImpl := th.App.Srv().Cloud
+		defer func() {
+			th.App.Srv().Cloud = cloudImpl
+		}()
+		th.App.Srv().Cloud = cloud
+
+		cloud.Mock.On("GetCloudLimits", mock.Anything).Return(&model.ProductLimits{
+			Teams: &model.TeamsLimits{
+				Active: model.NewInt(200),
+			},
+		}, nil).Once()
+		team := &model.Team{Name: GenerateTestUsername(), DisplayName: "Some Team", Type: model.TeamOpen}
+		_, resp, err := th.Client.CreateTeam(team)
+		require.NoError(t, err)
+		CheckCreatedStatus(t, resp)
+	})
 }

 func TestCreateTeamSanitization(t *testing.T) {
@@ -578,6 +632,56 @@ func TestRestoreTeam(t *testing.T) {
 		require.NoError(t, err)
 		CheckOKStatus(t, resp)
 	})
+
+	t.Run("cloud limit reached returns 400", func(t *testing.T) {
+		// Create an archived team to be restored later
+		team := createTeam(t, true, model.TeamOpen)
+		os.Setenv("MM_FEATUREFLAGS_CLOUDFREE", "true")
+		defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDFREE")
+		th.App.ReloadConfig()
+		th.App.Srv().SetLicense(model.NewTestLicense("cloud"))
+
+		cloud := &mocks.CloudInterface{}
+		cloudImpl := th.App.Srv().Cloud
+		defer func() {
+			th.App.Srv().Cloud = cloudImpl
+		}()
+		th.App.Srv().Cloud = cloud
+
+		cloud.Mock.On("GetCloudLimits", mock.Anything).Return(&model.ProductLimits{
+			Teams: &model.TeamsLimits{
+				Active: model.NewInt(1),
+			},
+		}, nil).Once()
+
+		_, resp, err := client.RestoreTeam(team.Id)
+		require.Error(t, err)
+		CheckBadRequestStatus(t, resp)
+	})
+
+	t.Run("cloud below limit returns 200", func(t *testing.T) {
+		os.Setenv("MM_FEATUREFLAGS_CLOUDFREE", "true")
+		defer os.Unsetenv("MM_FEATUREFLAGS_CLOUDFREE")
+		th.App.ReloadConfig()
+		th.App.Srv().SetLicense(model.NewTestLicense("cloud"))
+
+		cloud := &mocks.CloudInterface{}
+		cloudImpl := th.App.Srv().Cloud
+		defer func() {
+			th.App.Srv().Cloud = cloudImpl
+		}()
+		th.App.Srv().Cloud = cloud
+
+		cloud.Mock.On("GetCloudLimits", mock.Anything).Return(&model.ProductLimits{
+			Teams: &model.TeamsLimits{
+				Active: model.NewInt(200),
+			},
+		}, nil).Twice()
+		team := createTeam(t, true, model.TeamOpen)
+		_, resp, err := client.RestoreTeam(team.Id)
+		require.NoError(t, err)
+		CheckOKStatus(t, resp)
+	})
 }

 func TestPatchTeamSanitization(t *testing.T) {
--- a/api4/usage.go
+++ b/api4/usage.go
@@ -13,6 +13,8 @@ import (
 func (api *API) InitUsage() {
 	// GET /api/v4/usage/posts
 	api.BaseRoutes.Usage.Handle("/posts", api.APISessionRequired(getPostsUsage)).Methods("GET")
+	// GET /api/v4/usage/teams
+	api.BaseRoutes.Usage.Handle("/teams", api.APISessionRequired(getTeamsUsage)).Methods("GET")

 	// GET /api/v4/usage/integrations
 	api.BaseRoutes.Usage.Handle("/integrations", api.APISessionRequired(getIntegrationsUsage)).Methods("GET")
@@ -34,6 +36,24 @@ func getPostsUsage(c *Context, w http.ResponseWriter, r *http.Request) {
 	w.Write(json)
 }

+func getTeamsUsage(c *Context, w http.ResponseWriter, r *http.Request) {
+	teamsUsage, appErr := c.App.GetTeamsUsage()
+	if appErr != nil {
+		c.Err = model.NewAppError("Api4.getTeamsUsage", "app.teams.analytics_teams_count.app_error", nil, appErr.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	if teamsUsage == nil {
+		c.Err = model.NewAppError("Api4.getTeamsUsage", "app.teams.analytics_teams_count.app_error", nil, appErr.Error(), http.StatusInternalServerError)
+	}
+
+	json, err := json.Marshal(teamsUsage)
+	if err != nil {
+		c.Err = model.NewAppError("Api4.getTeamsUsage", "api.marshal_error", nil, err.Error(), http.StatusInternalServerError)
+	}
+	w.Write(json)
+}
+
 func getIntegrationsUsage(c *Context, w http.ResponseWriter, r *http.Request) {
 	if !*c.App.Config().PluginSettings.Enable {
 		json, err := json.Marshal(&model.IntegrationsUsage{})
--- a/api4/usage_test.go
+++ b/api4/usage_test.go
@@ -50,6 +50,34 @@ func TestGetPostsUsage(t *testing.T) {
 	})
 }

+func TestGetTeamsUsage(t *testing.T) {
+	t.Run("unauthenticated users can not access", func(t *testing.T) {
+		th := Setup(t)
+		defer th.TearDown()
+
+		th.Client.Logout()
+
+		usage, r, err := th.Client.GetTeamsUsage()
+		assert.Error(t, err)
+		assert.Nil(t, usage)
+		assert.Equal(t, http.StatusUnauthorized, r.StatusCode)
+	})
+
+	t.Run("good request returns response", func(t *testing.T) {
+		// Following calls create a total of 3 teams
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+		th.CreateTeam()
+		th.CreateTeam()
+
+		usage, r, err := th.Client.GetTeamsUsage()
+		assert.NoError(t, err)
+		assert.Equal(t, http.StatusOK, r.StatusCode)
+		assert.NotNil(t, usage)
+		assert.Equal(t, int64(3), usage.Active)
+	})
+}
+
 func TestGetIntegrationsUsage(t *testing.T) {
 	t.Run("unauthenticated users can not access", func(t *testing.T) {
 		th := Setup(t)